This is a fix for a regression in 32 bit kernels caused by an
invalid check for pgoff overflow in hugetlbfs mmap setup. The
check incorrectly specified that the size of a loff_t was the
same as the size of a long. The regression prevents mapping
hugetlbfs files at offsets greater than 4GB on 32 bit kernels.
On 32 bit kernels conversion from a page based unsigned long can
not overflow a loff_t byte offset. Therefore, skip this check
if sizeof(unsigned long) != sizeof(loff_t).
Fixes: 63489f8e8211 ("hugetlbfs: check for pgoff value overflow")
Cc: <stable(a)vger.kernel.org>
Reported-by: Dan Rue <dan.rue(a)linaro.org>
Signed-off-by: Mike Kravetz <mike.kravetz(a)oracle.com>
---
fs/hugetlbfs/inode.c | 10 +++++++---
1 file changed, 7 insertions(+), 3 deletions(-)
diff --git a/fs/hugetlbfs/inode.c b/fs/hugetlbfs/inode.c
index b9a254dcc0e7..d508c7844681 100644
--- a/fs/hugetlbfs/inode.c
+++ b/fs/hugetlbfs/inode.c
@@ -138,10 +138,14 @@ static int hugetlbfs_file_mmap(struct file *file, struct vm_area_struct *vma)
/*
* page based offset in vm_pgoff could be sufficiently large to
- * overflow a (l)off_t when converted to byte offset.
+ * overflow a loff_t when converted to byte offset. This can
+ * only happen on architectures where sizeof(loff_t) ==
+ * sizeof(unsigned long). So, only check in those instances.
*/
- if (vma->vm_pgoff & PGOFF_LOFFT_MAX)
- return -EINVAL;
+ if (sizeof(unsigned long) == sizeof(loff_t)) {
+ if (vma->vm_pgoff & PGOFF_LOFFT_MAX)
+ return -EINVAL;
+ }
/* must be huge page aligned */
if (vma->vm_pgoff & (~huge_page_mask(h) >> PAGE_SHIFT))
--
2.13.6
Hi!
4.16-rc7 doesn't seem to be in stable.git yet. Am I too impatient or perhaps having a git-pull-problem here?
Thanks!
Rainer Fiebig
--
The truth always turns out to be simpler than you thought.
Richard Feynman
On 03/31/2018 01:38 PM, Jason Andryuk wrote:
> On Wed, Mar 21, 2018, 5:12 PM Boris Ostrovsky
> <boris.ostrovsky(a)oracle.com <mailto:boris.ostrovsky@oracle.com>> wrote:
>
> On 03/19/2018 12:58 PM, Jason Andryuk wrote:
> > Commit 2cc42bac1c79 ("x86-64/Xen: eliminate W+X mappings")
> introduced a
> > call to get_cpu_cap, which is fstack-protected. This is works on
> x86-64
> > as commit 4f277295e54c ("x86/xen: init %gs very early to avoid page
> > faults with stack protector") ensures the stack protector is
> configured,
> > but it it did not cover x86-32.
> >
> > Delay calling get_cpu_cap until after xen_setup_gdt has
> initialized the
> > stack canary. Without this, a 32bit PV machine crashes early
> > in boot.
> > (XEN) Domain 0 (vcpu#0) crashed on cpu#0:
> > (XEN) ----[ Xen-4.6.6-xc x86_64 debug=n Tainted: C ]----
> > (XEN) CPU: 0
> > (XEN) RIP: e019:[<00000000c10362f8>]
> >
> > And the PV kernel IP corresponds to init_scattered_cpuid_features
> > 0xc10362f8 <+24>: mov %gs:0x14,%eax
> >
> > Fixes 2cc42bac1c79 ("x86-64/Xen: eliminate W+X mappings")
> >
> > Signed-off-by: Jason Andryuk <jandryuk(a)gmail.com
> <mailto:jandryuk@gmail.com>>
> >
>
>
> Applied to for-linus-4.17
>
>
> Thanks. If it's not too late, can this be cc: stable?
We can always try ;-)
This is 4.15 and 4.16 only, I believe.
-boris
> If not, I'll
> submit the request after it is in Linus's tree.
>
> -Jason
>