[PATCH 1/1] hugetlbfs: fix bug in pgoff overflow checking

[Mike Kravetz]

This is a fix for a regression in 32 bit kernels caused by an
invalid check for pgoff overflow in hugetlbfs mmap setup.  The
check incorrectly specified that the size of a loff_t was the
same as the size of a long.  The regression prevents mapping
hugetlbfs files at offset greater than 4GB on 32 bit kernels.

Fix the check by using sizeof(loff_t) to get size.  In addition,
make sure pgoff + length can be represented by a signed long
huge page offset.  This check is only necessary on 32 bit kernels.

Fixes: 63489f8e8211 ("hugetlbfs: check for pgoff value overflow")
Cc: <sta...@vger.kernel.org>
Reported-by: Dan Rue <dan....@linaro.org>
Signed-off-by: Mike Kravetz <mike.krav...@oracle.com>
---
 fs/hugetlbfs/inode.c | 22 +++++++++++++++++-----
 1 file changed, 17 insertions(+), 5 deletions(-)

diff --git a/fs/hugetlbfs/inode.c b/fs/hugetlbfs/inode.c
index b9a254dcc0e7..8450a1d75dfa 100644
--- a/fs/hugetlbfs/inode.c
+++ b/fs/hugetlbfs/inode.c
@@ -116,7 +116,8 @@ static void huge_pagevec_release(struct pagevec *pvec)
  * bit into account.
  */
 #define PGOFF_LOFFT_MAX \
-       (((1UL << (PAGE_SHIFT + 1)) - 1) <<  (BITS_PER_LONG - (PAGE_SHIFT + 1)))
+       (((1UL << (PAGE_SHIFT + 1)) - 1) << \
+        ((sizeof(loff_t) * BITS_PER_BYTE) - (PAGE_SHIFT + 1)))
 
 static int hugetlbfs_file_mmap(struct file *file, struct vm_area_struct *vma)
 {
@@ -138,21 +139,32 @@ static int hugetlbfs_file_mmap(struct file *file, struct 
vm_area_struct *vma)
 
        /*
         * page based offset in vm_pgoff could be sufficiently large to
-        * overflow a (l)off_t when converted to byte offset.
+        * overflow a loff_t when converted to byte offset.
         */
-       if (vma->vm_pgoff & PGOFF_LOFFT_MAX)
+       if ((loff_t)vma->vm_pgoff & (loff_t)PGOFF_LOFFT_MAX)
                return -EINVAL;
 
-       /* must be huge page aligned */
+       /* vm_pgoff must be huge page aligned */
        if (vma->vm_pgoff & (~huge_page_mask(h) >> PAGE_SHIFT))
                return -EINVAL;
 
+       /*
+        * Compute file offset of the end of this mapping
+        */
        vma_len = (loff_t)(vma->vm_end - vma->vm_start);
        len = vma_len + ((loff_t)vma->vm_pgoff << PAGE_SHIFT);
-       /* check for overflow */
+
+       /* Check to ensure this did not overflow loff_t */
        if (len < vma_len)
                return -EINVAL;
 
+       /*
+        * On 32 bit systems, this check is necessary to ensure the last page
+        * of mapping can be represented as a signed long huge page index.
+        */
+       if ((len >> huge_page_shift(h)) > LONG_MAX)
+               return -EINVAL;
+
        inode_lock(inode);
        file_accessed(file);
 
-- 
2.13.6