lkml.org 
[lkml]   [2021]   [Jul]   [16]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
Date
From
SubjectRe: [syzbot] UBSAN: shift-out-of-bounds in profile_init
On Wed, 14 Jul 2021 05:47:21 -0700
syzbot <syzbot+e68c89a9510c159d9684@syzkaller.appspotmail.com> wrote:

> Hello,
>
> syzbot found the following issue on:
>
> HEAD commit: 3dbdb38e Merge branch 'for-5.14' of
> git://git.kernel.org/p.. git tree: upstream
> console output:
> https://syzkaller.appspot.com/x/log.txt?x=11342328300000 kernel
> config: https://syzkaller.appspot.com/x/.config?x=a1fcf15a09815757
> dashboard link:
> https://syzkaller.appspot.com/bug?extid=e68c89a9510c159d9684 syz
> repro:
> https://syzkaller.appspot.com/x/repro.syz?x=149a96d2300000 C
> reproducer: https://syzkaller.appspot.com/x/repro.c?x=114e5bc4300000
>
> IMPORTANT: if you fix the issue, please add the following tag to the
> commit: Reported-by:
> syzbot+e68c89a9510c159d9684@syzkaller.appspotmail.com
>

With clamp() call suggested by Tetsuo

#syz test
git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master



With regards,
Pavel Skripkin
From 6dadb86239173d28b1d36e974e000d39b088177e Mon Sep 17 00:00:00 2001
From: Pavel Skripkin <paskripkin@gmail.com>
Date: Fri, 16 Jul 2021 17:27:44 +0300
Subject: [PATCH] profiling: fix shift-out-of-bounds

/* ... */

Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
---
kernel/profile.c | 9 +++++----
1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/kernel/profile.c b/kernel/profile.c
index c2ebddb5e974..c905931e3c3b 100644
--- a/kernel/profile.c
+++ b/kernel/profile.c
@@ -42,6 +42,7 @@ struct profile_hit {

static atomic_t *prof_buffer;
static unsigned long prof_len, prof_shift;
+#define MAX_PROF_SHIFT (sizeof(prof_shift) * 8)

int prof_on __read_mostly;
EXPORT_SYMBOL_GPL(prof_on);
@@ -67,7 +68,7 @@ int profile_setup(char *str)
if (str[strlen(sleepstr)] == ',')
str += strlen(sleepstr) + 1;
if (get_option(&str, &par))
- prof_shift = par;
+ prof_shift = clamp(par, 0, (int) MAX_PROF_SHIFT - 1);
pr_info("kernel sleep profiling enabled (shift: %ld)\n",
prof_shift);
#else
@@ -78,7 +79,7 @@ int profile_setup(char *str)
if (str[strlen(schedstr)] == ',')
str += strlen(schedstr) + 1;
if (get_option(&str, &par))
- prof_shift = par;
+ prof_shift = clamp(par, 0, (int) MAX_PROF_SHIFT - 1);
pr_info("kernel schedule profiling enabled (shift: %ld)\n",
prof_shift);
} else if (!strncmp(str, kvmstr, strlen(kvmstr))) {
@@ -86,11 +87,11 @@ int profile_setup(char *str)
if (str[strlen(kvmstr)] == ',')
str += strlen(kvmstr) + 1;
if (get_option(&str, &par))
- prof_shift = par;
+ prof_shift = clamp(par, 0, (int) MAX_PROF_SHIFT - 1);
pr_info("kernel KVM profiling enabled (shift: %ld)\n",
prof_shift);
} else if (get_option(&str, &par)) {
- prof_shift = par;
+ prof_shift = clamp(par, 0, (int) MAX_PROF_SHIFT - 1);
prof_on = CPU_PROFILING;
pr_info("kernel profiling enabled (shift: %ld)\n",
prof_shift);
--
2.32.0
\
 
 \ /
  Last update: 2021-07-16 16:39    [W:0.136 / U:0.076 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site