* Re: [syzbot] UBSAN: shift-out-of-bounds in profile_init
2021-07-14 12:47 [syzbot] UBSAN: shift-out-of-bounds in profile_init syzbot
@ 2021-07-16 12:24 ` Pavel Skripkin
2021-07-16 14:10 ` Tetsuo Handa
2021-07-16 13:55 ` Pavel Skripkin
2021-07-16 14:38 ` Pavel Skripkin
2 siblings, 1 reply; 8+ messages in thread
From: Pavel Skripkin @ 2021-07-16 12:24 UTC (permalink / raw)
To: syzbot; +Cc: linux-kernel, penguin-kernel, rostedt, syzkaller-bugs, tglx
On Wed, 14 Jul 2021 05:47:21 -0700
syzbot <syzbot+e68c89a9510c159d9684@syzkaller.appspotmail.com> wrote:
> Hello,
>
> syzbot found the following issue on:
>
> HEAD commit: 3dbdb38e Merge branch 'for-5.14' of
> git://git.kernel.org/p.. git tree: upstream
> console output:
> https://syzkaller.appspot.com/x/log.txt?x=11342328300000 kernel
> config: https://syzkaller.appspot.com/x/.config?x=a1fcf15a09815757
> dashboard link:
> https://syzkaller.appspot.com/bug?extid=e68c89a9510c159d9684 syz
> repro:
> https://syzkaller.appspot.com/x/repro.syz?x=149a96d2300000 C
> reproducer: https://syzkaller.appspot.com/x/repro.c?x=114e5bc4300000
>
> IMPORTANT: if you fix the issue, please add the following tag to the
> commit: Reported-by:
> syzbot+e68c89a9510c159d9684@syzkaller.appspotmail.com
>
> kernel profiling enabled (shift: 1000000)
> ================================================================================
> UBSAN: shift-out-of-bounds in kernel/profile.c:110:31
> shift exponent 1000000 is too large for 64-bit type 'long int'
> CPU: 0 PID: 8453 Comm: syz-executor969 Tainted: G W
> 5.13.0-syzkaller #0 Hardware name: Google Google Compute
> Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace:
> __dump_stack lib/dump_stack.c:79 [inline]
> dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:96
> ubsan_epilogue+0xb/0x5a lib/ubsan.c:148
> __ubsan_handle_shift_out_of_bounds.cold+0xb1/0x181 lib/ubsan.c:327
> profile_init+0xfc/0x110 kernel/profile.c:110
> profiling_store+0x5e/0xd0 kernel/ksysfs.c:80
> kobj_attr_store+0x50/0x80 lib/kobject.c:856
> sysfs_kf_write+0x110/0x160 fs/sysfs/file.c:139
I believe, something like this should fix it:
diff --git a/kernel/ksysfs.c b/kernel/ksysfs.c
index 35859da8bd4f..ca075d9f671a 100644
--- a/kernel/ksysfs.c
+++ b/kernel/ksysfs.c
@@ -76,7 +76,9 @@ static ssize_t profiling_store(struct kobject *kobj,
* has a ton of callers and is not const. It is
* easiest to cast it away here.
*/
- profile_setup((char *)buf);
+ ret = profile_setup((char *)buf);
+ if (!ret)
+ return -EINVAL;
ret = profile_init();
if (ret)
return ret;
diff --git a/kernel/profile.c b/kernel/profile.c
index c2ebddb5e974..5c61677030f4 100644
--- a/kernel/profile.c
+++ b/kernel/profile.c
@@ -42,6 +42,7 @@ struct profile_hit {
static atomic_t *prof_buffer;
static unsigned long prof_len, prof_shift;
+#define MAX_PROF_SHIFT sizeof(prof_shift) * 8
int prof_on __read_mostly;
EXPORT_SYMBOL_GPL(prof_on);
@@ -66,8 +67,11 @@ int profile_setup(char *str)
prof_on = SLEEP_PROFILING;
if (str[strlen(sleepstr)] == ',')
str += strlen(sleepstr) + 1;
- if (get_option(&str, &par))
+ if (get_option(&str, &par)) {
+ if (par >= MAX_PROF_SHIFT)
+ return 0;
prof_shift = par;
+ }
pr_info("kernel sleep profiling enabled (shift: %ld)\n",
prof_shift);
#else
@@ -77,19 +81,27 @@ int profile_setup(char *str)
prof_on = SCHED_PROFILING;
if (str[strlen(schedstr)] == ',')
str += strlen(schedstr) + 1;
- if (get_option(&str, &par))
+ if (get_option(&str, &par)) {
+ if (par >= MAX_PROF_SHIFT)
+ return 0;
prof_shift = par;
+ }
pr_info("kernel schedule profiling enabled (shift: %ld)\n",
prof_shift);
} else if (!strncmp(str, kvmstr, strlen(kvmstr))) {
prof_on = KVM_PROFILING;
if (str[strlen(kvmstr)] == ',')
str += strlen(kvmstr) + 1;
- if (get_option(&str, &par))
+ if (get_option(&str, &par)) {
+ if (par >= MAX_PROF_SHIFT)
+ return 0;
prof_shift = par;
+ }
pr_info("kernel KVM profiling enabled (shift: %ld)\n",
prof_shift);
} else if (get_option(&str, &par)) {
+ if (par >= MAX_PROF_SHIFT)
+ return 0;
prof_shift = par;
prof_on = CPU_PROFILING;
pr_info("kernel profiling enabled (shift: %ld)\n",
But this function can be called not only from sysfs and I can't
understand will my patch break something or not. And, I think, error
message is needed somewhere here to inform callers about wrong shift
value.
Thoughts?
--
With regards,
Pavel Skripkin
^ permalink raw reply related [flat|nested] 8+ messages in thread* Re: [syzbot] UBSAN: shift-out-of-bounds in profile_init
2021-07-16 12:24 ` Pavel Skripkin
@ 2021-07-16 14:10 ` Tetsuo Handa
2021-07-16 14:18 ` Pavel Skripkin
0 siblings, 1 reply; 8+ messages in thread
From: Tetsuo Handa @ 2021-07-16 14:10 UTC (permalink / raw)
To: Pavel Skripkin; +Cc: linux-kernel, rostedt, syzkaller-bugs, tglx, syzbot
On 2021/07/16 21:24, Pavel Skripkin wrote:
> But this function can be called not only from sysfs and I can't
> understand will my patch break something or not. And, I think, error
> message is needed somewhere here to inform callers about wrong shift
> value.
>
>
> Thoughts?
Subsequent profiling_store() attempts will return -EEXIST if
profile_setup() once set prof_on to non-zero value. Therefore,
if you try to return -EINVAL when profile_setup() returns 0,
you need to make sure that prof_on is set to non-zero value
only if prof_shift is valid.
But, the userspace might not be aware of the value of MAX_PROF_SHIFT
because it is an architecture dependent value, and par might become negative
value because get_option() accepts negative value. Therefore, it might be
better to
+ par = clamp(par, 0, MAX_PROF_SHIFT - 1);
than
+ if (par < 0 || par >= MAX_PROF_SHIFT)
+ return 0;
.
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [syzbot] UBSAN: shift-out-of-bounds in profile_init
2021-07-16 14:10 ` Tetsuo Handa
@ 2021-07-16 14:18 ` Pavel Skripkin
0 siblings, 0 replies; 8+ messages in thread
From: Pavel Skripkin @ 2021-07-16 14:18 UTC (permalink / raw)
To: Tetsuo Handa; +Cc: linux-kernel, rostedt, syzkaller-bugs, tglx, syzbot
On Fri, 16 Jul 2021 23:10:25 +0900
Tetsuo Handa <penguin-kernel@i-love.sakura.ne.jp> wrote:
> On 2021/07/16 21:24, Pavel Skripkin wrote:
> > But this function can be called not only from sysfs and I can't
> > understand will my patch break something or not. And, I think, error
> > message is needed somewhere here to inform callers about wrong shift
> > value.
> >
> >
> > Thoughts?
>
> Subsequent profiling_store() attempts will return -EEXIST if
> profile_setup() once set prof_on to non-zero value. Therefore,
> if you try to return -EINVAL when profile_setup() returns 0,
> you need to make sure that prof_on is set to non-zero value
> only if prof_shift is valid.
>
> But, the userspace might not be aware of the value of MAX_PROF_SHIFT
> because it is an architecture dependent value, and par might become
> negative value because get_option() accepts negative value.
> Therefore, it might be better to
>
> + par = clamp(par, 0, MAX_PROF_SHIFT - 1);
>
> than
>
> + if (par < 0 || par >= MAX_PROF_SHIFT)
> + return 0;
>
> .
>
Yes, this sounds much better, thank you. I will send reworked patch to
syzbot. Do you mind if I add
Suggested-by: Tetsuo Handa <penguin-kernel@i-love.sakura.ne.jp>
tag to final patch?
With regards,
Pavel Skripkin
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [syzbot] UBSAN: shift-out-of-bounds in profile_init
2021-07-14 12:47 [syzbot] UBSAN: shift-out-of-bounds in profile_init syzbot
2021-07-16 12:24 ` Pavel Skripkin
@ 2021-07-16 13:55 ` Pavel Skripkin
2021-07-16 16:19 ` syzbot
2021-07-16 14:38 ` Pavel Skripkin
2 siblings, 1 reply; 8+ messages in thread
From: Pavel Skripkin @ 2021-07-16 13:55 UTC (permalink / raw)
To: syzbot; +Cc: linux-kernel, penguin-kernel, rostedt, syzkaller-bugs, tglx
[-- Attachment #1: Type: text/plain, Size: 922 bytes --]
On Wed, 14 Jul 2021 05:47:21 -0700
syzbot <syzbot+e68c89a9510c159d9684@syzkaller.appspotmail.com> wrote:
> Hello,
>
> syzbot found the following issue on:
>
> HEAD commit: 3dbdb38e Merge branch 'for-5.14' of
> git://git.kernel.org/p.. git tree: upstream
> console output:
> https://syzkaller.appspot.com/x/log.txt?x=11342328300000 kernel
> config: https://syzkaller.appspot.com/x/.config?x=a1fcf15a09815757
> dashboard link:
> https://syzkaller.appspot.com/bug?extid=e68c89a9510c159d9684 syz
> repro:
> https://syzkaller.appspot.com/x/repro.syz?x=149a96d2300000 C
> reproducer: https://syzkaller.appspot.com/x/repro.c?x=114e5bc4300000
>
> IMPORTANT: if you fix the issue, please add the following tag to the
> commit: Reported-by:
> syzbot+e68c89a9510c159d9684@syzkaller.appspotmail.com
>
#syz test
git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
With regards,
Pavel Skripkin
[-- Attachment #2: 0001-profiling-fix-shift-out-of-bounds.patch --]
[-- Type: text/x-patch, Size: 2491 bytes --]
From 52652f42abee7eadcdf52fd38ee6cfb0b025448d Mon Sep 17 00:00:00 2001
From: Pavel Skripkin <paskripkin@gmail.com>
Date: Fri, 16 Jul 2021 16:47:17 +0300
Subject: [PATCH] profiling: fix shift-out-of bounds
/** ... **/
Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
---
kernel/ksysfs.c | 4 +++-
kernel/profile.c | 18 +++++++++++++++---
2 files changed, 18 insertions(+), 4 deletions(-)
diff --git a/kernel/ksysfs.c b/kernel/ksysfs.c
index 35859da8bd4f..ca075d9f671a 100644
--- a/kernel/ksysfs.c
+++ b/kernel/ksysfs.c
@@ -76,7 +76,9 @@ static ssize_t profiling_store(struct kobject *kobj,
* has a ton of callers and is not const. It is
* easiest to cast it away here.
*/
- profile_setup((char *)buf);
+ ret = profile_setup((char *)buf);
+ if (!ret)
+ return -EINVAL;
ret = profile_init();
if (ret)
return ret;
diff --git a/kernel/profile.c b/kernel/profile.c
index c2ebddb5e974..5c61677030f4 100644
--- a/kernel/profile.c
+++ b/kernel/profile.c
@@ -42,6 +42,7 @@ struct profile_hit {
static atomic_t *prof_buffer;
static unsigned long prof_len, prof_shift;
+#define MAX_PROF_SHIFT sizeof(prof_shift) * 8
int prof_on __read_mostly;
EXPORT_SYMBOL_GPL(prof_on);
@@ -66,8 +67,11 @@ int profile_setup(char *str)
prof_on = SLEEP_PROFILING;
if (str[strlen(sleepstr)] == ',')
str += strlen(sleepstr) + 1;
- if (get_option(&str, &par))
+ if (get_option(&str, &par)) {
+ if (par >= MAX_PROF_SHIFT)
+ return 0;
prof_shift = par;
+ }
pr_info("kernel sleep profiling enabled (shift: %ld)\n",
prof_shift);
#else
@@ -77,19 +81,27 @@ int profile_setup(char *str)
prof_on = SCHED_PROFILING;
if (str[strlen(schedstr)] == ',')
str += strlen(schedstr) + 1;
- if (get_option(&str, &par))
+ if (get_option(&str, &par)) {
+ if (par >= MAX_PROF_SHIFT)
+ return 0;
prof_shift = par;
+ }
pr_info("kernel schedule profiling enabled (shift: %ld)\n",
prof_shift);
} else if (!strncmp(str, kvmstr, strlen(kvmstr))) {
prof_on = KVM_PROFILING;
if (str[strlen(kvmstr)] == ',')
str += strlen(kvmstr) + 1;
- if (get_option(&str, &par))
+ if (get_option(&str, &par)) {
+ if (par >= MAX_PROF_SHIFT)
+ return 0;
prof_shift = par;
+ }
pr_info("kernel KVM profiling enabled (shift: %ld)\n",
prof_shift);
} else if (get_option(&str, &par)) {
+ if (par >= MAX_PROF_SHIFT)
+ return 0;
prof_shift = par;
prof_on = CPU_PROFILING;
pr_info("kernel profiling enabled (shift: %ld)\n",
--
2.32.0
^ permalink raw reply related [flat|nested] 8+ messages in thread* Re: [syzbot] UBSAN: shift-out-of-bounds in profile_init
2021-07-14 12:47 [syzbot] UBSAN: shift-out-of-bounds in profile_init syzbot
2021-07-16 12:24 ` Pavel Skripkin
2021-07-16 13:55 ` Pavel Skripkin
@ 2021-07-16 14:38 ` Pavel Skripkin
2021-07-16 16:36 ` syzbot
2 siblings, 1 reply; 8+ messages in thread
From: Pavel Skripkin @ 2021-07-16 14:38 UTC (permalink / raw)
To: syzbot; +Cc: linux-kernel, penguin-kernel, rostedt, syzkaller-bugs, tglx
[-- Attachment #1: Type: text/plain, Size: 960 bytes --]
On Wed, 14 Jul 2021 05:47:21 -0700
syzbot <syzbot+e68c89a9510c159d9684@syzkaller.appspotmail.com> wrote:
> Hello,
>
> syzbot found the following issue on:
>
> HEAD commit: 3dbdb38e Merge branch 'for-5.14' of
> git://git.kernel.org/p.. git tree: upstream
> console output:
> https://syzkaller.appspot.com/x/log.txt?x=11342328300000 kernel
> config: https://syzkaller.appspot.com/x/.config?x=a1fcf15a09815757
> dashboard link:
> https://syzkaller.appspot.com/bug?extid=e68c89a9510c159d9684 syz
> repro:
> https://syzkaller.appspot.com/x/repro.syz?x=149a96d2300000 C
> reproducer: https://syzkaller.appspot.com/x/repro.c?x=114e5bc4300000
>
> IMPORTANT: if you fix the issue, please add the following tag to the
> commit: Reported-by:
> syzbot+e68c89a9510c159d9684@syzkaller.appspotmail.com
>
With clamp() call suggested by Tetsuo
#syz test
git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
With regards,
Pavel Skripkin
[-- Attachment #2: 0001-profiling-fix-shift-out-of-bounds.patch --]
[-- Type: text/x-patch, Size: 1919 bytes --]
From 6dadb86239173d28b1d36e974e000d39b088177e Mon Sep 17 00:00:00 2001
From: Pavel Skripkin <paskripkin@gmail.com>
Date: Fri, 16 Jul 2021 17:27:44 +0300
Subject: [PATCH] profiling: fix shift-out-of-bounds
/* ... */
Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
---
kernel/profile.c | 9 +++++----
1 file changed, 5 insertions(+), 4 deletions(-)
diff --git a/kernel/profile.c b/kernel/profile.c
index c2ebddb5e974..c905931e3c3b 100644
--- a/kernel/profile.c
+++ b/kernel/profile.c
@@ -42,6 +42,7 @@ struct profile_hit {
static atomic_t *prof_buffer;
static unsigned long prof_len, prof_shift;
+#define MAX_PROF_SHIFT (sizeof(prof_shift) * 8)
int prof_on __read_mostly;
EXPORT_SYMBOL_GPL(prof_on);
@@ -67,7 +68,7 @@ int profile_setup(char *str)
if (str[strlen(sleepstr)] == ',')
str += strlen(sleepstr) + 1;
if (get_option(&str, &par))
- prof_shift = par;
+ prof_shift = clamp(par, 0, (int) MAX_PROF_SHIFT - 1);
pr_info("kernel sleep profiling enabled (shift: %ld)\n",
prof_shift);
#else
@@ -78,7 +79,7 @@ int profile_setup(char *str)
if (str[strlen(schedstr)] == ',')
str += strlen(schedstr) + 1;
if (get_option(&str, &par))
- prof_shift = par;
+ prof_shift = clamp(par, 0, (int) MAX_PROF_SHIFT - 1);
pr_info("kernel schedule profiling enabled (shift: %ld)\n",
prof_shift);
} else if (!strncmp(str, kvmstr, strlen(kvmstr))) {
@@ -86,11 +87,11 @@ int profile_setup(char *str)
if (str[strlen(kvmstr)] == ',')
str += strlen(kvmstr) + 1;
if (get_option(&str, &par))
- prof_shift = par;
+ prof_shift = clamp(par, 0, (int) MAX_PROF_SHIFT - 1);
pr_info("kernel KVM profiling enabled (shift: %ld)\n",
prof_shift);
} else if (get_option(&str, &par)) {
- prof_shift = par;
+ prof_shift = clamp(par, 0, (int) MAX_PROF_SHIFT - 1);
prof_on = CPU_PROFILING;
pr_info("kernel profiling enabled (shift: %ld)\n",
prof_shift);
--
2.32.0
^ permalink raw reply related [flat|nested] 8+ messages in thread