[Bug 114701] New: ubsan: "shift exponent -1 is negative" in fs/ext4/mballoc.c:2612:15

[Bug 114701] New: ubsan: "shift exponent -1 is negative" in fs/ext4/mballoc.c:2612:15

[bugzilla-daemon]

https://bugzilla.kernel.org/show_bug.cgi?id=114701

            Bug ID: 114701
           Summary: ubsan: "shift exponent -1 is negative" in
                    fs/ext4/mballoc.c:2612:15
           Product: File System
           Version: 2.5
    Kernel Version: 4.5.0
          Hardware: All
                OS: Linux
              Tree: Mainline
            Status: NEW
          Severity: normal
          Priority: P1
         Component: ext4
          Assignee: fs_ext4@kernel-bugs.osdl.org
          Reporter: peter@arbitrary.ch
        Regression: No

The following message appeared during boot:

Mar 15 12:09:22 ivy kernel:
================================================================================
Mar 15 12:09:22 ivy kernel: UBSAN: Undefined behaviour in
fs/ext4/mballoc.c:2612:15
Mar 15 12:09:22 ivy kernel: shift exponent -1 is negative
Mar 15 12:09:22 ivy kernel: CPU: 1 PID: 657 Comm: mount Not tainted 4.5.0-pege1
#1
Mar 15 12:09:22 ivy kernel: Hardware name: Hewlett-Packard HP ENVY dv6 Notebook
PC/181B, BIOS F.29 10/03/2013
Mar 15 12:09:22 ivy kernel:  0000000000000000 00000000450d838f ffffffff816fcef7
0000000000000001
Mar 15 12:09:22 ivy kernel:  00000000450d838f ffff880449cfbb90 ffff880449cfbc10
ffffffff817952a9
Mar 15 12:09:22 ivy kernel:  ffffffffc324f17e ffffffff81795caa 0000000000000202
000000000000312d
Mar 15 12:09:22 ivy kernel: Call Trace:
Mar 15 12:09:22 ivy kernel:  [<ffffffff816fcef7>] ? dump_stack+0x70/0xb9
Mar 15 12:09:22 ivy kernel:  [<ffffffff817952a9>] ? ubsan_epilogue+0x9/0x40
Mar 15 12:09:22 ivy kernel:  [<ffffffff81795caa>] ?
__ubsan_handle_shift_out_of_bounds+0xfa/0x150
Mar 15 12:09:22 ivy kernel:  [<ffffffff81380031>] ? use_mm+0x3e1/0x5d0
Mar 15 12:09:22 ivy kernel:  [<ffffffffc310e408>] ? ext4_mb_init+0xbf8/0xf70
[ext4]
Mar 15 12:09:22 ivy kernel:  [<ffffffffc31146db>] ?
ext4_setup_system_zone+0x20b/0x4d0 [ext4]
Mar 15 12:09:22 ivy kernel:  [<ffffffffc30cbd5e>] ?
ext4_fill_super+0x52fe/0x83a0 [ext4]
Mar 15 12:09:22 ivy kernel:  [<ffffffff817252b9>] ? snprintf+0x49/0x60
Mar 15 12:09:22 ivy kernel:  [<ffffffffc30c6a60>] ?
ext4_calculate_overhead+0xc90/0xc90 [ext4]
Mar 15 12:09:22 ivy kernel:  [<ffffffff8145a549>] ? mount_bdev+0x1a9/0x290
Mar 15 12:09:22 ivy kernel:  [<ffffffff8145bbba>] ? mount_fs+0x4a/0x280
Mar 15 12:09:22 ivy kernel:  [<ffffffff81499906>] ? vfs_kern_mount+0x76/0x290
Mar 15 12:09:22 ivy kernel:  [<ffffffff814a118c>] ? do_mount+0x2ac/0x1be0
Mar 15 12:09:22 ivy kernel:  [<ffffffff814a0bd5>] ?
copy_mount_options+0x35/0x320
Mar 15 12:09:22 ivy kernel:  [<ffffffff814a3274>] ? SyS_mount+0x84/0xc0
Mar 15 12:09:22 ivy kernel:  [<ffffffff81dfbcf6>] ?
entry_SYSCALL_64_fastpath+0x16/0x75
Mar 15 12:09:22 ivy kernel:
================================================================================

Let me know if you need more information.

-- 
You are receiving this mail because:
You are watching the assignee of the bug.

[Bug 114701] ubsan: "shift exponent -1 is negative" in fs/ext4/mballoc.c:2612:15

[bugzilla-daemon]

https://bugzilla.kernel.org/show_bug.cgi?id=114701

Navin Parakkal <navinp1912@gmail.com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |navinp1912@gmail.com

--- Comment #1 from Navin Parakkal <navinp1912@gmail.com> ---
diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c
index 50e05df..8ccfcf7 100644
--- a/fs/ext4/mballoc.c
+++ b/fs/ext4/mballoc.c
@@ -1278,6 +1278,8 @@ static int mb_find_order_for_block(struct ext4_buddy
*e4b, int block)
                        /* this block is part of buddy of order 'order' */
                        return order;
                }
+               if (order > e4b->bd_blkbits)
+                       break;
                bb += 1 << (e4b->bd_blkbits - order);
                order++;
        }
@@ -2616,6 +2618,8 @@ int ext4_mb_init(struct super_block *sb)
        do {
                sbi->s_mb_offsets[i] = offset;
                sbi->s_mb_maxs[i] = max;
+               if (i > sb->s_blocksize_bits)
+                       break;
                offset += 1 << (sb->s_blocksize_bits - i);
                max = max >> 1;
                i++;


The only case if when i>b you compute off and max but those are not assigned .
So those values can be ignored. It keeps the old behaviour intact and fixes the
undefined behaviour.


offset += 1 << (sb->s_blocksize_bits - i);


/* Remove the if to see trap error at runtime */
/* gcc -fsanitize=undefined x.c */
int main()
{
    int i=1;
    int b=12;
    unsigned ub=12;
    unsigned off=0,uoff=0;
    do{
        if(i> b) break;
        off+=1<<(b-i);
        uoff+=1<<(ub-i);
        i++;
    } while(i<=b+1);
}

-- 
You are receiving this mail because:
You are watching the assignee of the bug.

[Bug 114701] ubsan: "shift exponent -1 is negative" in fs/ext4/mballoc.c:2612:15

[bugzilla-daemon]

https://bugzilla.kernel.org/show_bug.cgi?id=114701

Theodore Tso <tytso@mit.edu> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
                 CC|                            |tytso@mit.edu
         Resolution|---                         |CODE_FIX

--- Comment #2 from Theodore Tso <tytso@mit.edu> ---
I will be applying these patches:

        http://patchwork.ozlabs.org/patch/599805/
        http://patchwork.ozlabs.org/patch/599804/

-- 
You are receiving this mail because:
You are watching the assignee of the bug.