Skip to content
Commit b409946b authored by Michael Ellerman's avatar Michael Ellerman
Browse files

powerpc/mm: Fix possible out-of-bounds shift in arch_mmap_rnd()



The recent patch to add runtime configuration of the ASLR limits added a bug in
arch_mmap_rnd() where we may shift an integer (32-bits) by up to 33 bits,
leading to undefined behaviour.

In practice it exhibits as every process seg faulting instantly, presumably
because the rnd value hasn't been restricited by the modulus at all. We didn't
notice because it only happens under certain kernel configurations and if the
number of bits is actually set to a large value.

Fix it by switching to unsigned long.

Fixes: 9fea59bd ("powerpc/mm: Add support for runtime configuration of ASLR limits")
Reported-by: default avatarBalbir Singh <bsingharora@gmail.com>
Reviewed-by: default avatarKees Cook <keescook@chromium.org>
Signed-off-by: default avatarMichael Ellerman <mpe@ellerman.id.au>
parent 9765ad13
Loading
Loading
Loading
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please register or to comment