On Thu, 8 Mar 2018 16:27:26 -0800 Mike Kravetz <mike.kravetz@xxxxxxxxxx> wrote:
> A vma with vm_pgoff large enough to overflow a loff_t type when
> converted to a byte offset can be passed via the remap_file_pages
> system call. The hugetlbfs mmap routine uses the byte offset to
> calculate reservations and file size.
>
> A sequence such as:
> mmap(0x20a00000, 0x600000, 0, 0x66033, -1, 0);
> remap_file_pages(0x20a00000, 0x600000, 0, 0x20000000000000, 0);
> will result in the following when task exits/file closed,
> kernel BUG at mm/hugetlb.c:749!
> Call Trace:
> hugetlbfs_evict_inode+0x2f/0x40
> evict+0xcb/0x190
> __dentry_kill+0xcb/0x150
> __fput+0x164/0x1e0
> task_work_run+0x84/0xa0
> exit_to_usermode_loop+0x7d/0x80
> do_syscall_64+0x18b/0x190
> entry_SYSCALL_64_after_hwframe+0x3d/0xa2
>
> The overflowed pgoff value causes hugetlbfs to try to set up a
> mapping with a negative range (end < start) that leaves invalid
> state which causes the BUG.
>
> The previous overflow fix to this code was incomplete and did not
> take the remap_file_pages system call into account.
>
> ...
>
> --- a/mm/hugetlb.c
> +++ b/mm/hugetlb.c
> @@ -4374,6 +4374,12 @@ int hugetlb_reserve_pages(struct inode *inode,
> struct resv_map *resv_map;
> long gbl_reserve;
>
> + /* This should never happen */
> + if (from > to) {
> + VM_WARN(1, "%s called with a negative range\n", __func__);
> + return -EINVAL;
> + }
This is tidier, and that comment is a bit too obvious to live ;)
--- a/mm/hugetlb.c~hugetlbfs-check-for-pgoff-value-overflow-v3-fix
+++ a/mm/hugetlb.c
@@ -18,6 +18,7 @@
#include <linux/bootmem.h>
#include <linux/sysfs.h>
#include <linux/slab.h>
+#include <linux/mmdebug.h>
#include <linux/sched/signal.h>
#include <linux/rmap.h>
#include <linux/string_helpers.h>
@@ -4374,11 +4375,8 @@ int hugetlb_reserve_pages(struct inode *
struct resv_map *resv_map;
long gbl_reserve;
- /* This should never happen */
- if (from > to) {
- VM_WARN(1, "%s called with a negative range\n", __func__);
+ if (VM_WARN(from > to, "%s called with a negative range\n", __func__))
return -EINVAL;
- }
/*
* Only apply hugepage reservation if asked. At fault time, an