Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1415133

[PATCH 4.5 096/128] ext4: silence UBSAN in ext4_mb_init()

Show all headers | View raw

4.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Nicolai Stange <nicstange@gmail.com>

commit 935244cd54b86ca46e69bc6604d2adfb1aec2d42 upstream.

Currently, in ext4_mb_init(), there's a loop like the following:

  do {
    ...
    offset += 1 << (sb->s_blocksize_bits - i);
    i++;
  } while (i <= sb->s_blocksize_bits + 1);

Note that the updated offset is used in the loop's next iteration only.

However, at the last iteration, that is at i == sb->s_blocksize_bits + 1,
the shift count becomes equal to (unsigned)-1 > 31 (c.f. C99 6.5.7(3))
and UBSAN reports

  UBSAN: Undefined behaviour in fs/ext4/mballoc.c:2621:15
  shift exponent 4294967295 is too large for 32-bit type 'int'
  [...]
  Call Trace:
   [<ffffffff818c4d25>] dump_stack+0xbc/0x117
   [<ffffffff818c4c69>] ? _atomic_dec_and_lock+0x169/0x169
   [<ffffffff819411ab>] ubsan_epilogue+0xd/0x4e
   [<ffffffff81941cac>] __ubsan_handle_shift_out_of_bounds+0x1fb/0x254
   [<ffffffff81941ab1>] ? __ubsan_handle_load_invalid_value+0x158/0x158
   [<ffffffff814b6dc1>] ? kmem_cache_alloc+0x101/0x390
   [<ffffffff816fc13b>] ? ext4_mb_init+0x13b/0xfd0
   [<ffffffff814293c7>] ? create_cache+0x57/0x1f0
   [<ffffffff8142948a>] ? create_cache+0x11a/0x1f0
   [<ffffffff821c2168>] ? mutex_lock+0x38/0x60
   [<ffffffff821c23ab>] ? mutex_unlock+0x1b/0x50
   [<ffffffff814c26ab>] ? put_online_mems+0x5b/0xc0
   [<ffffffff81429677>] ? kmem_cache_create+0x117/0x2c0
   [<ffffffff816fcc49>] ext4_mb_init+0xc49/0xfd0
   [...]

Observe that the mentioned shift exponent, 4294967295, equals (unsigned)-1.

Unless compilers start to do some fancy transformations (which at least
GCC 6.0.0 doesn't currently do), the issue is of cosmetic nature only: the
such calculated value of offset is never used again.

Silence UBSAN by introducing another variable, offset_incr, holding the
next increment to apply to offset and adjust that one by right shifting it
by one position per loop iteration.

Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=114701
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=112161

Signed-off-by: Nicolai Stange <nicstange@gmail.com>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 fs/ext4/mballoc.c |    6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

--- a/fs/ext4/mballoc.c
+++ b/fs/ext4/mballoc.c
@@ -2578,7 +2578,7 @@ int ext4_mb_init(struct super_block *sb)
 {
 	struct ext4_sb_info *sbi = EXT4_SB(sb);
 	unsigned i, j;
-	unsigned offset;
+	unsigned offset, offset_incr;
 	unsigned max;
 	int ret;
 
@@ -2607,11 +2607,13 @@ int ext4_mb_init(struct super_block *sb)
 
 	i = 1;
 	offset = 0;
+	offset_incr = 1 << (sb->s_blocksize_bits - 1);
 	max = sb->s_blocksize << 2;
 	do {
 		sbi->s_mb_offsets[i] = offset;
 		sbi->s_mb_maxs[i] = max;
-		offset += 1 << (sb->s_blocksize_bits - i);
+		offset += offset_incr;
+		offset_incr = offset_incr >> 1;
 		max = max >> 1;
 		i++;
 	} while (i <= sb->s_blocksize_bits + 1);

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH 4.5 000/128] 4.5.7-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-06 01:00 +0200
  [PATCH 4.5 126/128] Btrfs: fix unexpected return value of fiemap Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-06 16:40 +0200
  [PATCH 4.5 127/128] btrfs: scrub: Set bbio to NULL before calling btrfs_map_block Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-06 16:40 +0200
  [PATCH 4.5 098/128] PM / sleep: Handle failures in device_suspend_late() consistently Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-06 16:40 +0200
  [PATCH 4.5 093/128] ext4: fix check of dqget() return value in ext4_ioctl_setproject() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-06 16:40 +0200
  [PATCH 4.5 110/128] btrfs: allow balancing to dup with multi-device Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-06 16:40 +0200
  [PATCH 4.5 128/128] btrfs: make state preallocation more speculative in __set_extent_bit Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-06 16:40 +0200
  [PATCH 4.5 120/128] btrfs: fix int32 overflow in shrink_delalloc(). Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-06 16:40 +0200
  [PATCH 4.5 095/128] ext4: address UBSAN warning in mb_find_order_for_block() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-06 16:40 +0200
  [PATCH 4.5 102/128] gcov: disable tree-loop-im to reduce stack usage Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-06 16:40 +0200
  [PATCH 4.5 097/128] nfs: avoid race that crashes nfs_init_commit Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-06 16:40 +0200
  [PATCH 4.5 100/128] scripts/package/Makefile: rpmbuild add support of RPMOPTS Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-06 16:40 +0200
  [PATCH 4.5 115/128] btrfs: add check to sysfs handler of label Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-06 16:40 +0200
  [PATCH 4.5 096/128] ext4: silence UBSAN in ext4_mb_init() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-06 16:40 +0200
  [PATCH 4.5 116/128] Btrfs: fix divide error upon chunks stripe_len Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-06 16:40 +0200
  [PATCH 4.5 123/128] btrfs: pass the right error code to the btrfs_std_error Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-06 16:40 +0200
  [PATCH 4.5 113/128] btrfs: fix lock dep warning, move scratch dev out of device_list_mutex and uuid_mutex Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-06 16:40 +0200
  [PATCH 4.5 122/128] btrfs: fix memory leak during RAID 5/6 device replacement Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-06 16:40 +0200
  [PATCH 4.5 109/128] Btrfs: do not create empty block group if we have allocated data Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-06 16:40 +0200
  [PATCH 4.5 114/128] btrfs: add read-only check to sysfs handler of features Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-06 16:40 +0200
  [PATCH 4.5 119/128] btrfs: add write protection to SET_FEATURES ioctl Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-06 16:40 +0200
  [PATCH 4.5 117/128] Btrfs: remove BUG_ON()s in btrfs_map_block Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-06 16:40 +0200
  [PATCH 4.5 111/128] btrfs: fix mixed block count of available space Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-06 16:40 +0200
  [PATCH 4.5 118/128] btrfs: fix lock dep warning move scratch super outside of chunk_mutex Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-06 16:40 +0200
  [PATCH 4.5 125/128] Btrfs: fix empty symlink after creating symlink and fsync parent dir Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-06 16:40 +0200
  [PATCH 4.5 101/128] mm: thp: avoid false positive VM_BUG_ON_PAGE in page_move_anon_rmap() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-06 16:40 +0200
  [PATCH 4.5 112/128] btrfs: avoid overflowing f_bfree Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-06 16:50 +0200
  Re: [PATCH 4.5 000/128] 4.5.7-stable review Shuah Khan <shuahkh@osg.samsung.com> - 2016-06-06 19:30 +0200
  Re: [PATCH 4.5 000/128] 4.5.7-stable review Guenter Roeck <linux@roeck-us.net> - 2016-06-07 15:40 +0200

csiph-web