• Joe Lawrence's avatar
    pipe: avoid round_pipe_size() nr_pages overflow on 32-bit · d3f14c48
    Joe Lawrence authored
    round_pipe_size() contains a right-bit-shift expression which may
    overflow, which would cause undefined results in a subsequent
    roundup_pow_of_two() call.
    
      static inline unsigned int round_pipe_size(unsigned int size)
      {
              unsigned long nr_pages;
    
              nr_pages = (size + PAGE_SIZE - 1) >> PAGE_SHIFT;
              return roundup_pow_of_two(nr_pages) << PAGE_SHIFT;
      }
    
    PAGE_SIZE is defined as (1UL << PAGE_SHIFT), so:
      - 4 bytes wide on 32-bit (0 to 0xffffffff)
      - 8 bytes wide on 64-bit (0 to 0xffffffffffffffff)
    
    That means that 32-bit round_pipe_size(), nr_pages may overflow to 0:
    
      size=0x00000000    nr_pages=0x0
      size=0x00000001    nr_pages=0x1
      size=0xfffff000    nr_pages=0xfffff
      size=0xfffff001    nr_pages=0x0         << !
      size=0xffffffff    nr_pages=0x0         << !
    
    This is bad because roundup_pow_of_two(n) is undefined when n == 0!
    
    64-bit is not a problem as the unsigned int size is 4 bytes wide
    (similar to 32-bit) and the larger, 8 byte wide unsigned long, is
    sufficient to handle the largest value of the bit shift expression:
    
      size=0xffffffff    nr_pages=100000
    
    Modify round_pipe_size() to return 0 if n == 0 and updates its callers to
    handle accordingly.
    
    Link: http://lkml.kernel.org/r/1507658689-11669-3-git-send-email-joe.lawrence@redhat.comSigned-off-by: default avatarJoe Lawrence <joe.lawrence@redhat.com>
    Reported-by: default avatarMikulas Patocka <mpatocka@redhat.com>
    Reviewed-by: default avatarMikulas Patocka <mpatocka@redhat.com>
    Cc: Al Viro <viro@zeniv.linux.org.uk>
    Cc: Jens Axboe <axboe@kernel.dk>
    Cc: Michael Kerrisk <mtk.manpages@gmail.com>
    Cc: Randy Dunlap <rdunlap@infradead.org>
    Cc: Josh Poimboeuf <jpoimboe@redhat.com>
    Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
    Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
    d3f14c48
pipe.c 27.6 KB