[PATCH v2] exit: avoid undefined behaviour when call wait4

Path	csiph.com!news.mixmin.net!aioe.org!news.servidellagleba.it!bofh.it!news.nic.it!robomod
From	zhong jiang <zhongjiang@huawei.com>
Newsgroups	linux.kernel
Subject	[PATCH v2] exit: avoid undefined behaviour when call wait4
Date	Tue, 13 Jun 2017 15:00:02 +0200
Message-ID	<tRTAl-859-21@gated-at.bofh.it> (permalink)
X-Original-To	<akpm@linux-foundation.org>, <jlayton@redhat.com>
X-Mailer	git-send-email 1.7.12.4
MIME-Version	1.0
Content-Type	text/plain
X-Originating-IP	[10.175.102.37]
X-Cfilter-Loop	Reflected
X-Mirapoint-Virus-Rapid-Raw	score=unknown(0), refid=str=0001.0A090201.593FE18F.006F,ss=1,re=0.000,recu=0.000,reip=0.000,cl=1,cld=1,fgs=0, ip=0.0.0.0, so=2014-11-16 11:51:01, dmn=2013-03-21 17:37:32
X-Mirapoint-Loop-ID	ccfd5d28ee574b55d0879b568d75f2db
Sender	robomod@news.nic.it
List-ID	<linux-kernel.vger.kernel.org>
X-Mailing-List	linux-kernel@vger.kernel.org
Approved	robomod@news.nic.it
Lines	51
Organization	linux.* mail to news gateway
X-Original-Cc	<oleg@redhat.com>, <jslaby@suse.cz>, <viro@zeniv.linux.org.uk>, <mhocko@kernel.org>, <vbabka@suse.cz>, <linux-mm@kvack.org>, <linux-kernel@vger.kernel.org>
X-Original-Date	Tue, 13 Jun 2017 20:53:31 +0800
X-Original-Message-ID	<1497358411-53071-1-git-send-email-zhongjiang@huawei.com>
X-Original-Sender	linux-kernel-owner@vger.kernel.org
Xref	csiph.com linux.kernel:1664823

Show key headers only | View raw

From: zhongjiang <zhongjiang@huawei.com>

wait4(-2147483648, 0x20, 0, 0xdd0000) triggers:
UBSAN: Undefined behaviour in kernel/exit.c:1651:9

The related calltrace is as follows:

[518871.435738] negation of -2147483648 cannot be represented in type 'int':
[518871.442618] CPU: 9 PID: 16482 Comm: zj Tainted: G    B          ---- -------   3.10.0-327.53.58.71.x86_64+ #66
[518871.452874] Hardware name: Huawei Technologies Co., Ltd. Tecal RH2285          /BC11BTSA              , BIOS CTSAV036 04/27/2011
[518871.464690]  ffffffff82599190 000000008b740a25 ffff880112447d90 ffffffff81d6eb16
[518871.472395]  ffff880112447da8 ffffffff81d6ebc9 ffffffff82599180 ffff880112447e98
[518871.480101]  ffffffff81d6fc99 0000000041b58ab3 ffffffff8228d698 ffffffff81d6fb90
[518871.487801] Call Trace:
[518871.490435]  [<ffffffff81d6eb16>] dump_stack+0x19/0x1b
[518871.495751]  [<ffffffff81d6ebc9>] ubsan_epilogue+0xd/0x50
[518871.501328]  [<ffffffff81d6fc99>] __ubsan_handle_negate_overflow+0x109/0x14e
[518871.508548]  [<ffffffff81d6fb90>] ? __ubsan_handle_divrem_overflow+0x1df/0x1df
[518871.516041]  [<ffffffff8116e0d4>] ? lg_local_lock+0x24/0xb0
[518871.521785]  [<ffffffff8116e640>] ? lg_local_unlock+0x20/0xd0
[518871.527708]  [<ffffffff81366fa0>] ? __pmd_alloc+0x180/0x180
[518871.533458]  [<ffffffff8143f81b>] ? mntput+0x3b/0x70
[518871.538598]  [<ffffffff8110d7bb>] SyS_wait4+0x1cb/0x1e0
[518871.543999]  [<ffffffff8110d5f0>] ? SyS_waitid+0x220/0x220
[518871.549661]  [<ffffffff8123bb57>] ? __audit_syscall_entry+0x1f7/0x2a0
[518871.556278]  [<ffffffff81d91109>] system_call_fastpath+0x16/0x1b

The patch by excluding the overflow to avoid the UBSAN warning.

Signed-off-by: zhong jiang <zhongjiang@huawei.com>
---
 kernel/exit.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/kernel/exit.c b/kernel/exit.c
index 516acdb..cfe70cf 100644
--- a/kernel/exit.c
+++ b/kernel/exit.c
@@ -1701,6 +1701,10 @@ static long do_wait(struct wait_opts *wo)
 	if (upid == -1)
 		type = PIDTYPE_MAX;
 	else if (upid < 0) {
+		/* -INT_MIN is not defined */
+		if (upid == INT_MIN)
+			return -ESRCH;
+
 		type = PIDTYPE_PGID;
 		pid = find_get_pid(-upid);
 	} else if (upid == 0) {
-- 
1.7.12.4

Back to linux.kernel | Previous | Next | Find similar | Unroll thread

Thread

[PATCH v2] exit: avoid undefined behaviour when call wait4 zhong jiang <zhongjiang@huawei.com> - 2017-06-13 15:00 +0200

csiph-web