From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Gaosheng Cui <cuigaosheng1@huawei.com>,
Paul Moore <paul@paul-moore.com>, Sasha Levin <sashal@kernel.org>,
eparis@redhat.com, linux-audit@redhat.com
Subject: [PATCH AUTOSEL 5.10 04/18] audit: fix undefined behavior in bit shift for AUDIT_BIT
Date: Fri, 18 Nov 2022 21:14:45 -0500 [thread overview]
Message-ID: <20221119021459.1775052-4-sashal@kernel.org> (raw)
In-Reply-To: <20221119021459.1775052-1-sashal@kernel.org>
From: Gaosheng Cui <cuigaosheng1@huawei.com>
[ Upstream commit 986d93f55bdeab1cac858d1e47b41fac10b2d7f6 ]
Shifting signed 32-bit value by 31 bits is undefined, so changing
significant bit to unsigned. The UBSAN warning calltrace like below:
UBSAN: shift-out-of-bounds in kernel/auditfilter.c:179:23
left shift of 1 by 31 places cannot be represented in type 'int'
Call Trace:
<TASK>
dump_stack_lvl+0x7d/0xa5
dump_stack+0x15/0x1b
ubsan_epilogue+0xe/0x4e
__ubsan_handle_shift_out_of_bounds+0x1e7/0x20c
audit_register_class+0x9d/0x137
audit_classes_init+0x4d/0xb8
do_one_initcall+0x76/0x430
kernel_init_freeable+0x3b3/0x422
kernel_init+0x24/0x1e0
ret_from_fork+0x1f/0x30
</TASK>
Signed-off-by: Gaosheng Cui <cuigaosheng1@huawei.com>
[PM: remove bad 'Fixes' tag as issue predates git, added in v2.6.6-rc1]
Signed-off-by: Paul Moore <paul@paul-moore.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/uapi/linux/audit.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/include/uapi/linux/audit.h b/include/uapi/linux/audit.h
index cd2d8279a5e4..cb4e8e6e86a9 100644
--- a/include/uapi/linux/audit.h
+++ b/include/uapi/linux/audit.h
@@ -182,7 +182,7 @@
#define AUDIT_MAX_KEY_LEN 256
#define AUDIT_BITMASK_SIZE 64
#define AUDIT_WORD(nr) ((__u32)((nr)/32))
-#define AUDIT_BIT(nr) (1 << ((nr) - AUDIT_WORD(nr)*32))
+#define AUDIT_BIT(nr) (1U << ((nr) - AUDIT_WORD(nr)*32))
#define AUDIT_SYSCALL_CLASSES 16
#define AUDIT_CLASS_DIR_WRITE 0
--
2.35.1
next prev parent reply other threads:[~2022-11-19 2:24 UTC|newest]
Thread overview: 18+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-11-19 2:14 [PATCH AUTOSEL 5.10 01/18] wifi: mac80211: fix memory free error when registering wiphy fail Sasha Levin
2022-11-19 2:14 ` [PATCH AUTOSEL 5.10 02/18] wifi: mac80211_hwsim: fix debugfs attribute ps with rc table support Sasha Levin
2022-11-19 2:14 ` [PATCH AUTOSEL 5.10 03/18] riscv: dts: sifive unleashed: Add PWM controlled LEDs Sasha Levin
2022-11-19 2:14 ` Sasha Levin [this message]
2022-11-19 2:14 ` [PATCH AUTOSEL 5.10 05/18] wifi: airo: do not assign -1 to unsigned char Sasha Levin
2022-11-19 2:14 ` [PATCH AUTOSEL 5.10 06/18] wifi: mac80211: Fix ack frame idr leak when mesh has no route Sasha Levin
2022-11-19 2:14 ` [PATCH AUTOSEL 5.10 07/18] spi: stm32: fix stm32_spi_prepare_mbr() that halves spi clk for every run Sasha Levin
2022-11-19 2:14 ` [PATCH AUTOSEL 5.10 08/18] selftests/bpf: Add verifier test for release_reference() Sasha Levin
2022-11-19 2:14 ` [PATCH AUTOSEL 5.10 09/18] Revert "net: macsec: report real_dev features when HW offloading is enabled" Sasha Levin
2022-11-19 2:14 ` [PATCH AUTOSEL 5.10 10/18] ACPI: video: Add backlight=native DMI quirk for Dell G15 5515 Sasha Levin
2022-11-19 2:14 ` [PATCH AUTOSEL 5.10 11/18] platform/x86: touchscreen_dmi: Add info for the RCA Cambio W101 v2 2-in-1 Sasha Levin
2022-11-19 2:14 ` [PATCH AUTOSEL 5.10 12/18] scsi: ibmvfc: Avoid path failures during live migration Sasha Levin
2022-11-19 2:14 ` [PATCH AUTOSEL 5.10 13/18] scsi: scsi_debug: Make the READ CAPACITY response compliant with ZBC Sasha Levin
2022-11-19 2:14 ` [PATCH AUTOSEL 5.10 14/18] drm: panel-orientation-quirks: Add quirk for Acer Switch V 10 (SW5-017) Sasha Levin
2022-11-19 2:14 ` [PATCH AUTOSEL 5.10 15/18] block, bfq: fix null pointer dereference in bfq_bio_bfqg() Sasha Levin
2022-11-19 2:14 ` [PATCH AUTOSEL 5.10 16/18] arm64/syscall: Include asm/ptrace.h in syscall_wrapper header Sasha Levin
2022-11-19 2:14 ` [PATCH AUTOSEL 5.10 17/18] RISC-V: vdso: Do not add missing symbols to version section in linker script Sasha Levin
2022-11-19 2:14 ` [PATCH AUTOSEL 5.10 18/18] MIPS: pic32: treat port as signed integer Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20221119021459.1775052-4-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=cuigaosheng1@huawei.com \
--cc=eparis@redhat.com \
--cc=linux-audit@redhat.com \
--cc=linux-kernel@vger.kernel.org \
--cc=paul@paul-moore.com \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®