Messages in this thread Patch in this message | | | Date | Fri, 16 Jul 2021 17:38:19 +0300 | From | Pavel Skripkin <> | Subject | Re: [syzbot] UBSAN: shift-out-of-bounds in profile_init |
| |
On Wed, 14 Jul 2021 05:47:21 -0700 syzbot <syzbot+e68c89a9510c159d9684@syzkaller.appspotmail.com> wrote:
> Hello, > > syzbot found the following issue on: > > HEAD commit: 3dbdb38e Merge branch 'for-5.14' of > git://git.kernel.org/p.. git tree: upstream > console output: > https://syzkaller.appspot.com/x/log.txt?x=11342328300000 kernel > config: https://syzkaller.appspot.com/x/.config?x=a1fcf15a09815757 > dashboard link: > https://syzkaller.appspot.com/bug?extid=e68c89a9510c159d9684 syz > repro: > https://syzkaller.appspot.com/x/repro.syz?x=149a96d2300000 C > reproducer: https://syzkaller.appspot.com/x/repro.c?x=114e5bc4300000 > > IMPORTANT: if you fix the issue, please add the following tag to the > commit: Reported-by: > syzbot+e68c89a9510c159d9684@syzkaller.appspotmail.com >
With clamp() call suggested by Tetsuo
#syz test git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
With regards, Pavel Skripkin From 6dadb86239173d28b1d36e974e000d39b088177e Mon Sep 17 00:00:00 2001 From: Pavel Skripkin <paskripkin@gmail.com> Date: Fri, 16 Jul 2021 17:27:44 +0300 Subject: [PATCH] profiling: fix shift-out-of-bounds
/* ... */
Signed-off-by: Pavel Skripkin <paskripkin@gmail.com> --- kernel/profile.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)
diff --git a/kernel/profile.c b/kernel/profile.c index c2ebddb5e974..c905931e3c3b 100644 --- a/kernel/profile.c +++ b/kernel/profile.c @@ -42,6 +42,7 @@ struct profile_hit { static atomic_t *prof_buffer; static unsigned long prof_len, prof_shift; +#define MAX_PROF_SHIFT (sizeof(prof_shift) * 8) int prof_on __read_mostly; EXPORT_SYMBOL_GPL(prof_on); @@ -67,7 +68,7 @@ int profile_setup(char *str) if (str[strlen(sleepstr)] == ',') str += strlen(sleepstr) + 1; if (get_option(&str, &par)) - prof_shift = par; + prof_shift = clamp(par, 0, (int) MAX_PROF_SHIFT - 1); pr_info("kernel sleep profiling enabled (shift: %ld)\n", prof_shift); #else @@ -78,7 +79,7 @@ int profile_setup(char *str) if (str[strlen(schedstr)] == ',') str += strlen(schedstr) + 1; if (get_option(&str, &par)) - prof_shift = par; + prof_shift = clamp(par, 0, (int) MAX_PROF_SHIFT - 1); pr_info("kernel schedule profiling enabled (shift: %ld)\n", prof_shift); } else if (!strncmp(str, kvmstr, strlen(kvmstr))) { @@ -86,11 +87,11 @@ int profile_setup(char *str) if (str[strlen(kvmstr)] == ',') str += strlen(kvmstr) + 1; if (get_option(&str, &par)) - prof_shift = par; + prof_shift = clamp(par, 0, (int) MAX_PROF_SHIFT - 1); pr_info("kernel KVM profiling enabled (shift: %ld)\n", prof_shift); } else if (get_option(&str, &par)) { - prof_shift = par; + prof_shift = clamp(par, 0, (int) MAX_PROF_SHIFT - 1); prof_on = CPU_PROFILING; pr_info("kernel profiling enabled (shift: %ld)\n", prof_shift); -- 2.32.0
| |