All of lore.kernel.org
 help / color / mirror / Atom feed
From: Andrew Morton <akpm@linux-foundation.org>
To: stable@vger.kernel.org,mike.kravetz@oracle.com,liuyuntao10@huawei.com,akpm@linux-foundation.org,patches@lists.linux.dev,linux-mm@kvack.org,mm-commits@vger.kernel.org,torvalds@linux-foundation.org,akpm@linux-foundation.org
Subject: [patch 04/12] hugetlbfs: fix a truncation issue in hugepages parameter
Date: Fri, 25 Feb 2022 19:11:02 -0800	[thread overview]
Message-ID: <20220226031103.37D84C340E7@smtp.kernel.org> (raw)
In-Reply-To: <20220225191021.f71538a3f43dc448110e88b6@linux-foundation.org>

From: Liu Yuntao <liuyuntao10@huawei.com>
Subject: hugetlbfs: fix a truncation issue in hugepages parameter

When we specify a large number for node in hugepages parameter, it may be
parsed to another number due to truncation in this statement:

	node = tmp;

For example, add following parameter in command line:

	hugepagesz=1G hugepages=4294967297:5

and kernel will allocate 5 hugepages for node 1 instead of ignoring it.

I move the validation check earlier to fix this issue, and slightly
simplifies the condition here.

Link: https://lkml.kernel.org/r/20220209134018.8242-1-liuyuntao10@huawei.com
Fixes: b5389086ad7be0 ("hugetlbfs: extend the definition of hugepages parameter to support node allocation")
Signed-off-by: Liu Yuntao <liuyuntao10@huawei.com>
Reviewed-by: Mike Kravetz <mike.kravetz@oracle.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
---

 mm/hugetlb.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- a/mm/hugetlb.c~hugetlbfs-fix-a-truncation-issue-in-hugepages-parameter
+++ a/mm/hugetlb.c
@@ -4159,10 +4159,10 @@ static int __init hugepages_setup(char *
 				pr_warn("HugeTLB: architecture can't support node specific alloc, ignoring!\n");
 				return 0;
 			}
+			if (tmp >= nr_online_nodes)
+				goto invalid;
 			node = tmp;
 			p += count + 1;
-			if (node < 0 || node >= nr_online_nodes)
-				goto invalid;
 			/* Parse hugepages */
 			if (sscanf(p, "%lu%n", &tmp, &count) != 1)
 				goto invalid;
_

WARNING: multiple messages have this Message-ID (diff)
From: Andrew Morton <akpm@linux-foundation.org>
To: stable@vger.kernel.org, mike.kravetz@oracle.com,
	liuyuntao10@huawei.com, akpm@linux-foundation.org,
	patches@lists.linux.dev, linux-mm@kvack.org,
	mm-commits@vger.kernel.org, torvalds@linux-foundation.org,
	akpm@linux-foundation.org
Subject: [patch 04/12] hugetlbfs: fix a truncation issue in hugepages parameter
Date: Fri, 25 Feb 2022 19:11:02 -0800	[thread overview]
Message-ID: <20220226031103.37D84C340E7@smtp.kernel.org> (raw)
In-Reply-To: <20220225191021.f71538a3f43dc448110e88b6@linux-foundation.org>

From: Liu Yuntao <liuyuntao10@huawei.com>
Subject: hugetlbfs: fix a truncation issue in hugepages parameter

When we specify a large number for node in hugepages parameter, it may be
parsed to another number due to truncation in this statement:

	node = tmp;

For example, add following parameter in command line:

	hugepagesz=1G hugepages=4294967297:5

and kernel will allocate 5 hugepages for node 1 instead of ignoring it.

I move the validation check earlier to fix this issue, and slightly
simplifies the condition here.

Link: https://lkml.kernel.org/r/20220209134018.8242-1-liuyuntao10@huawei.com
Fixes: b5389086ad7be0 ("hugetlbfs: extend the definition of hugepages parameter to support node allocation")
Signed-off-by: Liu Yuntao <liuyuntao10@huawei.com>
Reviewed-by: Mike Kravetz <mike.kravetz@oracle.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
---

 mm/hugetlb.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- a/mm/hugetlb.c~hugetlbfs-fix-a-truncation-issue-in-hugepages-parameter
+++ a/mm/hugetlb.c
@@ -4159,10 +4159,10 @@ static int __init hugepages_setup(char *
 				pr_warn("HugeTLB: architecture can't support node specific alloc, ignoring!\n");
 				return 0;
 			}
+			if (tmp >= nr_online_nodes)
+				goto invalid;
 			node = tmp;
 			p += count + 1;
-			if (node < 0 || node >= nr_online_nodes)
-				goto invalid;
 			/* Parse hugepages */
 			if (sscanf(p, "%lu%n", &tmp, &count) != 1)
 				goto invalid;
_

  parent reply	other threads:[~2022-02-26  3:11 UTC|newest]

Thread overview: 25+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2022-02-26  3:10 incoming Andrew Morton
2022-02-26  3:10 ` [patch 01/12] MAINTAINERS: add sysctl-next git tree Andrew Morton
2022-02-26  3:10   ` Andrew Morton
2022-02-26  3:10 ` [patch 02/12] mm/hugetlb: fix kernel crash with hugetlb mremap Andrew Morton
2022-02-26  3:10   ` Andrew Morton
2022-02-26  3:10 ` [patch 03/12] kasan: test: prevent cache merging in kmem_cache_double_destroy Andrew Morton
2022-02-26  3:10   ` Andrew Morton
2022-02-26  3:11 ` Andrew Morton [this message]
2022-02-26  3:11   ` [patch 04/12] hugetlbfs: fix a truncation issue in hugepages parameter Andrew Morton
2022-02-26  3:11 ` [patch 05/12] mm: fix use-after-free bug when mm->mmap is reused after being freed Andrew Morton
2022-02-26  3:11   ` Andrew Morton
2022-02-26  3:11 ` [patch 06/12] selftest/vm: fix map_fixed_noreplace test failure Andrew Morton
2022-02-26  3:11   ` Andrew Morton
2022-02-26  3:11 ` [patch 07/12] MAINTAINERS: add Roman as a memcg co-maintainer Andrew Morton
2022-02-26  3:11   ` Andrew Morton
2022-02-26  3:11 ` [patch 08/12] MAINTAINERS: remove Vladimir from memcg maintainers Andrew Morton
2022-02-26  3:11   ` Andrew Morton
2022-02-26  3:11 ` [patch 09/12] MAINTAINERS: add Shakeel as a memcg co-maintainer Andrew Morton
2022-02-26  3:11   ` Andrew Morton
2022-02-26  3:11 ` [patch 10/12] MAINTAINERS, SLAB: add Roman as reviewer, git tree Andrew Morton
2022-02-26  3:11   ` Andrew Morton
2022-02-26  3:11 ` [patch 11/12] mailmap: update Roman Gushchin's email Andrew Morton
2022-02-26  3:11   ` Andrew Morton
2022-02-26  3:11 ` [patch 12/12] selftests/memfd: clean up mapping in mfd_fail_write Andrew Morton
2022-02-26  3:11   ` Andrew Morton

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20220226031103.37D84C340E7@smtp.kernel.org \
    --to=akpm@linux-foundation.org \
    --cc=linux-mm@kvack.org \
    --cc=liuyuntao10@huawei.com \
    --cc=mike.kravetz@oracle.com \
    --cc=mm-commits@vger.kernel.org \
    --cc=patches@lists.linux.dev \
    --cc=stable@vger.kernel.org \
    --cc=torvalds@linux-foundation.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.