tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

profiling: fix shift-out-of-bounds bugs

Syzbot reported shift-out-of-bounds bug in profile_init().
The problem was in incorrect prof_shift. Since prof_shift value comes from
userspace we need to clamp this value into [0, BITS_PER_LONG -1]
boundaries.

Second possible shiht-out-of-bounds was found by Tetsuo:
sample_step local variable in read_profile() had "unsigned int" type,
but prof_shift allows to make a BITS_PER_LONG shift. So, to prevent
possible shiht-out-of-bounds sample_step type was changed to
"unsigned long".

Also, "unsigned short int" will be sufficient for storing
[0, BITS_PER_LONG] value, that's why there is no need for
"unsigned long" prof_shift.

Link: https://lkml.kernel.org/r/20210813140022.5011-1-paskripkin@gmail.com
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Reported-and-tested-by: syzbot+e68c89a9510c159d9684@syzkaller.appspotmail.com
Suggested-by: Tetsuo Handa <penguin-kernel@i-love.sakura.ne.jp>
Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Steven Rostedt <rostedt@goodmis.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

authored by

Pavel Skripkin and committed by
Linus Torvalds 2d186afd 3c91dda9

+11 -10
+11 -10
kernel/profile.c
··· 41 41 #define NR_PROFILE_GRP (NR_PROFILE_HIT/PROFILE_GRPSZ) 42 42 43 43 static atomic_t *prof_buffer; 44 - static unsigned long prof_len, prof_shift; 44 + static unsigned long prof_len; 45 + static unsigned short int prof_shift; 45 46 46 47 int prof_on __read_mostly; 47 48 EXPORT_SYMBOL_GPL(prof_on); ··· 68 67 if (str[strlen(sleepstr)] == ',') 69 68 str += strlen(sleepstr) + 1; 70 69 if (get_option(&str, &par)) 71 - prof_shift = par; 72 - pr_info("kernel sleep profiling enabled (shift: %ld)\n", 70 + prof_shift = clamp(par, 0, BITS_PER_LONG - 1); 71 + pr_info("kernel sleep profiling enabled (shift: %u)\n", 73 72 prof_shift); 74 73 #else 75 74 pr_warn("kernel sleep profiling requires CONFIG_SCHEDSTATS\n"); ··· 79 78 if (str[strlen(schedstr)] == ',') 80 79 str += strlen(schedstr) + 1; 81 80 if (get_option(&str, &par)) 82 - prof_shift = par; 83 - pr_info("kernel schedule profiling enabled (shift: %ld)\n", 81 + prof_shift = clamp(par, 0, BITS_PER_LONG - 1); 82 + pr_info("kernel schedule profiling enabled (shift: %u)\n", 84 83 prof_shift); 85 84 } else if (!strncmp(str, kvmstr, strlen(kvmstr))) { 86 85 prof_on = KVM_PROFILING; 87 86 if (str[strlen(kvmstr)] == ',') 88 87 str += strlen(kvmstr) + 1; 89 88 if (get_option(&str, &par)) 90 - prof_shift = par; 91 - pr_info("kernel KVM profiling enabled (shift: %ld)\n", 89 + prof_shift = clamp(par, 0, BITS_PER_LONG - 1); 90 + pr_info("kernel KVM profiling enabled (shift: %u)\n", 92 91 prof_shift); 93 92 } else if (get_option(&str, &par)) { 94 - prof_shift = par; 93 + prof_shift = clamp(par, 0, BITS_PER_LONG - 1); 95 94 prof_on = CPU_PROFILING; 96 - pr_info("kernel profiling enabled (shift: %ld)\n", 95 + pr_info("kernel profiling enabled (shift: %u)\n", 97 96 prof_shift); 98 97 } 99 98 return 1; ··· 469 468 unsigned long p = *ppos; 470 469 ssize_t read; 471 470 char *pnt; 472 - unsigned int sample_step = 1 << prof_shift; 471 + unsigned long sample_step = 1UL << prof_shift; 473 472 474 473 profile_flip_buffers(); 475 474 if (p >= (prof_len+1)*sizeof(unsigned int))