* drivers/xen/gntdev.c:817 gntdev_get_page() warn: mask and shift to zero: expr='(addr & ~(~((1 << 12) - 1))) >> 12'
@ 2026-09-24 19:39 ` Dan Carpenter
0 siblings, 0 replies; 4+ messages in thread
From: kernel test robot @ 2026-09-24 16:34 UTC (permalink / raw)
To: oe-kbuild; +Cc: lkp, Dan Carpenter
BCC: lkp@intel.com
CC: oe-kbuild-all@lists.linux.dev
CC: linux-kernel@vger.kernel.org
TO: Arnd Bergmann <arnd@arndb.de>
tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
head: 62f4c998b297cf233997a2b4cd6fc2d2df0319c9
commit: d70242427110123b65c095594eb74a703d3af156 ARM: rework ARM11 CPU selection logic
date: 3 months ago
:::::: branch date: 19 hours ago
:::::: commit date: 3 months ago
config: arm-randconfig-r2200-20260924 (https://download.01.org/0day-ci/archive/20260924/202609241805.VsLzGPLn-lkp@intel.com/config)
compiler: arm-linux-gnueabi-gcc (GCC) 10.5.0
smatch: v0.5.0-9187-g5189e3fb
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Fixes: d70242427110 ("ARM: rework ARM11 CPU selection logic")
| Reported-by: kernel test robot <lkp@intel.com>
| Reported-by: Dan Carpenter <error27@gmail.com>
| Closes: https://lore.kernel.org/r/202609241805.VsLzGPLn-lkp@intel.com/
smatch warnings:
drivers/xen/gntdev.c:817 gntdev_get_page() warn: mask and shift to zero: expr='(addr & ~(~((1 << 12) - 1))) >> 12'
drivers/xen/privcmd.c:488 privcmd_ioctl_mmap_batch() warn: potential user controlled sizeof overflow 'm.num * 8' '0-u32max * 8'
drivers/xen/privcmd.c:495 privcmd_ioctl_mmap_batch() warn: potential user controlled sizeof overflow 'm.num * (4)' '0-u32max * 4'
vim +817 drivers/xen/gntdev.c
bdc612dc6903c4 Daniel De Graaf 2011-02-03 802
a4cdb556cae05c David Vrabel 2014-12-02 803 static int gntdev_get_page(struct gntdev_copy_batch *batch, void __user *virt,
779055842da5b2 Souptick Joarder 2020-09-06 804 unsigned long *gfn)
a4cdb556cae05c David Vrabel 2014-12-02 805 {
a4cdb556cae05c David Vrabel 2014-12-02 806 unsigned long addr = (unsigned long)virt;
a4cdb556cae05c David Vrabel 2014-12-02 807 struct page *page;
a4cdb556cae05c David Vrabel 2014-12-02 808 unsigned long xen_pfn;
a4cdb556cae05c David Vrabel 2014-12-02 809 int ret;
a4cdb556cae05c David Vrabel 2014-12-02 810
d6bbc2ff68fd22 Souptick Joarder 2020-09-06 811 ret = pin_user_pages_fast(addr, 1, batch->writeable ? FOLL_WRITE : 0, &page);
a4cdb556cae05c David Vrabel 2014-12-02 812 if (ret < 0)
a4cdb556cae05c David Vrabel 2014-12-02 813 return ret;
a4cdb556cae05c David Vrabel 2014-12-02 814
a4cdb556cae05c David Vrabel 2014-12-02 815 batch->pages[batch->nr_pages++] = page;
a4cdb556cae05c David Vrabel 2014-12-02 816
a4cdb556cae05c David Vrabel 2014-12-02 @817 xen_pfn = page_to_xen_pfn(page) + XEN_PFN_DOWN(addr & ~PAGE_MASK);
a4cdb556cae05c David Vrabel 2014-12-02 818 *gfn = pfn_to_gfn(xen_pfn);
a4cdb556cae05c David Vrabel 2014-12-02 819
a4cdb556cae05c David Vrabel 2014-12-02 820 return 0;
a4cdb556cae05c David Vrabel 2014-12-02 821 }
a4cdb556cae05c David Vrabel 2014-12-02 822
:::::: The code at line 817 was first introduced by commit
:::::: a4cdb556cae05cd3e7b602b3a44c01420c4e2258 xen/gntdev: add ioctl for grant copy
:::::: TO: David Vrabel <david.vrabel@citrix.com>
:::::: CC: David Vrabel <david.vrabel@citrix.com>
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
^ permalink raw reply [flat|nested] 4+ messages in thread
* drivers/xen/gntdev.c:817 gntdev_get_page() warn: mask and shift to zero: expr='(addr & ~(~((1 << 12) - 1))) >> 12'
@ 2026-09-24 19:39 ` Dan Carpenter
0 siblings, 0 replies; 4+ messages in thread
From: Dan Carpenter @ 2026-09-24 19:39 UTC (permalink / raw)
To: oe-kbuild, Arnd Bergmann; +Cc: lkp, oe-kbuild-all, linux-kernel
tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
head: 62f4c998b297cf233997a2b4cd6fc2d2df0319c9
commit: d70242427110123b65c095594eb74a703d3af156 ARM: rework ARM11 CPU selection logic
config: arm-randconfig-r2200-20260924 (https://download.01.org/0day-ci/archive/20260924/202609241805.VsLzGPLn-lkp@intel.com/config)
compiler: arm-linux-gnueabi-gcc (GCC) 10.5.0
smatch: v0.5.0-9187-g5189e3fb
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Fixes: d70242427110 ("ARM: rework ARM11 CPU selection logic")
| Reported-by: kernel test robot <lkp@intel.com>
| Reported-by: Dan Carpenter <error27@gmail.com>
| Closes: https://lore.kernel.org/r/202609241805.VsLzGPLn-lkp@intel.com/
smatch warnings:
drivers/xen/privcmd.c:488 privcmd_ioctl_mmap_batch() warn: potential user controlled sizeof overflow 'm.num * 8' '0-u32max * 8'
drivers/xen/privcmd.c:495 privcmd_ioctl_mmap_batch() warn: potential user controlled sizeof overflow 'm.num * (4)' '0-u32max * 4'
vim +817 drivers/xen/gntdev.c
470 static long privcmd_ioctl_mmap_batch(
471 struct file *file, void __user *udata, int version)
472 {
473 struct privcmd_data *data = file->private_data;
474 int ret;
475 struct privcmd_mmapbatch_v2 m;
476 struct mm_struct *mm = current->mm;
477 struct vm_area_struct *vma;
478 unsigned long nr_pages;
479 LIST_HEAD(pagelist);
480 struct mmap_batch_state state;
481
482 switch (version) {
483 case 1:
484 if (copy_from_user(&m, udata, sizeof(struct privcmd_mmapbatch)))
485 return -EFAULT;
486 /* Returns per-frame error in m.arr. */
487 m.err = NULL;
488 if (!access_ok(m.arr, m.num * sizeof(*m.arr)))
^^^^^^^^^^^^^^^^^^^^^^
489 return -EFAULT;
490 break;
491 case 2:
492 if (copy_from_user(&m, udata, sizeof(struct privcmd_mmapbatch_v2)))
493 return -EFAULT;
494 /* Returns per-frame error code in m.err. */
495 if (!access_ok(m.err, m.num * (sizeof(*m.err))))
^^^^^^^^^^^^^^^^^^^^^^^
These integer overflow bugs are from 2012, but I guess your patch exposed
the arm32 build to the zero day bot. The bugs only affect 32bit systems.
496 return -EFAULT;
497 break;
498 default:
499 return -EINVAL;
500 }
501
502 /* If restriction is in place, check the domid matches */
503 if (data->domid != DOMID_INVALID && data->domid != m.dom)
504 return -EPERM;
505
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: drivers/xen/gntdev.c:817 gntdev_get_page() warn: mask and shift to zero: expr='(addr & ~(~((1 << 12) - 1))) >> 12'
2026-09-24 19:39 ` Dan Carpenter
(?)
@ 2026-09-25 6:43 ` Arnd Bergmann
2026-09-25 7:42 ` Dan Carpenter
-1 siblings, 1 reply; 4+ messages in thread
From: Arnd Bergmann @ 2026-09-25 6:43 UTC (permalink / raw)
To: Dan Carpenter, oe-kbuild
Cc: kernel test robot, oe-kbuild-all, linux-kernel, Juergen Gross,
xen-devel, Stefano Stabellini, Oleksandr Tyshchenko
On Thu, Sep 24, 2026, at 21:39, Dan Carpenter wrote:
> 489 return -EFAULT;
> 490 break;
> 491 case 2:
> 492 if (copy_from_user(&m, udata, sizeof(struct
> privcmd_mmapbatch_v2)))
> 493 return -EFAULT;
> 494 /* Returns per-frame error code in m.err. */
> 495 if (!access_ok(m.err, m.num * (sizeof(*m.err))))
> ^^^^^^^^^^^^^^^^^^^^^^^
> These integer overflow bugs are from 2012, but I guess your patch
> exposed
> the arm32 build to the zero day bot. The bugs only affect 32bit
> systems.
Right, the randconfig came up with an ARMv6 Xen build, which was not
possible before my patch. I'm sure this was reported for other configs
before and just showed up as introduced by my patch here.
This is clearly a bug but it does look harmless to me, as it only
results in the userspace corrupting itself when passing invalid
data.
Arnd
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: drivers/xen/gntdev.c:817 gntdev_get_page() warn: mask and shift to zero: expr='(addr & ~(~((1 << 12) - 1))) >> 12'
2026-09-25 6:43 ` Arnd Bergmann
@ 2026-09-25 7:42 ` Dan Carpenter
0 siblings, 0 replies; 4+ messages in thread
From: Dan Carpenter @ 2026-09-25 7:42 UTC (permalink / raw)
To: Arnd Bergmann
Cc: oe-kbuild, kernel test robot, oe-kbuild-all, linux-kernel,
Juergen Gross, xen-devel, Stefano Stabellini,
Oleksandr Tyshchenko
On Fri, Sep 25, 2026 at 08:43:54AM +0200, Arnd Bergmann wrote:
> On Thu, Sep 24, 2026, at 21:39, Dan Carpenter wrote:
>
> > 489 return -EFAULT;
> > 490 break;
> > 491 case 2:
> > 492 if (copy_from_user(&m, udata, sizeof(struct
> > privcmd_mmapbatch_v2)))
> > 493 return -EFAULT;
> > 494 /* Returns per-frame error code in m.err. */
> > 495 if (!access_ok(m.err, m.num * (sizeof(*m.err))))
> > ^^^^^^^^^^^^^^^^^^^^^^^
> > These integer overflow bugs are from 2012, but I guess your patch
> > exposed
> > the arm32 build to the zero day bot. The bugs only affect 32bit
> > systems.
>
> Right, the randconfig came up with an ARMv6 Xen build, which was not
> possible before my patch. I'm sure this was reported for other configs
> before and just showed up as introduced by my patch here.
>
> This is clearly a bug but it does look harmless to me, as it only
> results in the userspace corrupting itself when passing invalid
> data.
In ancient times, these access_ok() overflows were a much bigger deal.
Easy to solve with a size_mul(m.num, sizeof(*m.err)).
regards,
dan carpenter
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2026-09-25 7:42 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-09-24 16:34 drivers/xen/gntdev.c:817 gntdev_get_page() warn: mask and shift to zero: expr='(addr & ~(~((1 << 12) - 1))) >> 12' kernel test robot
2026-09-24 19:39 ` Dan Carpenter
2026-09-25 6:43 ` Arnd Bergmann
2026-09-25 7:42 ` Dan Carpenter
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.