From:   Mike Kravetz <mike.kravetz@oracle.com>
To:     linux-mm@kvack.org, linux-kernel@vger.kernel.org
Cc:     Muchun Song <songmuchun@bytedance.com>,
        Andi Kleen <ak@linux.intel.com>,
        Sasha Levin <sashal@kernel.org>,
        Anders Roxell <anders.roxell@linaro.org>,
        Andrew Morton <akpm@linux-foundation.org>,
        Mike Kravetz <mike.kravetz@oracle.com>,
        Naresh Kamboju <naresh.kamboju@linaro.org>,
        stable@vger.kernel.org
Subject: [PATCH] hugetlb: check for undefined shift on 32 bit architectures
Date:   Wed, 15 Feb 2023 17:35:42 -0800
Message-Id: <20230216013542.138708-1-mike.kravetz@oracle.com>
Content-Transfer-Encoding: 8bit
Content-Type: text/plain
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?FA4kK+2OFxyf5zEpKpVJHaJmZV6b1i4mizv0HD7TJrtCkDxt45G2sPXrNGVk?=
 =?us-ascii?Q?8E6CY5zShZJIaIdkOjIjYdnq9aOO5vJAjCLiLo41FrBvWlkUzfHKyOPdsYbe?=
 =?us-ascii?Q?J/CFmrWuFsRyLOM20kyewvscc4IR5PvbVKu/UKQWBEULtTiQuVdjhYPvW8CC?=
 =?us-ascii?Q?gmkkWnPNABVRukVhd4mxz7u+wg+Hkb1/+EOmww3EYM+/azBjVm3X7dQKe//j?=
 =?us-ascii?Q?kTKG9j0k6ByGp9lcz/4Oj0Zeq7Dt45Fg7b+3zmJOnSW7pcjjUckYga9uDiz4?=
 =?us-ascii?Q?sEKdHFdEXQvTw/6x+nhIBFJDkhqCqC0TcU7BAi+HYKywhyvHqDnFGL74elIe?=
 =?us-ascii?Q?TjHE+KGyo22YFjJ3HVqt9fU5tcziih3xlqR5sLLRMcbL5ULM7ETxlaMH2ufj?=
 =?us-ascii?Q?jYFRcwy6pQ+Yzap3owZVCXcCCrFnHihoMmksyrtk5e2wnF45IbJmEH19KIUq?=
 =?us-ascii?Q?vDO6mpl7fBBoJVdCykQaavR1MePuJAJt3J7JDSuZi0oxJkHeFv8o13ekjhYa?=
 =?us-ascii?Q?OadV3SQL0LDXJW9Ro+79e96BdVERrQQsHhOKPh0+jcPfQ0yRdwycpxaofI4h?=
 =?us-ascii?Q?g1HFpmJ15UVel+YinWnuoiSOQocUUFsfc83xMxRPtUhUDIf1ijMVvAXvBb0R?=
 =?us-ascii?Q?VwNgwdivq+iSNSfcAzCTKfDZudQxk4yrcnaE8QE20m/rTlufIBztG9LyJIN1?=
 =?us-ascii?Q?FDpSoXA1ij2uikHnHsoNrC4kUqqLiPYNnoWGaIy5jnRBfXzKE5dlvtoGrytE?=
 =?us-ascii?Q?wKrcKqIgSA29Ew9sStZZ8kWAv/DlBOYjiX+jJBOl5b1VF64fR5ReDnqZvlDh?=
 =?us-ascii?Q?H1YrzM7cXPQqA8+JzjiNWNWY/MR450zknRktLAtjvI62cNOUdWhUSntl+Eo7?=
 =?us-ascii?Q?A4h9xQHM+A8VmRAzYpwNUbio6jAdJxP6FOiwa7j2pMLaY6Wt58epP+7m0Yv9?=
 =?us-ascii?Q?D2S51TOz5gAwniZzVKyZ38V5biGEHCh4YXI4iJn2TxwjrnxILoyVrS0SWEK7?=
 =?us-ascii?Q?gntC/i3TxOgXM3c3fum8jxAyqzVkY6eaBe7AQYko9C15D22YwTRLjhgBdQG5?=
 =?us-ascii?Q?Vj+d2sDtOGbZhhIeStkSWp+d7KMHwMY9c0fKi5zizTjMI5Jm8OtJZCAME8EA?=
 =?us-ascii?Q?2wR7Bbzfs0d3AcSdJGvIvcB9OYM/dGQJ9qpQ4fAe3+w9/8wjnQdlB03lhaxB?=
 =?us-ascii?Q?QsvdCqRFCrP070mU7kbi8LufLpp+swS5STUfJ7SfV9jEO2iWpR9EobfCbG4e?=
 =?us-ascii?Q?qXA6LxaZw0kIDFyA+V+sp5ASkkAlthYsdhxKF2UlmLlwB1/dTeVEJjkNEbCK?=
 =?us-ascii?Q?iE1spAemS7MoKufL+t++Qm9dynMtc1bdsJRM9PRDbSM9dKPR+glTDwYo0yaB?=
 =?us-ascii?Q?RkbVLTpIGj2rb1SXEri96t4b/PC8nW6C2izd//7nokZzVZ3n4lABvXkwTWsg?=
 =?us-ascii?Q?BLgBCZObhGKcf3UTSDwHJPl9/62BkMi9e15rKv0lgHOCfgk2uAHHs0qiie6f?=
 =?us-ascii?Q?7PCdFxaLSvwbEncg5b8ymUNDE7Qp62AtmeXED95dLw2mtogBRD2LOjqwQuaE?=
 =?us-ascii?Q?M07Q3U/DR2N4tkqcs6NUMuchcMLZVWYJqZxozJ5eCj6pRNfs/xEh2na7dsIs?=
 =?us-ascii?Q?BQ=3D=3D?=
X-MS-Exchange-AntiSpam-ExternalHop-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-ExternalHop-MessageData-0: =?us-ascii?Q?/Uh+TkN7is9iMQIiPdK8ThoxqPC+XXozvP5L0J0KJnEjvux58y08+BOS0VjJ?=
 =?us-ascii?Q?5p4Tz7NAu+UyA+kZe6/IFPk9aBDiBKm4dhmqO/RTOxCLQcGHIDZagcqX905F?=
 =?us-ascii?Q?rSf9LSpiVu+Lyzt4rHzQWvfyviefBBi0SjUN8uuQFSy0a55iERYQNzc9hFrJ?=
 =?us-ascii?Q?z7A2DWyyMGKlZq1PPFolEB0pggF576TDKb81u4bjrR5s1paqDvwNlj9bNG1k?=
 =?us-ascii?Q?7mjR5gtdb/kqCLdhtHVDIh9RjZuAs3h0wW0axNd4DvCbZBVURBxBu+l5gyjw?=
 =?us-ascii?Q?ygwOWlPxSza2EMgshPX8N1NKPJzk6APshTaqlB84eQkmeEgLRqIcAQj7FgEy?=
 =?us-ascii?Q?jebLzykP01hhTmqcMUcDgG7+KJ6+2LnUiXXTRq8VTGhatUhWEohvdPNQ9QR8?=
 =?us-ascii?Q?107OzCKFJ4JJErRzAyKtdGRPWNNTWFP1iM28CeYmzrIZLSLQ9KjKNGQCigsk?=
 =?us-ascii?Q?EU61fb6jRtigEXLXzGy/HfLYhh/keBESf74pFRAtaGhr/5MMA8y7A/6EjBfP?=
 =?us-ascii?Q?j5GYtrNDA2lB3hNUKkCymh8GvBF79m7uNR7yfQfZB1LwujbjoZMwBu0Phztq?=
 =?us-ascii?Q?wyjMu+eOsznWbw4NSjd396wjhxeDkYOHlxfYbp1kL7JF3FMMTrXI314YPCyy?=
 =?us-ascii?Q?4QBtLzOXUhS29Qy+jMmiDpwj/q/EiCkoVoTckFIbN9U7N0VtyKAOg6zTVi0I?=
 =?us-ascii?Q?C/iV6S9gtMp4ad7BgAC+hmPb3s/8By0kJ4HmO/S5N1BuPxUx3pdMj1vX1EBk?=
 =?us-ascii?Q?0EeSEeAuVYe51y9G1FsKdJMc9nH5v7wfXYNMCc54PNXKi57dMCLsjLCASA4F?=
 =?us-ascii?Q?eYhQzg2Xa+U/QYGr6PGQ4yg4Uk2Htjmv/SoZi6IzGa1NOLf3wpKIWEyA8Io5?=
 =?us-ascii?Q?mimb8njCG6TySX0/2YmLJJMQgBH5V+BaC4b8QK3MBUtc+e5UR9AeDCtjQQLn?=
 =?us-ascii?Q?eahOThOmiBl7qCCduVGyt9eSzNLhCEWb12mGgVLSo5c=3D?=
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 9d350af8-0dfd-4750-e938-08db0fbe2074
X-MS-Exchange-CrossTenant-AuthSource: BY5PR10MB4196.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 16 Feb 2023 01:35:46.7355
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: 2gSxIcS0aN6MVWc01ucYQknABRamX90ZB8tkdZ4fYV98fvyA0BQj8DQkZ1fQdOFq/7t9R8sIIHbXevED0ka1JA==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: IA0PR10MB7135
X-Proofpoint-Virus-Version: vendor=baseguard
 engine=ICAP:2.0.219,Aquarius:18.0.930,Hydra:6.0.562,FMLib:17.11.170.22
 definitions=2023-02-15_15,2023-02-15_01,2023-02-09_01
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 adultscore=0 suspectscore=0
 phishscore=0 spamscore=0 bulkscore=0 mlxlogscore=811 malwarescore=0
 mlxscore=0 classifier=spam adjust=0 reason=mlx scancount=1
 engine=8.12.0-2212070000 definitions=main-2302160010
X-Proofpoint-GUID: hS8mAD7ZzNnlI2tB6CUrSkWR8v0IzrQZ
X-Proofpoint-ORIG-GUID: hS8mAD7ZzNnlI2tB6CUrSkWR8v0IzrQZ
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

Users can specify the hugetlb page size in the mmap, shmget and
memfd_create system calls.  This is done by using 6 bits within the
flags argument to encode the base-2 logarithm of the desired page size.
The routine hstate_sizelog() uses the log2 value to find the
corresponding hugetlb hstate structure.  Converting the log2 value
(page_size_log) to potential hugetlb page size is the simple statement:

	1UL << page_size_log

Because only 6 bits are used for page_size_log, the left shift can not
be greater than 63.  This is fine on 64 bit architectures where a long
is 64 bits.  However, if a value greater than 31 is passed on a 32 bit
architecture (where long is 32 bits) the shift will result in undefined
behavior.  This was generally not an issue as the result of the
undefined shift had to exactly match hugetlb page size to proceed.

Recent improvements in runtime checking have resulted in this undefined
behavior throwing errors such as reported below.

Fix by comparing page_size_log to BITS_PER_LONG before doing shift.

Reported-by: Naresh Kamboju <naresh.kamboju@linaro.org>
Link: https://lore.kernel.org/lkml/CA+G9fYuei_Tr-vN9GS7SfFyU1y9hNysnf=PB7kT0=yv4MiPgVg@mail.gmail.com/
Fixes: 42d7395feb56 ("mm: support more pagesizes for MAP_HUGETLB/SHM_HUGETLB")
Cc: <stable@vger.kernel.org>
Signed-off-by: Mike Kravetz <mike.kravetz@oracle.com>
---
 include/linux/hugetlb.h | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/include/linux/hugetlb.h b/include/linux/hugetlb.h
index df6dd624ccfe..8b45720f9475 100644
--- a/include/linux/hugetlb.h
+++ b/include/linux/hugetlb.h
@@ -781,7 +781,10 @@ static inline struct hstate *hstate_sizelog(int page_size_log)
 	if (!page_size_log)
 		return &default_hstate;
 
-	return size_to_hstate(1UL << page_size_log);
+	if (page_size_log < BITS_PER_LONG)
+		return size_to_hstate(1UL << page_size_log);
+
+	return NULL;
 }
 
 static inline struct hstate *hstate_vma(struct vm_area_struct *vma)
-- 
2.39.1