All of lore.kernel.org
 help / color / mirror / Atom feed
From: Sasha Levin <sashal@kernel.org>
To: stable@vger.kernel.org, linux-kernel@vger.kernel.org
Cc: Daniel Axtens <dja@axtens.net>,
	Michael Ellerman <mpe@ellerman.id.au>,
	Sasha Levin <sashal@kernel.org>
Subject: [PATCH AUTOSEL 4.9 07/21] powerpc/nohash: fix undefined behaviour when testing page size support
Date: Sun,  4 Nov 2018 08:53:41 -0500	[thread overview]
Message-ID: <20181104135355.88602-7-sashal@kernel.org> (raw)
In-Reply-To: <20181104135355.88602-1-sashal@kernel.org>

From: Daniel Axtens <dja@axtens.net>

[ Upstream commit f5e284803a7206d43e26f9ffcae5de9626d95e37 ]

When enumerating page size definitions to check hardware support,
we construct a constant which is (1U << (def->shift - 10)).

However, the array of page size definitions is only initalised for
various MMU_PAGE_* constants, so it contains a number of 0-initialised
elements with def->shift == 0. This means we end up shifting by a
very large number, which gives the following UBSan splat:

================================================================================
UBSAN: Undefined behaviour in /home/dja/dev/linux/linux/arch/powerpc/mm/tlb_nohash.c:506:21
shift exponent 4294967286 is too large for 32-bit type 'unsigned int'
CPU: 0 PID: 0 Comm: swapper Not tainted 4.19.0-rc3-00045-ga604f927b012-dirty #6
Call Trace:
[c00000000101bc20] [c000000000a13d54] .dump_stack+0xa8/0xec (unreliable)
[c00000000101bcb0] [c0000000004f20a8] .ubsan_epilogue+0x18/0x64
[c00000000101bd30] [c0000000004f2b10] .__ubsan_handle_shift_out_of_bounds+0x110/0x1a4
[c00000000101be20] [c000000000d21760] .early_init_mmu+0x1b4/0x5a0
[c00000000101bf10] [c000000000d1ba28] .early_setup+0x100/0x130
[c00000000101bf90] [c000000000000528] start_here_multiplatform+0x68/0x80
================================================================================

Fix this by first checking if the element exists (shift != 0) before
constructing the constant.

Signed-off-by: Daniel Axtens <dja@axtens.net>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/powerpc/mm/tlb_nohash.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/arch/powerpc/mm/tlb_nohash.c b/arch/powerpc/mm/tlb_nohash.c
index 0b50019505a5..79cf21be8f6e 100644
--- a/arch/powerpc/mm/tlb_nohash.c
+++ b/arch/powerpc/mm/tlb_nohash.c
@@ -481,6 +481,9 @@ static void setup_page_sizes(void)
 		for (psize = 0; psize < MMU_PAGE_COUNT; ++psize) {
 			struct mmu_psize_def *def = &mmu_psize_defs[psize];
 
+			if (!def->shift)
+				continue;
+
 			if (tlb1ps & (1U << (def->shift - 10))) {
 				def->flags |= MMU_PAGE_SIZE_DIRECT;
 
-- 
2.17.1


  parent reply	other threads:[~2018-11-04 13:58 UTC|newest]

Thread overview: 21+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2018-11-04 13:53 [PATCH AUTOSEL 4.9 01/21] mm/vmstat.c: assert that vmstat_text is in sync with stat_items_size Sasha Levin
2018-11-04 13:53 ` [PATCH AUTOSEL 4.9 02/21] userfaultfd: allow get_mempolicy(MPOL_F_NODE|MPOL_F_ADDR) to trigger userfaults Sasha Levin
2018-11-04 13:53 ` [PATCH AUTOSEL 4.9 03/21] mm: don't warn about large allocations for slab Sasha Levin
2018-11-04 13:53 ` [PATCH AUTOSEL 4.9 04/21] powerpc/eeh: Fix possible null deref in eeh_dump_dev_log() Sasha Levin
2018-11-04 13:53 ` [PATCH AUTOSEL 4.9 05/21] tty: check name length in tty_find_polling_driver() Sasha Levin
2018-11-04 13:53 ` [PATCH AUTOSEL 4.9 06/21] ARM: imx_v6_v7_defconfig: Select CONFIG_TMPFS_POSIX_ACL Sasha Levin
2018-11-04 13:53 ` Sasha Levin [this message]
2018-11-04 13:53 ` [PATCH AUTOSEL 4.9 08/21] watchdog: lantiq: update register names to better match spec Sasha Levin
2018-11-04 13:53 ` [PATCH AUTOSEL 4.9 09/21] drm/omap: fix memory barrier bug in DMM driver Sasha Levin
2018-11-04 13:53 ` [PATCH AUTOSEL 4.9 10/21] iio: adc: at91: fix wrong channel number in triggered buffer mode Sasha Levin
2018-11-04 13:53 ` [PATCH AUTOSEL 4.9 11/21] iio: adc: at91: fix acking DRDY irq on simple conversions Sasha Levin
2018-11-04 13:53 ` [PATCH AUTOSEL 4.9 12/21] media: pci: cx23885: handle adding to list failure Sasha Levin
2018-11-04 13:53 ` [PATCH AUTOSEL 4.9 13/21] iio: adc: imx25-gcq: Fix leak of device_node in mx25_gcq_setup_cfgs() Sasha Levin
2018-11-04 13:53 ` [PATCH AUTOSEL 4.9 14/21] MIPS: kexec: Mark CPU offline before disabling local IRQ Sasha Levin
2018-11-04 13:53 ` [PATCH AUTOSEL 4.9 15/21] powerpc/boot: Ensure _zimage_start is a weak symbol Sasha Levin
2018-11-04 13:53 ` [PATCH AUTOSEL 4.9 16/21] MIPS/PCI: Call pcie_bus_configure_settings() to set MPS/MRRS Sasha Levin
2018-11-04 13:53 ` [PATCH AUTOSEL 4.9 17/21] sc16is7xx: Fix for multi-channel stall Sasha Levin
2018-11-04 13:53 ` [PATCH AUTOSEL 4.9 18/21] media: tvp5150: fix width alignment during set_selection() Sasha Levin
2018-11-04 13:53 ` [PATCH AUTOSEL 4.9 19/21] powerpc/selftests: Wait all threads to join Sasha Levin
2018-11-04 13:53 ` [PATCH AUTOSEL 4.9 20/21] 9p locks: fix glock.client_id leak in do_lock Sasha Levin
2018-11-04 13:53 ` [PATCH AUTOSEL 4.9 21/21] 9p: clear dangling pointers in p9stat_free Sasha Levin

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20181104135355.88602-7-sashal@kernel.org \
    --to=sashal@kernel.org \
    --cc=dja@axtens.net \
    --cc=linux-kernel@vger.kernel.org \
    --cc=mpe@ellerman.id.au \
    --cc=stable@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.