profiling: fix shift-out-of-bounds bugs

commit 2d186afd04d669fe9c48b994c41a7405a3c9f16d upstream.

Syzbot reported shift-out-of-bounds bug in profile_init().
The problem was in incorrect prof_shift. Since prof_shift value comes from
userspace we need to clamp this value into [0, BITS_PER_LONG -1]
boundaries.

Second possible shiht-out-of-bounds was found by Tetsuo:
sample_step local variable in read_profile() had "unsigned int" type,
but prof_shift allows to make a BITS_PER_LONG shift. So, to prevent
possible shiht-out-of-bounds sample_step type was changed to
"unsigned long".

Also, "unsigned short int" will be sufficient for storing
[0, BITS_PER_LONG] value, that's why there is no need for
"unsigned long" prof_shift.

Link: https://lkml.kernel.org/r/20210813140022.5011-1-paskripkin@gmail.com
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Reported-and-tested-by: syzbot+e68c89a9510c159d9684@syzkaller.appspotmail.com
Suggested-by: Tetsuo Handa <penguin-kernel@i-love.sakura.ne.jp>
Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Steven Rostedt <rostedt@goodmis.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/kernel/profile.c b/kernel/profile.c
index 9aa2a4445b0d2a21c736b844f2df7acebe7b2158..efa58f63dc1bfd10ac9848835a2b86ea6ceb23df 100644 (file)
--- a/kernel/profile.c
+++ b/kernel/profile.c
@@ -40,7 +40,8 @@ struct profile_hit {
 #define NR_PROFILE_GRP         (NR_PROFILE_HIT/PROFILE_GRPSZ)
 
 static atomic_t *prof_buffer;
-static unsigned long prof_len, prof_shift;
+static unsigned long prof_len;
+static unsigned short int prof_shift;
 
 int prof_on __read_mostly;
 EXPORT_SYMBOL_GPL(prof_on);
@@ -66,8 +67,8 @@ int profile_setup(char *str)
                if (str[strlen(sleepstr)] == ',')
                        str += strlen(sleepstr) + 1;
                if (get_option(&str, &par))
-                       prof_shift = par;
-               pr_info("kernel sleep profiling enabled (shift: %ld)\n",
+                       prof_shift = clamp(par, 0, BITS_PER_LONG - 1);
+               pr_info("kernel sleep profiling enabled (shift: %u)\n",
                        prof_shift);
 #else
                pr_warn("kernel sleep profiling requires CONFIG_SCHEDSTATS\n");
@@ -77,21 +78,21 @@ int profile_setup(char *str)
                if (str[strlen(schedstr)] == ',')
                        str += strlen(schedstr) + 1;
                if (get_option(&str, &par))
-                       prof_shift = par;
-               pr_info("kernel schedule profiling enabled (shift: %ld)\n",
+                       prof_shift = clamp(par, 0, BITS_PER_LONG - 1);
+               pr_info("kernel schedule profiling enabled (shift: %u)\n",
                        prof_shift);
        } else if (!strncmp(str, kvmstr, strlen(kvmstr))) {
                prof_on = KVM_PROFILING;
                if (str[strlen(kvmstr)] == ',')
                        str += strlen(kvmstr) + 1;
                if (get_option(&str, &par))
-                       prof_shift = par;
-               pr_info("kernel KVM profiling enabled (shift: %ld)\n",
+                       prof_shift = clamp(par, 0, BITS_PER_LONG - 1);
+               pr_info("kernel KVM profiling enabled (shift: %u)\n",
                        prof_shift);
        } else if (get_option(&str, &par)) {
-               prof_shift = par;
+               prof_shift = clamp(par, 0, BITS_PER_LONG - 1);
                prof_on = CPU_PROFILING;
-               pr_info("kernel profiling enabled (shift: %ld)\n",
+               pr_info("kernel profiling enabled (shift: %u)\n",
                        prof_shift);
        }
        return 1;
@@ -467,7 +468,7 @@ read_profile(struct file *file, char __user *buf, size_t count, loff_t *ppos)
        unsigned long p = *ppos;
        ssize_t read;
        char *pnt;
-       unsigned int sample_step = 1 << prof_shift;
+       unsigned long sample_step = 1UL << prof_shift;
 
        profile_flip_buffers();
        if (p >= (prof_len+1)*sizeof(unsigned int))