[bug report] mm: huge_memory: enable debugfs to split huge pages to any order

[Dan Carpenter <dan.carpenter@linaro.org>]

Hello Zi Yan,

Commit fc4d182316bd ("mm: huge_memory: enable debugfs to split huge
pages to any order") from Feb 26, 2024 (linux-next), leads to the
following Smatch static checker warning:

	mm/huge_memory.c:2898 __split_huge_page()
	error: undefined (user controlled) shift '1 << new_order'

mm/huge_memory.c
    2889 static void __split_huge_page(struct page *page, struct list_head *list,
    2890                 pgoff_t end, unsigned int new_order)
    2891 {
    2892         struct folio *folio = page_folio(page);
    2893         struct page *head = &folio->page;
    2894         struct lruvec *lruvec;
    2895         struct address_space *swap_cache = NULL;
    2896         unsigned long offset = 0;
    2897         int i, nr_dropped = 0;
--> 2898         unsigned int new_nr = 1 << new_order;
                                            ^^^^^^^^^
The new_order variable comes from the user via debugfs.

    2899         int order = folio_order(folio);
    2900         unsigned int nr = 1 << order;
    2901 
    2902         /* complete memcg works before add pages to LRU */
    2903         split_page_memcg(head, order, new_order);
    2904 
    2905         if (folio_test_anon(folio) && folio_test_swapcache(folio)) {
    2906                 offset = swp_offset(folio->swap);
    2907                 swap_cache = swap_address_space(folio->swap);

Here is the debugfs code in split_huge_pages_write()

mm/huge_memory.c
  3628  
  3629          ret = sscanf(input_buf, "%d,0x%lx,0x%lx,%d", &pid, &vaddr_start, &vaddr_end, &new_order);
                                                                                             ^^^^^^^^^^
We just read new_order

  3630          if (ret == 1 && pid == 1) {
  3631                  split_huge_pages_all();
  3632                  ret = strlen(input_buf);
  3633                  goto out;
  3634          } else if (ret != 3 && ret != 4) {
  3635                  ret = -EINVAL;
  3636                  goto out;
  3637          }
  3638  
  3639          ret = split_huge_pages_pid(pid, vaddr_start, vaddr_end, new_order);
                                                                        ^^^^^^^^^
And pass it directly with no bounds checking.  Debugfs code is root
only...  We used to take a view that if root does something stupid then
they get what they deserve.  But these days syzbot is fuzz testing stuff
even when it's root only and complaining about shift wraps or other
undefined behavior.  So I feel like it might be easiest to silence this
undefined behavior warning now instead of waiting for the syzbot reports
to come back to bite us in a couple years.

  3640          if (!ret)
  3641                  ret = strlen(input_buf);
  3642  out:
  3643          mutex_unlock(&split_debug_mutex);
  3644          return ret;
  3645  
  3646  }




regards,
dan carpenter