From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=100.103.45.18 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1794060797; b=NW95IdM5hpGFdmDQeU9X+9Xg/bBeUIOkWnRi/ABZtMQHThv245gbJBN12BzFGpJ7uMJS b/PsyJkpZI/t92Wy+LSIZf4so37/QIqOz+s2Iuq0waBcQHHqlxyraIesY7Js5qqiRjZCL RUEg8b3YVNkJ7JsXQ1SqPTtkSW8w2vcFg3FJ/4tei8fw+UvDjKL1mtyizAnKZfLB41IKg MxTysZEHZaLNW72E9BZCSD2/qUSsQQZNKt0nSfvzNQ54Gf3F3jQLgbtTbIa4wiFo+Fazd /pBVRBaM8VManB7V/u5ri1jnyhURhjijyITKpVCyiDeqcKX7YPxwMCBffMTponZ/CEQ== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1794060797; h=Received:DKIM-Signature:From:To:Cc:Subject:Date:Message-ID:X-Mailer: In-Reply-To:References:User-Agent:X-stable:X-Patchwork-Hint: MIME-Version:Content-Transfer-Encoding; bh=YLf8kUhIlA7mPYywOMjtXjuTZREMqWx53Yz65/mk1VA=; b=K5K61ZTE1H9lCQyrSklTv0jwvPe6i1usiVjxDXPYqlVfpHgIHc2KgZ9lzLxBH4ynjkmF HzPJ98/lgLejKye9dCLxBLqF/JGTSkP8WPrVSQ1VoxlR1FcVZOmy08Uy+tNhjwlp0sWIF wIb835tSGpWNOpT2wxE3f4CME+HkXrZAtHaHFeJGJ4HGrp8jVfrmMOFBcK7Y62B7szgRr QtYCBbG60BaAwnwMFfoaRiEnCf2LniCBZui8VDY+Si29IdEB4yKt1A1af/0msUf7JvdIP +ux48VV6J0YMdFR1i+tNAkcYVDUI4os81IaM1nJiq+ywiPPj4mC8j/6e1aGFh/zbIOA== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=dvBqTiHh; arc=none smtp.remote-ip=100.103.45.18 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id AFC1E606A333; Sat, 7 Nov 2026 14:13:16 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=dvBqTiHh Received: by smtp.kernel.org (Postfix) with ESMTPSA id 5B95F1F0089F; Sat, 7 Nov 2026 14:13:16 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1794060796; bh=YLf8kUhIlA7mPYywOMjtXjuTZREMqWx53Yz65/mk1VA=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=dvBqTiHhp9jA0CDtpNqOK41KOm5UJHlwUR9md+1+SOfCRNdZdfLjROwWXPxcQQYed 1nmemrSPyxgBb3P8oKQ7iyfISNOHSm1HVnlhfTW5nINyCP2VIMCghdzvu/db/6GAbD gLnqYPykJPGpkmgJ7k3SRVncJIuHHZReGUS/va1s= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Benjamin Marzinski , Yury Norov , Sasha Levin Subject: [PATCH 6.12 0198/1536] bitops: make the *_bit_le functions use unsigned long Date: Sat, 7 Nov 2026 08:36:54 -0500 Message-ID: <20261107135003.223485072@linuxfoundation.org> X-Mailer: git-send-email 2.56.0 In-Reply-To: <20261107134957.653319350@linuxfoundation.org> References: <20261107134957.653319350@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore X-Mailing-List: stable@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.12-stable review patch. If anyone has any objections, please let me know. ------------------ From: Benjamin Marzinski [ Upstream commit 1c61b0a6e5c472737619f74f79c390363ee258df ] The *_bit_le functions use a signed integer for the bit number. However, the *_bit functions can use an unsigned long. This causes problems if there is a large bitmap and a bit number > 0x80000000 is passed in. Since that is a negative int, it will get sign extended to a long when getting passed to the *_bit function, turning it into a huge bit number. This usually ends up with the memory address wrapping around and the function accessing memory before the start of the bitmap. Avoid this by making the *_bit_le functions take an unsigned long. This can be triggered by faking an almost 4TB dm-mirror device, which uses bitmaps to track the mirror regions: $ dmsetup create bigzero --table '0 8589934590 zero' $ dmsetup create mymirror --table '0 8589934590 mirror core 2 2 nosync 2 /dev/mapper/bigzero 0 /dev/mapper/bigzero 0' This will access memory before the start of the sync_bits bitmap, and likely hit the guard page of the previously allocated clean_bits bitmap, causing a kernel panic with the old code. I looked and didn't see any crazy code using the signed int to intentionally try and access bits before some address within the bitmap. Signed-off-by: Benjamin Marzinski Signed-off-by: Yury Norov Signed-off-by: Sasha Levin --- include/asm-generic/bitops/le.h | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/include/asm-generic/bitops/le.h b/include/asm-generic/bitops/le.h index d51beff603755..e3b0da9a25f1b 100644 --- a/include/asm-generic/bitops/le.h +++ b/include/asm-generic/bitops/le.h @@ -16,47 +16,47 @@ #endif -static inline int test_bit_le(int nr, const void *addr) +static inline int test_bit_le(unsigned long nr, const void *addr) { return test_bit(nr ^ BITOP_LE_SWIZZLE, addr); } -static inline void set_bit_le(int nr, void *addr) +static inline void set_bit_le(unsigned long nr, void *addr) { set_bit(nr ^ BITOP_LE_SWIZZLE, addr); } -static inline void clear_bit_le(int nr, void *addr) +static inline void clear_bit_le(unsigned long nr, void *addr) { clear_bit(nr ^ BITOP_LE_SWIZZLE, addr); } -static inline void __set_bit_le(int nr, void *addr) +static inline void __set_bit_le(unsigned long nr, void *addr) { __set_bit(nr ^ BITOP_LE_SWIZZLE, addr); } -static inline void __clear_bit_le(int nr, void *addr) +static inline void __clear_bit_le(unsigned long nr, void *addr) { __clear_bit(nr ^ BITOP_LE_SWIZZLE, addr); } -static inline int test_and_set_bit_le(int nr, void *addr) +static inline int test_and_set_bit_le(unsigned long nr, void *addr) { return test_and_set_bit(nr ^ BITOP_LE_SWIZZLE, addr); } -static inline int test_and_clear_bit_le(int nr, void *addr) +static inline int test_and_clear_bit_le(unsigned long nr, void *addr) { return test_and_clear_bit(nr ^ BITOP_LE_SWIZZLE, addr); } -static inline int __test_and_set_bit_le(int nr, void *addr) +static inline int __test_and_set_bit_le(unsigned long nr, void *addr) { return __test_and_set_bit(nr ^ BITOP_LE_SWIZZLE, addr); } -static inline int __test_and_clear_bit_le(int nr, void *addr) +static inline int __test_and_clear_bit_le(unsigned long nr, void *addr) { return __test_and_clear_bit(nr ^ BITOP_LE_SWIZZLE, addr); } -- 2.53.0