linux-kernel - UBSAN: Undefined behaviour in mm/fadvise.c:72:10

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Date:	Wed, 27 Jan 2016 16:11:51 +0100
From:	Toralf Förster <toralf.foerster@....de>
To:	Linux Kernel <linux-kernel@...r.kernel.org>
Subject: UBSAN: Undefined behaviour in mm/fadvise.c:72:10

got this at a 32 bit Gentoo Linux KVM while fuzzying with trinity :

Jan 27 15:30:50 n22kvm-clone kernel: ================================================================================
Jan 27 15:30:50 n22kvm-clone kernel: UBSAN: Undefined behaviour in mm/fadvise.c:72:10
Jan 27 15:30:50 n22kvm-clone kernel: signed integer overflow:
Jan 27 15:30:50 n22kvm-clone kernel: 3218697763487219936 + 7957419010335735808 cannot be represented in type 'long long int'
Jan 27 15:30:50 n22kvm-clone kernel: CPU: 1 PID: 30658 Comm: trinity-c0 Not tainted 4.5.0-rc1 #1
Jan 27 15:30:50 n22kvm-clone kernel: Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.8.2-0-g33fbe13 by qemu-project.org 04/01/2014
Jan 27 15:30:50 n22kvm-clone kernel:  f0529f4c 00000000 f0529e70 d2bcd78b 00000007 f0529ea0 f0529e80 d2c31bbe
Jan 27 15:30:50 n22kvm-clone kernel:  f0529e80 d3531e1c f0529f04 d2c31f0b d3308e5c f0529ea4 0000002b f0529ecc
Jan 27 15:30:50 n22kvm-clone kernel:  d3531e1c 0000002b 00000286 38313233 37373936 38343336 39313237 00363339
Jan 27 15:30:50 n22kvm-clone kernel: Call Trace:
Jan 27 15:30:50 n22kvm-clone kernel:  [<d2bcd78b>] dump_stack+0x42/0x67
Jan 27 15:30:50 n22kvm-clone kernel:  [<d2c31bbe>] ubsan_epilogue+0xe/0x40
Jan 27 15:30:50 n22kvm-clone kernel:  [<d2c31f0b>] handle_overflow+0xbb/0xf0
Jan 27 15:30:50 n22kvm-clone kernel:  [<d27d8676>] ? __audit_syscall_entry+0x106/0x2a0
Jan 27 15:30:50 n22kvm-clone kernel:  [<d2c31f52>] __ubsan_handle_add_overflow+0x12/0x20
Jan 27 15:30:50 n22kvm-clone kernel:  [<d28f5bf3>] SyS_fadvise64_64+0xd3/0x630
Jan 27 15:30:50 n22kvm-clone kernel:  [<d260333f>] do_fast_syscall_32+0x14f/0x940
Jan 27 15:30:50 n22kvm-clone kernel:  [<d28f5b20>] ? reset_node_managed_pages+0x50/0x50
Jan 27 15:30:50 n22kvm-clone kernel:  [<d31882a1>] sysenter_past_esp+0x42/0x69
Jan 27 15:30:50 n22kvm-clone kernel: ================================================================================

-- 
Toralf, pgp: C4EACDDE 0076E94E