linux-kernel - Re: UBSAN: Undefined behaviour in kernel/rcu/tree

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Sat, 10 Nov 2018 16:52:12 -0800
From:   "Paul E. McKenney" <paulmck@...ux.ibm.com>
To:     Christophe LEROY <christophe.leroy@....fr>
Cc:     "linuxppc-dev@...ts.ozlabs.org" <linuxppc-dev@...ts.ozlabs.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Subject: Re: UBSAN: Undefined behaviour in kernel/rcu/tree_plugin.h in
 4.20-rc1

On Fri, Nov 09, 2018 at 12:10:30PM -0800, Paul E. McKenney wrote:
> On Fri, Nov 09, 2018 at 06:11:20PM +0100, Christophe LEROY wrote:
> > (Resending due to error in Paul's address)
> > 
> > Paul
> > 
> > I get the following UBSAN reports in 4.20-rc1 on an MPC8321E
> > (powerpc/book3s/32)
> > 
> > I bisected it to 3e31009898699dfc ("rcu: Defer reporting RCU-preempt
> > quiescent states when disabled")
> 
> Fixed by dfdc33585b0a ("rcu: Avoid signed integer overflow in
> rcu_preempt_deferred_qs()") in my -rcu tree and in -next, which I intend
> to push into the next merge window.

And while I am at it...  The C++ Standards Committee just yesterday
voted "Signed integers are twos complement" into the C++20 standard.  ;-)

Yeah, C++20 rather than now, and C++ rather than C, but there you have it!

							Thanx, Paul

> > Thanks
> > Christophe
> > 
> > [    4.919995] ================================================================================
> > [    4.928428] UBSAN: Undefined behaviour in kernel/rcu/tree_plugin.h:623:28
> > [    4.935198] signed integer overflow:
> > [    4.938766] 0 - -2147483648 cannot be represented in type 'int'
> > [    4.944678] CPU: 0 PID: 119 Comm: mkdir Not tainted
> > 4.19.0-rc1-s3k-dev-00005-g5a60513 #214
> > [    4.952908] Call Trace:
> > [    4.955382] [dec4fd20] [c02cb0d0] ubsan_epilogue+0x18/0x74 (unreliable)
> > [    4.962003] [dec4fd30] [c02cb5e0] handle_overflow+0xd0/0xe0
> > [    4.967588] [dec4fdb0] [c007b424] rcu_preempt_deferred_qs+0xc0/0xc8
> > [    4.973857] [dec4fdd0] [c007be28] rcu_note_context_switch+0x74/0x608
> > [    4.980217] [dec4fe10] [c064b790] __schedule+0x58/0x6e0
> > [    4.985448] [dec4fe50] [c064bfdc] preempt_schedule_common+0x48/0x9c
> > [    4.991717] [dec4fe70] [c01308c8] handle_mm_fault+0x10fc/0x1ecc
> > [    4.997639] [dec4fee0] [c001339c] do_page_fault+0x10c/0x760
> > [    5.003225] [dec4ff40] [c001234c] handle_page_fault+0x14/0x40
> > [    5.008968] --- interrupt: 401 at 0xff9cff8
> > [    5.008968]     LR = 0xfeefd78
> > [    5.016170] ================================================================================
> > [    5.024591] ================================================================================
> > [    5.033005] UBSAN: Undefined behaviour in kernel/rcu/tree_plugin.h:627:28
> > [    5.039775] signed integer overflow:
> > [    5.043342] -2147483648 + -2147483648 cannot be represented in type 'int'
> > [    5.050118] CPU: 0 PID: 119 Comm: mkdir Not tainted
> > 4.19.0-rc1-s3k-dev-00005-g5a60513 #214
> > [    5.058348] Call Trace:
> > [    5.060813] [dec4fd20] [c02cb0d0] ubsan_epilogue+0x18/0x74 (unreliable)
> > [    5.067433] [dec4fd30] [c02cb5e0] handle_overflow+0xd0/0xe0
> > [    5.073014] [dec4fdb0] [c007b408] rcu_preempt_deferred_qs+0xa4/0xc8
> > [    5.079283] [dec4fdd0] [c007be28] rcu_note_context_switch+0x74/0x608
> > [    5.085640] [dec4fe10] [c064b790] __schedule+0x58/0x6e0
> > [    5.090871] [dec4fe50] [c064bfdc] preempt_schedule_common+0x48/0x9c
> > [    5.097139] [dec4fe70] [c01308c8] handle_mm_fault+0x10fc/0x1ecc
> > [    5.103059] [dec4fee0] [c001339c] do_page_fault+0x10c/0x760
> > [    5.108642] [dec4ff40] [c001234c] handle_page_fault+0x14/0x40
> > [    5.114385] --- interrupt: 401 at 0xff9cff8
> > [    5.114385]     LR = 0xfeefd78
> > [    5.121588] ================================================================================
> >