powerpc/mm: Fix possible out-of-bounds shift in arch_mmap_rnd()
authorMichael Ellerman <mpe@ellerman.id.au>
Tue, 25 Apr 2017 10:49:24 +0000 (20:49 +1000)
committerMichael Ellerman <mpe@ellerman.id.au>
Wed, 26 Apr 2017 05:35:01 +0000 (15:35 +1000)
commitb409946b2a3c1ddcde75e5f35a77e03f4d354be0
tree16420ac23dca9335e6ee935ad85b0484cdb622a3
parent9765ad134a00a01cbcc69c78ff6defbfad209bc5
powerpc/mm: Fix possible out-of-bounds shift in arch_mmap_rnd()

The recent patch to add runtime configuration of the ASLR limits added a bug in
arch_mmap_rnd() where we may shift an integer (32-bits) by up to 33 bits,
leading to undefined behaviour.

In practice it exhibits as every process seg faulting instantly, presumably
because the rnd value hasn't been restricited by the modulus at all. We didn't
notice because it only happens under certain kernel configurations and if the
number of bits is actually set to a large value.

Fix it by switching to unsigned long.

Fixes: 9fea59bd7ca5 ("powerpc/mm: Add support for runtime configuration of ASLR limits")
Reported-by: Balbir Singh <bsingharora@gmail.com>
Reviewed-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
arch/powerpc/mm/mmap.c