Messages in this thread | | | Date | Tue, 9 Apr 2024 09:59:18 -0700 | Subject | Re: [Bug] UBSAN: shift-out-of-bounds in sg_build_indirect | From | Bart Van Assche <> |
| |
On 4/9/24 05:51, Sam Sun wrote: > We further analyzed the root cause of this bug. In function > sg_build_indirect of drivers/scsi/sg.c, variable order of line 1900 is > calculated out using get_order(num), and num comes from > scatter_elem_sz. If scatter_elem_sz is equal or below zero, the order > returned will be 52, so that PAGE_SHIFT + order is 64, which is larger > than 32 bits int range, causing shift-out-of bound. This bug is tested > and still remains in the latest upstream linux (6.9-rc3). > If you have any questions, please contact us.
Thank you for having root-caused this issue and also for having shared your root-cause analysis. Do you perhaps plan to post a patch that fixes this issue?
Thanks,
Bart.
| |