releases/4.4.133/kernel-exit.c-avoid-undefined-behaviour-when-calling-wait4.patch

   1 From dd83c161fbcc5d8be637ab159c0de015cbff5ba4 Mon Sep 17 00:00:00 2001
   2 From: zhongjiang <zhongjiang@huawei.com>
   3 Date: Mon, 10 Jul 2017 15:53:01 -0700
   4 Subject: kernel/exit.c: avoid undefined behaviour when calling wait4()
   5
   6 From: zhongjiang <zhongjiang@huawei.com>
   7
   8 commit dd83c161fbcc5d8be637ab159c0de015cbff5ba4 upstream.
   9
  10 wait4(-2147483648, 0x20, 0, 0xdd0000) triggers:
  11 UBSAN: Undefined behaviour in kernel/exit.c:1651:9
  12
  13 The related calltrace is as follows:
  14
  15   negation of -2147483648 cannot be represented in type 'int':
  16   CPU: 9 PID: 16482 Comm: zj Tainted: G    B          ---- -------   3.10.0-327.53.58.71.x86_64+ #66
  17   Hardware name: Huawei Technologies Co., Ltd. Tecal RH2285          /BC11BTSA              , BIOS CTSAV036 04/27/2011
  18   Call Trace:
  19     dump_stack+0x19/0x1b
  20     ubsan_epilogue+0xd/0x50
  21     __ubsan_handle_negate_overflow+0x109/0x14e
  22     SyS_wait4+0x1cb/0x1e0
  23     system_call_fastpath+0x16/0x1b
  24
  25 Exclude the overflow to avoid the UBSAN warning.
  26
  27 Link: http://lkml.kernel.org/r/1497264618-20212-1-git-send-email-zhongjiang@huawei.com
  28 Signed-off-by: zhongjiang <zhongjiang@huawei.com>
  29 Cc: Oleg Nesterov <oleg@redhat.com>
  30 Cc: David Rientjes <rientjes@google.com>
  31 Cc: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>
  32 Cc: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
  33 Cc: Xishi Qiu <qiuxishi@huawei.com>
  34 Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
  35 Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
  36 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  37
  38 ---
  39  kernel/exit.c |    4 ++++
  40  1 file changed, 4 insertions(+)
  41
  42 --- a/kernel/exit.c
  43 +++ b/kernel/exit.c
  44 @@ -1608,6 +1608,10 @@ SYSCALL_DEFINE4(wait4, pid_t, upid, int
  45                         __WNOTHREAD|__WCLONE|__WALL))
  46                 return -EINVAL;
  47
  48 +       /* -INT_MIN is not defined */
  49 +       if (upid == INT_MIN)
  50 +               return -ESRCH;
  51 +
  52         if (upid == -1)
  53                 type = PIDTYPE_MAX;
  54         else if (upid < 0) {