linux-kernel - Re: signed integer overflow in atomic.h

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <CAH2r5ms_+ZgzsbUb=ghFpaN-qGLUumpkwD43A8rhqGEPWE12VQ@mail.gmail.com>
Date:   Thu, 12 Aug 2021 10:55:56 -0500
From:   Steve French <smfrench@...il.com>
To:     ronnie sahlberg <ronniesahlberg@...il.com>,
        LKML <linux-kernel@...r.kernel.org>
Cc:     Randy Dunlap <rdunlap@...radead.org>, Paulo Alcantara <pc@....nz>
Subject: Re: signed integer overflow in atomic.h

If the "signed integer overflow" is a compiler bug fixed in last
couple of years - do we even need these two patches that we were
seeing to fix this issue in  a few places in cifs.ko (which we noted
on 5.11 regression test runs, but not 5.14-rc)


On Thu, Aug 12, 2021 at 10:43 AM Steve French <smfrench@...il.com> wrote:
>
> Ronnie,
> The guest irunning the tests is Fedora (although the host where the
> compile is done is RHEL7.9 IIRC) ... do we need to update the compiler
> on it - we do hit some of these with UBSAN enabled on 5.11 tests
> (strangely I don't see them on 5.14-rc)
>
> ---------- Forwarded message ---------
> From: Randy Dunlap <rdunlap@...radead.org>
> Date: Thu, Aug 12, 2021 at 10:07 AM
> Subject: Re: signed integer overflow in atomic.h
> To: Steve French <smfrench@...il.com>, LKML
> <linux-kernel@...r.kernel.org>, Netdev <netdev@...r.kernel.org>
>
>
> On 8/11/21 10:41 PM, Steve French wrote:
> > ===============
> > [   28.345189] UBSAN: signed-integer-overflow in
> > ./arch/x86/include/asm/atomic.h:165:11
> > [   28.345196] 484501395 + 2024361625 cannot be represented in type 'int'
> > [   28.345202] CPU: 6 PID: 987 Comm: nmbd Not tainted 5.11.22 #1
> > [   28.345208] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011
> > [   28.345212] Call Trace:
> > [   28.345218]  dump_stack+0x8d/0xb5
> > [   28.345233]  ubsan_epilogue+0x5/0x50
> > [   28.345242]  handle_overflow+0xa3/0xb0
> > [   28.345257]  ? rcu_read_lock_sched_held+0x39/0x80
> > [   28.345270]  ip_idents_reserve+0x8d/0xb0
> > [   28.345283]  __ip_select_ident+0x3f/0x70
> > [   28.345292]  __ip_make_skb+0x279/0x450
> > [   28.345302]  ? ip_reply_glue_bits+0x40/0x40
> > [   28.345314]  ip_make_skb+0x10d/0x130
> > [   28.345326]  ? ip_route_output_key_hash+0xee/0x190
> > [   28.345344]  udp_sendmsg+0x79b/0x13b0
> > [   28.345365]  ? ip_reply_glue_bits+0x40/0x40
> > [   28.345403]  ? find_held_lock+0x29/0xb0
> > [   28.345420]  ? sock_sendmsg+0x54/0x60
> > [   28.345426]  sock_sendmsg+0x54/0x60
>
> from net/ipv4/route.c:
>
>         /* If UBSAN reports an error there, please make sure your compiler
>          * supports -fno-strict-overflow before reporting it that was a bug
>          * in UBSAN, and it has been fixed in GCC-8.
>          */
>         return atomic_add_return(segs + delta, p_id) - segs;
>
>
> --
> ~Randy
>
>
>
> --
> Thanks,
>
> Steve



-- 
Thanks,

Steve

View attachment "0004-cifs-avoid-signed-integer-overflow-in-calculating-bl.patch" of type "text/x-patch" (1936 bytes)

View attachment "0001-cifs-fix-signed-integer-overflow-when-fl_end-is-OFFS.patch" of type "text/x-patch" (5644 bytes)