From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id B8451C41535 for ; Mon, 6 Nov 2023 23:17:58 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232527AbjKFXR6 (ORCPT ); Mon, 6 Nov 2023 18:17:58 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:35842 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233093AbjKFXRi (ORCPT ); Mon, 6 Nov 2023 18:17:38 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id EE4A01BD8; Mon, 6 Nov 2023 15:16:00 -0800 (PST) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 18472C43391; Mon, 6 Nov 2023 23:15:59 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1699312560; bh=nOD7E5+wndSc4Q77ObBmwUTez6KQoxSMjzmtjfGSXTM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=kUeakEPGc+7R9Txt9MwEMqBBWixPfQqXbU+zE9OcD+sukFS0yVN3/WqVF8GqbDdCa DhI7ook6czDb7iD0EzT/NxFzFdUUlTgPCLRsHr9VXToshScCKHpgnhxHOQXY7np3YM JFBDpT8l7UmblRPKtHDSG8D3jmvg9GqRo/RrcBs4Zc7a+AWf4sKOxLo2Me8m4nX1ND VP6X9cF3XOx5eERQvM7P0p1SSupdPsVI7SRbNsiTYIO4p+y/S+l72jkuIimxfF0dzl hHRE4sqEGPrjZEOb7GT+YJvFLZVvRpN1Vqb7xU0UnqbSPc7eMJ669xY5cpCxREdklD wwPinFOlBN84w== From: Sasha Levin To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Denis Arefev , Mathieu Desnoyers , Joel Fernandes , David Laight , "Paul E . McKenney" , Frederic Weisbecker , Sasha Levin , jiangshanlai@gmail.com, josh@joshtriplett.org, rcu@vger.kernel.org Subject: [PATCH AUTOSEL 6.1 03/11] srcu: Fix srcu_struct node grpmask overflow on 64-bit systems Date: Mon, 6 Nov 2023 18:15:37 -0500 Message-ID: <20231106231553.3735366-3-sashal@kernel.org> X-Mailer: git-send-email 2.42.0 In-Reply-To: <20231106231553.3735366-1-sashal@kernel.org> References: <20231106231553.3735366-1-sashal@kernel.org> MIME-Version: 1.0 X-stable: review X-Patchwork-Hint: Ignore X-stable-base: Linux 6.1.61 Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: rcu@vger.kernel.org From: Denis Arefev [ Upstream commit d8d5b7bf6f2105883bbd91bbd4d5b67e4e3dff71 ] The value of a bitwise expression 1 << (cpu - sdp->mynode->grplo) is subject to overflow due to a failure to cast operands to a larger data type before performing the bitwise operation. The maximum result of this subtraction is defined by the RCU_FANOUT_LEAF Kconfig option, which on 64-bit systems defaults to 16 (resulting in a maximum shift of 15), but which can be set up as high as 64 (resulting in a maximum shift of 63). A value of 31 can result in sign extension, resulting in 0xffffffff80000000 instead of the desired 0x80000000. A value of 32 or greater triggers undefined behavior per the C standard. This bug has not been known to cause issues because almost all kernels take the default CONFIG_RCU_FANOUT_LEAF=16. Furthermore, as long as a given compiler gives a deterministic non-zero result for 1<=32, the code correctly invokes all SRCU callbacks, albeit wasting CPU time along the way. This commit therefore substitutes the correct 1UL for the buggy 1. Found by Linux Verification Center (linuxtesting.org) with SVACE. Signed-off-by: Denis Arefev Reviewed-by: Mathieu Desnoyers Reviewed-by: Joel Fernandes (Google) Cc: David Laight Signed-off-by: Paul E. McKenney Signed-off-by: Frederic Weisbecker Signed-off-by: Sasha Levin --- kernel/rcu/srcutree.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/kernel/rcu/srcutree.c b/kernel/rcu/srcutree.c index ce60cdf069e3a..94da8e13b71fb 100644 --- a/kernel/rcu/srcutree.c +++ b/kernel/rcu/srcutree.c @@ -223,7 +223,7 @@ static bool init_srcu_struct_nodes(struct srcu_struct *ssp, gfp_t gfp_flags) snp->grplo = cpu; snp->grphi = cpu; } - sdp->grpmask = 1 << (cpu - sdp->mynode->grplo); + sdp->grpmask = 1UL << (cpu - sdp->mynode->grplo); } smp_store_release(&ssp->srcu_size_state, SRCU_SIZE_WAIT_BARRIER); return true; @@ -722,7 +722,7 @@ static void srcu_schedule_cbs_snp(struct srcu_struct *ssp, struct srcu_node *snp int cpu; for (cpu = snp->grplo; cpu <= snp->grphi; cpu++) { - if (!(mask & (1 << (cpu - snp->grplo)))) + if (!(mask & (1UL << (cpu - snp->grplo)))) continue; srcu_schedule_cbs_sdp(per_cpu_ptr(ssp->sda, cpu), delay); } -- 2.42.0