Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1592188

[PATCH 2/3] futex: fix decoding of operation

Show all headers | View raw

encoded_op uses int as type which results in pretty weird behaviour.
E.g. if encoded_op contains oparg 0xfff, it currently results in oparg
being -1.

Switch encoded_op to 'unsigned int' which is correct given it is a bit
mask anyway. And perform upper bound checking on oparg to inform users
about the failure. Finally, avoid int overflows using unsigned shift on
oparg. Note that given we use -fno-strict-overflow, this is not a fix as
there is no problem to fix in the first place.

Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
 kernel/futex.c | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/kernel/futex.c b/kernel/futex.c
index c5ff9850952f..c09424406560 100644
--- a/kernel/futex.c
+++ b/kernel/futex.c
@@ -1457,7 +1457,7 @@ futex_wake(u32 __user *uaddr, unsigned int flags, int nr_wake, u32 bitset)
 	return ret;
 }
 
-static int futex_atomic_op_inuser(int encoded_op, u32 __user *uaddr)
+static int futex_atomic_op_inuser(unsigned int encoded_op, u32 __user *uaddr)
 {
 	int op = (encoded_op >> 28) & 7;
 	int cmp = (encoded_op >> 24) & 15;
@@ -1465,8 +1465,11 @@ static int futex_atomic_op_inuser(int encoded_op, u32 __user *uaddr)
 	int cmparg = (encoded_op << 20) >> 20;
 	int oldval, ret;
 
-	if (encoded_op & (FUTEX_OP_OPARG_SHIFT << 28))
-		oparg = 1 << oparg;
+	if (encoded_op & (FUTEX_OP_OPARG_SHIFT << 28)) {
+		if (oparg >= 32)
+			return -EINVAL;
+		oparg = 1U << oparg;
+	}
 
 	if (!access_ok(VERIFY_WRITE, uaddr, sizeof(u32)))
 		return -EFAULT;
-- 
2.12.0

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH 1/3] futex: remove duplicated code Jiri Slaby <jslaby@suse.cz> - 2017-03-03 13:40 +0100
  [PATCH 2/3] futex: fix decoding of operation Jiri Slaby <jslaby@suse.cz> - 2017-03-03 19:30 +0100
  [PATCH 3/3] futex: make the encoded_op decoding readable Jiri Slaby <jslaby@suse.cz> - 2017-03-03 19:30 +0100
    Re: [PATCH 3/3] futex: make the encoded_op decoding readable Jiri Slaby <jslaby@suse.cz> - 2017-03-05 09:00 +0100
  Re: [PATCH 1/3] futex: remove duplicated code Heiko Carstens <heiko.carstens@de.ibm.com> - 2017-03-03 21:10 +0100
  Re: [PATCH 1/3] futex: remove duplicated code Michael Ellerman <mpe@ellerman.id.au> - 2017-03-04 14:00 +0100
  Re: [PATCH 1/3] futex: remove duplicated code Russell King - ARM Linux <linux@armlinux.org.uk> - 2017-03-04 14:20 +0100
    Re: [PATCH 1/3] futex: remove duplicated code "H. Peter Anvin" <hpa@zytor.com> - 2017-03-04 20:30 +0100
      Re: [PATCH 1/3] futex: remove duplicated code Stafford Horne <shorne@gmail.com> - 2017-03-04 22:40 +0100
        Re: [PATCH 1/3] futex: remove duplicated code "H. Peter Anvin" <hpa@zytor.com> - 2017-03-05 00:20 +0100
          Re: [PATCH 1/3] futex: remove duplicated code Stafford Horne <shorne@gmail.com> - 2017-03-05 00:40 +0100
            Re: [PATCH 1/3] futex: remove duplicated code Jiri Slaby <jslaby@suse.cz> - 2017-03-06 09:50 +0100
              Re: [PATCH 1/3] futex: remove duplicated code "H. Peter Anvin" <hpa@zytor.com> - 2017-03-06 10:20 +0100
              Re: [PATCH 1/3] futex: remove duplicated code Geert Uytterhoeven <geert@linux-m68k.org> - 2017-03-06 15:20 +0100
        Re: [PATCH 1/3] futex: remove duplicated code "H. Peter Anvin" <hpa@zytor.com> - 2017-03-05 00:20 +0100
    Re: [PATCH 1/3] futex: remove duplicated code Rob Landley <rob@landley.net> - 2017-03-09 05:20 +0100
      Re: [PATCH 1/3] futex: remove duplicated code "H. Peter Anvin" <hpa@zytor.com> - 2017-03-09 06:10 +0100
        Re: [PATCH 1/3] futex: remove duplicated code Rich Felker <dalias@libc.org> - 2017-03-09 23:50 +0100
  Re: [PATCH 1/3] futex: remove duplicated code Rich Felker <dalias@libc.org> - 2017-03-06 03:20 +0100
  Re: [PATCH 1/3] futex: remove duplicated code Vineet Gupta <Vineet.Gupta1@synopsys.com> - 2017-03-09 23:50 +0100

csiph-web