This is a fix for a regression in 32 bit kernels caused by an
invalid check for pgoff overflow in hugetlbfs mmap setup. The
check incorrectly specified that the size of a loff_t was the
same as the size of a long. The regression prevents mapping
hugetlbfs files at offset greater than 4GB on 32 bit kernels.
Fix the check by using sizeof(loff_t) to get size. In addition,
make sure pgoff + length can be represented by a signed long
huge page offset. This check is only necessary on 32 bit kernels.
Fixes: 63489f8e8211 ("hugetlbfs: check for pgoff value overflow")
Cc: <stable@xxxxxxxxxxxxxxx>
Reported-by: Dan Rue <dan.rue@xxxxxxxxxx>
Signed-off-by: Mike Kravetz <mike.kravetz@xxxxxxxxxx>
---
fs/hugetlbfs/inode.c | 22 +++++++++++++++++-----
1 file changed, 17 insertions(+), 5 deletions(-)
diff --git a/fs/hugetlbfs/inode.c b/fs/hugetlbfs/inode.c
index b9a254dcc0e7..8450a1d75dfa 100644
--- a/fs/hugetlbfs/inode.c
+++ b/fs/hugetlbfs/inode.c
@@ -116,7 +116,8 @@ static void huge_pagevec_release(struct pagevec *pvec)
* bit into account.
*/
#define PGOFF_LOFFT_MAX \
- (((1UL << (PAGE_SHIFT + 1)) - 1) << (BITS_PER_LONG - (PAGE_SHIFT + 1)))
+ (((1UL << (PAGE_SHIFT + 1)) - 1) << \
+ ((sizeof(loff_t) * BITS_PER_BYTE) - (PAGE_SHIFT + 1)))
static int hugetlbfs_file_mmap(struct file *file, struct vm_area_struct *vma)
{
@@ -138,21 +139,32 @@ static int hugetlbfs_file_mmap(struct file *file, struct vm_area_struct *vma)
/*
* page based offset in vm_pgoff could be sufficiently large to
- * overflow a (l)off_t when converted to byte offset.
+ * overflow a loff_t when converted to byte offset.
*/
- if (vma->vm_pgoff & PGOFF_LOFFT_MAX)
+ if ((loff_t)vma->vm_pgoff & (loff_t)PGOFF_LOFFT_MAX)
return -EINVAL;
- /* must be huge page aligned */
+ /* vm_pgoff must be huge page aligned */
if (vma->vm_pgoff & (~huge_page_mask(h) >> PAGE_SHIFT))
return -EINVAL;
+ /*
+ * Compute file offset of the end of this mapping
+ */
vma_len = (loff_t)(vma->vm_end - vma->vm_start);
len = vma_len + ((loff_t)vma->vm_pgoff << PAGE_SHIFT);
- /* check for overflow */
+
+ /* Check to ensure this did not overflow loff_t */
if (len < vma_len)
return -EINVAL;
+ /*
+ * On 32 bit systems, this check is necessary to ensure the last page
+ * of mapping can be represented as a signed long huge page index.
+ */
+ if ((len >> huge_page_shift(h)) > LONG_MAX)
+ return -EINVAL;
+
inode_lock(inode);
file_accessed(file);
--
2.13.6
