The patch titled
Subject: hugetlbfs-check-for-pgoff-value-overflow-v3
has been added to the -mm tree. Its filename is
hugetlbfs-check-for-pgoff-value-overflow-v3.patch
This patch should soon appear at
http://ozlabs.org/~akpm/mmots/broken-out/hugetlbfs-check-for-pgoff-value-overflow-v3.patch
and later at
http://ozlabs.org/~akpm/mmotm/broken-out/hugetlbfs-check-for-pgoff-value-overflow-v3.patch
Before you just go and hit "reply", please:
a) Consider who else should be cc'ed
b) Prefer to cc a suitable mailing list as well
c) Ideally: find the original patch on the mailing list and do a
reply-to-all to that, adding suitable additional cc's
*** Remember to use Documentation/SubmitChecklist when testing your code ***
The -mm tree is included into linux-next and is updated
there every 3-4 working days
------------------------------------------------------
From: Mike Kravetz <mike.kravetz@xxxxxxxxxx>
Subject: hugetlbfs-check-for-pgoff-value-overflow-v3
Link: http://lkml.kernel.org/r/20180309002726.7248-1-mike.kravetz@xxxxxxxxxx
Fixes: 045c7a3f53d9 ("hugetlbfs: fix offset overflow in hugetlbfs mmap")
Signed-off-by: Mike Kravetz <mike.kravetz@xxxxxxxxxx>
Reported-by: Nic Losby <blurbdust@xxxxxxxxx>
Cc: Michal Hocko <mhocko@xxxxxxxxxx>
Cc: "Kirill A . Shutemov" <kirill.shutemov@xxxxxxxxxxxxxxx>
Cc: Yisheng Xie <xieyisheng1@xxxxxxxxxx>
Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx>
---
diff -puN fs/hugetlbfs/inode.c~hugetlbfs-check-for-pgoff-value-overflow-v3 fs/hugetlbfs/inode.c
--- a/fs/hugetlbfs/inode.c~hugetlbfs-check-for-pgoff-value-overflow-v3
+++ a/fs/hugetlbfs/inode.c
@@ -108,10 +108,18 @@ static void huge_pagevec_release(struct
pagevec_reinit(pvec);
}
+/*
+ * Mask used when checking the page offset value passed in via system
+ * calls. This value will be converted to a loff_t which is signed.
+ * Therefore, we want to check the upper PAGE_SHIFT + 1 bits of the
+ * value. The extra bit (- 1 in the shift value) is to take the sign
+ * bit into account.
+ */
+#define PGOFF_LOFFT_MAX (PAGE_MASK << (BITS_PER_LONG - (2 * PAGE_SHIFT) - 1))
+
static int hugetlbfs_file_mmap(struct file *file, struct vm_area_struct *vma)
{
struct inode *inode = file_inode(file);
- unsigned long ovfl_mask;
loff_t len, vma_len;
int ret;
struct hstate *h = hstate_file(file);
@@ -131,10 +139,7 @@ static int hugetlbfs_file_mmap(struct fi
* page based offset in vm_pgoff could be sufficiently large to
* overflow a (l)off_t when converted to byte offset.
*/
- ovfl_mask = (1UL << (PAGE_SHIFT + 1)) - 1;
- ovfl_mask <<= ((sizeof(unsigned long) * BITS_PER_BYTE) -
- (PAGE_SHIFT + 1));
- if (vma->vm_pgoff & ovfl_mask)
+ if (vma->vm_pgoff & PGOFF_LOFFT_MAX)
return -EINVAL;
/* must be huge page aligned */
_
Patches currently in -mm which might be from mike.kravetz@xxxxxxxxxx are
hugetlbfs-check-for-pgoff-value-overflow.patch
hugetlbfs-check-for-pgoff-value-overflow-v3.patch
mm-hugetlbfs-move-hugetlbfs_i-outside-ifdef-config_hugetlbfs.patch
mm-memfd-split-out-memfd-for-use-by-multiple-filesystems.patch
mm-memfd-remove-memfd-code-from-shmem-files-and-use-new-memfd-files.patch
--
To unsubscribe from this list: send the line "unsubscribe mm-commits" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
