linux-kernel - Re: UBSAN: Undefined behaviour in lib/radix-tree.c:123:14: member access within null pointer of type 'const struct radix_tree

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 20 Jul 2018 09:31:02 +0100
From:   Mark Rutland <mark.rutland@....com>
To:     Paul Menzel <pmenzel+linux-kernel@...gen.mpg.de>
Cc:     Matthew Wilcox <mawilcox@...rosoft.com>,
        linux-kernel@...r.kernel.org
Subject: Re: UBSAN: Undefined behaviour in lib/radix-tree.c:123:14: member
 access within null pointer of type 'const struct radix_tree_node'

In-Reply-To: <19427cc3-3372-9b02-4b92-096fbe328622@...gen.mpg.de>

On Fri, Jul 20, 2018 at 09:53:21AM +0200, Paul Menzel wrote:
> Dear Linux folks,

Hi,

> Enabling the undefined behavior sanitizer and building GNU/Linux 4.18-rc5+
> (with some unrelated commits) with GCC 8.1.0 from Debian Sid/unstable, the
> warning below is shown.
> 
> > [    0.958688] ================================================================================
> > [    0.959029] UBSAN: Undefined behaviour in lib/radix-tree.c:123:14

That's in get_slot_offset(), and I think this is addressed by the patch [1] I previously sent.

There are at least a couple of instances in the radix tree code, and I had
intended to address them together, but I haven't had the chance over the last
couple of weeks.

I will try to get back to that soon.

> > [    0.959212] member access within null pointer of type 'const struct radix_tree_node'
> > [    0.959472] CPU: 0 PID: 24 Comm: kworker/0:2 Not tainted 4.18.0-rc5-00316-g4864b68cedf2 #104
> > [    0.959475] Hardware name: ASROCK E350M1/E350M1, BIOS TIMELESS 01/01/1970
> > [    0.959488] Workqueue: events_power_efficient ioc_release_fn
> > [    0.959492] Call Trace:
> > [    0.959501]  dump_stack+0x55/0x89
> > [    0.959507]  ubsan_epilogue+0xb/0x33
> > [    0.959511]  handle_null_ptr_deref+0x7f/0x90
> > [    0.959516]  __ubsan_handle_type_mismatch_v1+0x55/0x60
> > [    0.959521]  __radix_tree_delete+0xc5/0xe0
> > [    0.959525]  radix_tree_delete_item+0x5f/0xf0
> > [    0.959529]  radix_tree_delete+0xa/0x10
> > [    0.959532]  ioc_destroy_icq+0x58/0x1f0
> > [    0.959538]  ? free_tty_struct+0x34/0x50
> > [    0.959541]  ioc_release_fn+0x9c/0x1a0
> > [    0.959548]  process_one_work+0x220/0x700
> > [    0.959553]  worker_thread+0x5a/0x690
> > [    0.959557]  kthread+0x14e/0x200
> > [    0.959561]  ? drain_workqueue+0x290/0x290
> > [    0.959565]  ? kthread_create_worker_on_cpu+0x30/0x30
> > [    0.959568]  ret_from_fork+0x1c/0x38
> > [    0.959572] ================================================================================

Thanks,
Mark.

[1] https://lkml.kernel.org/r/20180706134144.48446-1-mark.rutland@arm.com