lkml.org 
[lkml]   [2022]   [Jan]   [24]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.16 0464/1039] powerpc/32s: Fix shift-out-of-bounds in KASAN init
    Date
    From: Christophe Leroy <christophe.leroy@csgroup.eu>

    [ Upstream commit af11dee4361b3519981fa04d014873f9d9edd6ac ]

    ================================================================================
    UBSAN: shift-out-of-bounds in arch/powerpc/mm/kasan/book3s_32.c:22:23
    shift exponent -1 is negative
    CPU: 0 PID: 0 Comm: swapper Not tainted 5.15.5-gentoo-PowerMacG4 #9
    Call Trace:
    [c214be60] [c0ba0048] dump_stack_lvl+0x80/0xb0 (unreliable)
    [c214be80] [c0b99288] ubsan_epilogue+0x10/0x5c
    [c214be90] [c0b98fe0] __ubsan_handle_shift_out_of_bounds+0x94/0x138
    [c214bf00] [c1c0f010] kasan_init_region+0xd8/0x26c
    [c214bf30] [c1c0ed84] kasan_init+0xc0/0x198
    [c214bf70] [c1c08024] setup_arch+0x18/0x54c
    [c214bfc0] [c1c037f0] start_kernel+0x90/0x33c
    [c214bff0] [00003610] 0x3610
    ================================================================================

    This happens when the directly mapped memory is a power of 2.

    Fix it by checking the shift and set the result to 0 when shift is -1

    Fixes: 7974c4732642 ("powerpc/32s: Implement dedicated kasan_init_region()")
    Reported-by: Erhard Furtner <erhard_f@mailbox.org>
    Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu>
    Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
    Link: https://bugzilla.kernel.org/show_bug.cgi?id=215169
    Link: https://lore.kernel.org/r/15cbc3439d4ad988b225e2119ec99502a5cc6ad3.1638261744.git.christophe.leroy@csgroup.eu
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    arch/powerpc/mm/kasan/book3s_32.c | 3 ++-
    1 file changed, 2 insertions(+), 1 deletion(-)

    diff --git a/arch/powerpc/mm/kasan/book3s_32.c b/arch/powerpc/mm/kasan/book3s_32.c
    index 202bd260a0095..35b287b0a8da4 100644
    --- a/arch/powerpc/mm/kasan/book3s_32.c
    +++ b/arch/powerpc/mm/kasan/book3s_32.c
    @@ -19,7 +19,8 @@ int __init kasan_init_region(void *start, size_t size)
    block = memblock_alloc(k_size, k_size_base);

    if (block && k_size_base >= SZ_128K && k_start == ALIGN(k_start, k_size_base)) {
    - int k_size_more = 1 << (ffs(k_size - k_size_base) - 1);
    + int shift = ffs(k_size - k_size_base);
    + int k_size_more = shift ? 1 << (shift - 1) : 0;

    setbat(-1, k_start, __pa(block), k_size_base, PAGE_KERNEL);
    if (k_size_more >= SZ_128K)
    --
    2.34.1


    \
     
     \ /
      Last update: 2022-01-25 01:12    [W:2.350 / U:0.304 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site