linux-kernel - UBSAN: Undefined behaviour in lib/radix-tree.c:123:14: member access within null pointer of type 'const struct radix_tree

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <19427cc3-3372-9b02-4b92-096fbe328622@molgen.mpg.de>
Date:   Fri, 20 Jul 2018 09:53:21 +0200
From:   Paul Menzel <pmenzel+linux-kernel@...gen.mpg.de>
To:     Matthew Wilcox <mawilcox@...rosoft.com>
Cc:     linux-kernel@...r.kernel.org
Subject: UBSAN: Undefined behaviour in lib/radix-tree.c:123:14: member access
 within null pointer of type 'const struct radix_tree_node'

Dear Linux folks,


Enabling the undefined behavior sanitizer and building GNU/Linux 
4.18-rc5+ (with some unrelated commits) with GCC 8.1.0 from Debian 
Sid/unstable, the warning below is shown.

> [    0.958688] ================================================================================
> [    0.959029] UBSAN: Undefined behaviour in lib/radix-tree.c:123:14
> [    0.959212] member access within null pointer of type 'const struct radix_tree_node'
> [    0.959472] CPU: 0 PID: 24 Comm: kworker/0:2 Not tainted 4.18.0-rc5-00316-g4864b68cedf2 #104
> [    0.959475] Hardware name: ASROCK E350M1/E350M1, BIOS TIMELESS 01/01/1970
> [    0.959488] Workqueue: events_power_efficient ioc_release_fn
> [    0.959492] Call Trace:
> [    0.959501]  dump_stack+0x55/0x89
> [    0.959507]  ubsan_epilogue+0xb/0x33
> [    0.959511]  handle_null_ptr_deref+0x7f/0x90
> [    0.959516]  __ubsan_handle_type_mismatch_v1+0x55/0x60
> [    0.959521]  __radix_tree_delete+0xc5/0xe0
> [    0.959525]  radix_tree_delete_item+0x5f/0xf0
> [    0.959529]  radix_tree_delete+0xa/0x10
> [    0.959532]  ioc_destroy_icq+0x58/0x1f0
> [    0.959538]  ? free_tty_struct+0x34/0x50
> [    0.959541]  ioc_release_fn+0x9c/0x1a0
> [    0.959548]  process_one_work+0x220/0x700
> [    0.959553]  worker_thread+0x5a/0x690
> [    0.959557]  kthread+0x14e/0x200
> [    0.959561]  ? drain_workqueue+0x290/0x290
> [    0.959565]  ? kthread_create_worker_on_cpu+0x30/0x30
> [    0.959568]  ret_from_fork+0x1c/0x38
> [    0.959572] ================================================================================


Kind regards,

Paul