Content-Type: text/plain;
        charset=us-ascii
MIME-Version: 1.0
Subject: Re: [PATCH] hugetlb: check for undefined shift on 32 bit
 architectures
From:   Muchun Song <muchun.song@linux.dev>
In-Reply-To: <20230216013542.138708-1-mike.kravetz@oracle.com>
Date:   Thu, 16 Feb 2023 11:01:13 +0800
Cc:     Linux Memory Management List <linux-mm@kvack.org>,
        linux-kernel@vger.kernel.org,
        Muchun Song <songmuchun@bytedance.com>,
        Andi Kleen <ak@linux.intel.com>,
        Sasha Levin <sashal@kernel.org>,
        Anders Roxell <anders.roxell@linaro.org>,
        Andrew Morton <akpm@linux-foundation.org>,
        Naresh Kamboju <naresh.kamboju@linaro.org>,
        stable@vger.kernel.org
Content-Transfer-Encoding: quoted-printable
Message-Id: <9B09A3E9-09E6-44E4-9B4F-30975C6947B7@linux.dev>
References: <20230216013542.138708-1-mike.kravetz@oracle.com>
To:     Mike Kravetz <mike.kravetz@oracle.com>
Precedence: bulk


> On Feb 16, 2023, at 09:35, Mike Kravetz <mike.kravetz@oracle.com> =
wrote:
>=20
> Users can specify the hugetlb page size in the mmap, shmget and
> memfd_create system calls.  This is done by using 6 bits within the
> flags argument to encode the base-2 logarithm of the desired page =
size.
> The routine hstate_sizelog() uses the log2 value to find the
> corresponding hugetlb hstate structure.  Converting the log2 value
> (page_size_log) to potential hugetlb page size is the simple =
statement:
>=20
> 1UL << page_size_log
>=20
> Because only 6 bits are used for page_size_log, the left shift can not
> be greater than 63.  This is fine on 64 bit architectures where a long
> is 64 bits.  However, if a value greater than 31 is passed on a 32 bit
> architecture (where long is 32 bits) the shift will result in =
undefined
> behavior.  This was generally not an issue as the result of the
> undefined shift had to exactly match hugetlb page size to proceed.
>=20
> Recent improvements in runtime checking have resulted in this =
undefined
> behavior throwing errors such as reported below.
>=20
> Fix by comparing page_size_log to BITS_PER_LONG before doing shift.
>=20
> Reported-by: Naresh Kamboju <naresh.kamboju@linaro.org>
> Link: =
https://lore.kernel.org/lkml/CA+G9fYuei_Tr-vN9GS7SfFyU1y9hNysnf=3DPB7kT0=3D=
yv4MiPgVg@mail.gmail.com/
> Fixes: 42d7395feb56 ("mm: support more pagesizes for =
MAP_HUGETLB/SHM_HUGETLB")
> Cc: <stable@vger.kernel.org>
> Signed-off-by: Mike Kravetz <mike.kravetz@oracle.com>

Acked-by: Muchun Song <songmuchun@bytedance.com>

Thanks.