From: "Hillf Danton" <hillf.zj@alibaba-inc.com>
To: "'Mike Kravetz'" <mike.kravetz@oracle.com>, <linux-mm@kvack.org>,
<linux-kernel@vger.kernel.org>
Cc: "'Vegard Nossum'" <vegard.nossum@gmail.com>,
"'Dmitry Vyukov'" <dvyukov@google.com>,
"'Michal Hocko'" <mhocko@suse.com>,
"'Kirill A . Shutemov'" <kirill.shutemov@linux.intel.com>,
"'Andrey Ryabinin'" <aryabinin@virtuozzo.com>,
"'Naoya Horiguchi'" <n-horiguchi@ah.jp.nec.com>,
"'Andrew Morton'" <akpm@linux-foundation.org>
Subject: Re: [PATCH] hugetlbfs: fix offset overflow in huegtlbfs mmap
Date: Wed, 12 Apr 2017 11:13:20 +0800 [thread overview]
Message-ID: <0c0501d2b33a$bd0bfc00$3723f400$@alibaba-inc.com> (raw)
In-Reply-To: <1491951118-30678-1-git-send-email-mike.kravetz@oracle.com>
On April 12, 2017 6:52 AM Mike Kravetz wrote:
>
> If mmap() maps a file, it can be passed an offset into the file at
> which the mapping is to start. Offset could be a negative value when
> represented as a loff_t. The offset plus length will be used to
> update the file size (i_size) which is also a loff_t. Validate the
> value of offset and offset + length to make sure they do not overflow
> and appear as negative.
>
> Found by syzcaller with commit ff8c0c53c475 ("mm/hugetlb.c: don't call
> region_abort if region_chg fails") applied. Prior to this commit, the
> overflow would still occur but we would luckily return ENOMEM.
> To reproduce:
> mmap(0, 0x2000, 0, 0x40021, 0xffffffffffffffffULL, 0x8000000000000000ULL);
>
> Resulted in,
> kernel BUG at mm/hugetlb.c:742!
> Call Trace:
> hugetlbfs_evict_inode+0x80/0xa0
> ? hugetlbfs_setattr+0x3c0/0x3c0
> evict+0x24a/0x620
> iput+0x48f/0x8c0
> dentry_unlink_inode+0x31f/0x4d0
> __dentry_kill+0x292/0x5e0
> dput+0x730/0x830
> __fput+0x438/0x720
> ____fput+0x1a/0x20
> task_work_run+0xfe/0x180
> exit_to_usermode_loop+0x133/0x150
> syscall_return_slowpath+0x184/0x1c0
> entry_SYSCALL_64_fastpath+0xab/0xad
>
> Reported-by: Vegard Nossum <vegard.nossum@gmail.com>
> Signed-off-by: Mike Kravetz <mike.kravetz@oracle.com>
> ---
Acked-by: Hillf Danton <hillf.zj@alibaba-inc.com>
next prev parent reply other threads:[~2017-04-12 3:13 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-04-11 22:51 [PATCH] hugetlbfs: fix offset overflow in huegtlbfs mmap Mike Kravetz
2017-04-12 3:13 ` Hillf Danton [this message]
2017-04-12 8:58 ` Vegard Nossum
2017-04-12 20:04 ` Mike Kravetz
2017-04-14 3:32 ` Naoya Horiguchi
2017-04-15 22:58 ` Mike Kravetz
2017-04-16 23:43 ` Naoya Horiguchi
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to='0c0501d2b33a$bd0bfc00$3723f400$@alibaba-inc.com' \
--to=hillf.zj@alibaba-inc.com \
--cc=akpm@linux-foundation.org \
--cc=aryabinin@virtuozzo.com \
--cc=dvyukov@google.com \
--cc=kirill.shutemov@linux.intel.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=mhocko@suse.com \
--cc=mike.kravetz@oracle.com \
--cc=n-horiguchi@ah.jp.nec.com \
--cc=vegard.nossum@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).