Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1317694 > unrolled thread

UBSAN: Undefined behaviour in drivers/usb/core/devio.c:1517:25

Started byChris Bainbridge <chris.bainbridge@gmail.com>
First post2016-01-26 11:20 +0100
Last post2016-01-26 17:50 +0100
Articles 4 — 4 participants

Back to article view | Back to linux.kernel

Contents

  UBSAN: Undefined behaviour in drivers/usb/core/devio.c:1517:25 Chris Bainbridge <chris.bainbridge@gmail.com> - 2016-01-26 11:20 +0100
    Re: UBSAN: Undefined behaviour in drivers/usb/core/devio.c:1517:25 Alan Stern <stern@rowland.harvard.edu> - 2016-01-26 16:30 +0100
      Re: UBSAN: Undefined behaviour in drivers/usb/core/devio.c:1517:25 Andrey Ryabinin <aryabinin@virtuozzo.com> - 2016-01-26 17:10 +0100
        Re: UBSAN: Undefined behaviour in drivers/usb/core/devio.c:1517:25 Greg KH <gregkh@linuxfoundation.org> - 2016-01-26 17:50 +0100

#1317694 — UBSAN: Undefined behaviour in drivers/usb/core/devio.c:1517:25

FromChris Bainbridge <chris.bainbridge@gmail.com>
Date2016-01-26 11:20 +0100
SubjectUBSAN: Undefined behaviour in drivers/usb/core/devio.c:1517:25
Message-ID<qV8T8-2E6-9@gated-at.bofh.it>
Booting 4.5.0-rc1 with new UBSAN checker enabled:

[    4.556968] ================================================================================
[    4.556972] UBSAN: Undefined behaviour in drivers/usb/core/devio.c:1517:25
[    4.556975] shift exponent -1 is negative
[    4.556979] CPU: 2 PID: 3624 Comm: usb Not tainted 4.5.0-rc1 #252
[    4.556981] Hardware name: Apple Inc. MacBookPro10,2/Mac-AFD8A9D944EA4843, BIOS MBP102.88Z.0106.B0A.1509130955 09/13/2015
[    4.556984]  0000000000000000 0000000000000000 ffffffff845c6528 ffff8802493b3c68
[    4.556988]  ffffffff81b2e7d9 0000000000000007 ffff8802493b3c98 ffff8802493b3c80
[    4.556992]  ffffffff81bcb87d ffffffffffffffff ffff8802493b3d10 ffffffff81bcc1c1
[    4.556996] Call Trace:
[    4.557004]  [<ffffffff81b2e7d9>] dump_stack+0x45/0x6c
[    4.557010]  [<ffffffff81bcb87d>] ubsan_epilogue+0xd/0x40
[    4.557015]  [<ffffffff81bcc1c1>] __ubsan_handle_shift_out_of_bounds+0xf1/0x140
[    4.557020]  [<ffffffff81438f49>] ? __kmalloc+0x209/0x5f0
[    4.557025]  [<ffffffff8220a615>] ? usb_alloc_urb+0x15/0x40
[    4.557030]  [<ffffffff822247af>] ? proc_do_submiturb+0x9af/0x2c30
[    4.557034]  [<ffffffff82226794>] proc_do_submiturb+0x2994/0x2c30
[    4.557039]  [<ffffffff811eb821>] ? blocking_notifier_call_chain+0x11/0x20
[    4.557044]  [<ffffffff8222733b>] usbdev_do_ioctl+0x90b/0x2170
[    4.557049]  [<ffffffff81279fe4>] ? hrtimer_start_range_ns+0x274/0xc60
[    4.557053]  [<ffffffff82228bb9>] usbdev_ioctl+0x9/0x10
[    4.557059]  [<ffffffff8148a322>] do_vfs_ioctl+0xd2/0xcb0
[    4.557063]  [<ffffffff8148af74>] SyS_ioctl+0x74/0x80
[    4.557067]  [<ffffffff82b40a57>] entry_SYSCALL_64_fastpath+0x12/0x6a
[    4.557070] ================================================================================

[toc] | [next] | [standalone]

#1318056

FromAlan Stern <stern@rowland.harvard.edu>
Date2016-01-26 16:30 +0100
Message-ID<qVdJ9-5Zk-25@gated-at.bofh.it>
In reply to#1317694
On Tue, 26 Jan 2016, Chris Bainbridge wrote:

> Booting 4.5.0-rc1 with new UBSAN checker enabled:
> 
> [    4.556968] ================================================================================
> [    4.556972] UBSAN: Undefined behaviour in drivers/usb/core/devio.c:1517:25
> [    4.556975] shift exponent -1 is negative

Does a left shift by a negative amount matter if the result isn't used?

Alan Stern

[toc] | [prev] | [next] | [standalone]

#1318099

FromAndrey Ryabinin <aryabinin@virtuozzo.com>
Date2016-01-26 17:10 +0100
Message-ID<qVelS-6xm-57@gated-at.bofh.it>
In reply to#1318056
On 01/26/2016 06:25 PM, Alan Stern wrote:
> On Tue, 26 Jan 2016, Chris Bainbridge wrote:
> 
>> Booting 4.5.0-rc1 with new UBSAN checker enabled:
>>
>> [    4.556968] ================================================================================
>> [    4.556972] UBSAN: Undefined behaviour in drivers/usb/core/devio.c:1517:25
>> [    4.556975] shift exponent -1 is negative
> 
> Does a left shift by a negative amount matter if the result isn't used?
> 

By definition, any code with undefined behavior could do anything.
But in practice, undefined shift just leads to undefined result of shift operation
(it depends on operands and architecture).


> Alan Stern
>

[toc] | [prev] | [next] | [standalone]

#1318136

FromGreg KH <gregkh@linuxfoundation.org>
Date2016-01-26 17:50 +0100
Message-ID<qVeYz-6NP-41@gated-at.bofh.it>
In reply to#1318099
On Tue, Jan 26, 2016 at 07:03:39PM +0300, Andrey Ryabinin wrote:
> On 01/26/2016 06:25 PM, Alan Stern wrote:
> > On Tue, 26 Jan 2016, Chris Bainbridge wrote:
> > 
> >> Booting 4.5.0-rc1 with new UBSAN checker enabled:
> >>
> >> [    4.556968] ================================================================================
> >> [    4.556972] UBSAN: Undefined behaviour in drivers/usb/core/devio.c:1517:25
> >> [    4.556975] shift exponent -1 is negative
> > 
> > Does a left shift by a negative amount matter if the result isn't used?
> > 
> 
> By definition, any code with undefined behavior could do anything.

But in reality, we are ok here, gcc isn't that foolish.

> But in practice, undefined shift just leads to undefined result of shift operation
> (it depends on operands and architecture).

But if we don't use the value...

Anyway, please send a patch if you wish this issue to be fixed and we
can discuss it that way.

thanks,

greg k-h

[toc] | [prev] | [standalone]

Back to top | Article view | linux.kernel

csiph-web