From: Pavel Skripkin <paskripkin@gmail.com>
To: Tetsuo Handa <penguin-kernel@i-love.sakura.ne.jp>,
rostedt@goodmis.org, tglx@linutronix.de
Cc: linux-kernel@vger.kernel.org,
syzbot+e68c89a9510c159d9684@syzkaller.appspotmail.com
Subject: Re: [PATCH] profiling: fix shift-out-of-bounds in profile_setup
Date: Fri, 13 Aug 2021 13:56:17 +0300 [thread overview]
Message-ID: <a222a2b1-63bd-9fe1-cbc4-ca0e1e214a46@gmail.com> (raw)
In-Reply-To: <7bc788bf-ba81-5732-957e-55edf522d1ca@i-love.sakura.ne.jp>
On 8/8/21 2:21 PM, Tetsuo Handa wrote:
> On 2021/07/17 4:04, Pavel Skripkin wrote:
>> Syzbot reported shift-out-of-bounds bug in profile_init().
>> The problem was in incorrect prof_shift. Since prof_shift value comes from
>> userspace we need to check this value to avoid too big shift.
>>
>> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
>> Reported-and-tested-by: syzbot+e68c89a9510c159d9684@syzkaller.appspotmail.com
>> Suggested-by: Tetsuo Handa <penguin-kernel@i-love.sakura.ne.jp>
>> Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
>> ---
>> kernel/profile.c | 9 +++++----
>> 1 file changed, 5 insertions(+), 4 deletions(-)
>>
>> diff --git a/kernel/profile.c b/kernel/profile.c
>> index c2ebddb5e974..c905931e3c3b 100644
>> --- a/kernel/profile.c
>> +++ b/kernel/profile.c
>> @@ -42,6 +42,7 @@ struct profile_hit {
>>
>> static atomic_t *prof_buffer;
>> static unsigned long prof_len, prof_shift;
>> +#define MAX_PROF_SHIFT (sizeof(prof_shift) * 8)
>
> I came to think that we should directly use BITS_PER_LONG, for
> the integer value which is subjected to shift operation is e.g.
>
> (_etext - _stext)
>
> part of
>
> prof_len = (_etext - _stext) >> prof_shift;
>
> in profile_init().
>
> Since "unsigned char" will be sufficient for holding BITS_PER_LONG - 1,
> defining MAX_PROF_SHIFT based on size of prof_shift is incorrect.
>
I don't get it, sorry. Do you mean, that
#define MAX_PROF_SHIFT BITS_PER_LONG
is better solution here? And as I understand we can change prof_shift
type from "unsigned long" to "unsigned short", rigth?
> Also, there is
>
> unsigned int sample_step = 1 << prof_shift;
>
> in read_profile(). This may result in shift-out-of-bounds on BITS_PER_LONG == 64
> architecture. Shouldn't this variable changed from "unsigned int" to "unsigned long"
> and use 1UL instead of 1 ?
>
Yep, it's necessary. Will do it in v2
With regards,
Pavel Skripkin
next prev parent reply other threads:[~2021-08-13 10:56 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-07-16 19:04 [PATCH] profiling: fix shift-out-of-bounds in profile_setup Pavel Skripkin
2021-08-08 11:21 ` Tetsuo Handa
2021-08-13 10:56 ` Pavel Skripkin [this message]
2021-08-13 13:27 ` Tetsuo Handa
2021-08-13 14:00 ` [PATCH v2] profiling: fix shift-out-of-bounds bugs Pavel Skripkin
2021-08-19 20:46 ` Steven Rostedt
2021-08-29 1:57 ` Tetsuo Handa
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=a222a2b1-63bd-9fe1-cbc4-ca0e1e214a46@gmail.com \
--to=paskripkin@gmail.com \
--cc=linux-kernel@vger.kernel.org \
--cc=penguin-kernel@i-love.sakura.ne.jp \
--cc=rostedt@goodmis.org \
--cc=syzbot+e68c89a9510c159d9684@syzkaller.appspotmail.com \
--cc=tglx@linutronix.de \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).