[PATCH] capabilities: fix undefined behavior in bit shift for CAP_TO_MASK

[Andrew G. Morgan]

Acked-by: Andrew G. Morgan <morgan at kernel.org>


On Mon, Oct 31, 2022 at 4:25 AM Gaosheng Cui <cuigaosheng1 at huawei.com> wrote:
>
> Shifting signed 32-bit value by 31 bits is undefined, so changing
> significant bit to unsigned. The UBSAN warning calltrace like below:
>
> UBSAN: shift-out-of-bounds in security/commoncap.c:1252:2
> left shift of 1 by 31 places cannot be represented in type 'int'
> Call Trace:
>  <TASK>
>  dump_stack_lvl+0x7d/0xa5
>  dump_stack+0x15/0x1b
>  ubsan_epilogue+0xe/0x4e
>  __ubsan_handle_shift_out_of_bounds+0x1e7/0x20c
>  cap_task_prctl+0x561/0x6f0
>  security_task_prctl+0x5a/0xb0
>  __x64_sys_prctl+0x61/0x8f0
>  do_syscall_64+0x58/0x80
>  entry_SYSCALL_64_after_hwframe+0x63/0xcd
>  </TASK>
>
> Fixes: e338d263a76a ("Add 64-bit capability support to the kernel")
> Signed-off-by: Gaosheng Cui <cuigaosheng1 at huawei.com>
> ---
>  include/uapi/linux/capability.h | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/include/uapi/linux/capability.h b/include/uapi/linux/capability.h
> index 463d1ba2232a..3d61a0ae055d 100644
> --- a/include/uapi/linux/capability.h
> +++ b/include/uapi/linux/capability.h
> @@ -426,7 +426,7 @@ struct vfs_ns_cap_data {
>   */
>
>  #define CAP_TO_INDEX(x)     ((x) >> 5)        /* 1 << 5 == bits in __u32 */
> -#define CAP_TO_MASK(x)      (1 << ((x) & 31)) /* mask for indexed __u32 */
> +#define CAP_TO_MASK(x)      (1U << ((x) & 31)) /* mask for indexed __u32 */
>
>
>  #endif /* _UAPI_LINUX_CAPABILITY_H */
> --
> 2.25.1
>