[PATCH v3 0/2] fs: clear a UBSAN shift-out-of-bounds warning

[PATCH v3 0/2] fs: clear a UBSAN shift-out-of-bounds warning

[Zhen Lei]

v2 --> v3:
Updated the commit message of patch 2/2 based on Alexander Viro's suggestion.

v1 -- > v2:
1. Replace INT_LIMIT(loff_t) with OFFSET_MAX in btrfs.
2. Replace INT_LIMIT() with type_max().

Zhen Lei (2):
  btrfs: replace INT_LIMIT(loff_t) with OFFSET_MAX
  fs: clear a UBSAN shift-out-of-bounds warning

 fs/btrfs/ordered-data.c | 6 +++---
 include/linux/fs.h      | 5 ++---
 2 files changed, 5 insertions(+), 6 deletions(-)

-- 
2.25.1

[PATCH v3 1/2] btrfs: replace INT_LIMIT(loff_t) with OFFSET_MAX

[Zhen Lei]

OFFSET_MAX is self-annotated and more readable.

Signed-off-by: Zhen Lei <thunder.leizhen@huawei.com>
Acked-by: David Sterba <dsterba@suse.com>
Reviewed-by: Eric Biggers <ebiggers@google.com>
---
 fs/btrfs/ordered-data.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/fs/btrfs/ordered-data.c b/fs/btrfs/ordered-data.c
index e54f8280031fa14..100d9f4836b177d 100644
--- a/fs/btrfs/ordered-data.c
+++ b/fs/btrfs/ordered-data.c
@@ -761,11 +761,11 @@ int btrfs_wait_ordered_range(struct inode *inode, u64 start, u64 len)
 	struct btrfs_ordered_extent *ordered;
 
 	if (start + len < start) {
-		orig_end = INT_LIMIT(loff_t);
+		orig_end = OFFSET_MAX;
 	} else {
 		orig_end = start + len - 1;
-		if (orig_end > INT_LIMIT(loff_t))
-			orig_end = INT_LIMIT(loff_t);
+		if (orig_end > OFFSET_MAX)
+			orig_end = OFFSET_MAX;
 	}
 
 	/* start IO across the range first to instantiate any delalloc
-- 
2.25.1

[PATCH v3 2/2] fs: clear a UBSAN shift-out-of-bounds warning

[Zhen Lei]

UBSAN: shift-out-of-bounds in fs/locks.c:2572:16
left shift of 1 by 63 places cannot be represented in type 'long long int'
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x8d/0xcf lib/dump_stack.c:106
 ubsan_epilogue+0xa/0x44 lib/ubsan.c:151
 __ubsan_handle_shift_out_of_bounds+0x1e7/0x208 lib/ubsan.c:322
 locks_remove_posix+0xba/0x290 fs/locks.c:2572
 filp_close+0x61/0xa0 fs/open.c:1424
 close_fd+0x56/0x70 fs/file.c:664
 __do_sys_close fs/open.c:1439 [inline]
 __se_sys_close fs/open.c:1437 [inline]
 __x64_sys_close+0x1a/0x50 fs/open.c:1437
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x34/0x80 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x63/0xcd
</TASK>

INT_LIMIT() tries to do what type_max() does, except that type_max()
doesn't rely upon undefined behaviour, might as well use type_max()
instead.

Suggested-by: Eric Biggers <ebiggers@kernel.org>
Signed-off-by: Zhen Lei <thunder.leizhen@huawei.com>
Reviewed-by: Eric Biggers <ebiggers@google.com>
---
 include/linux/fs.h | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/include/linux/fs.h b/include/linux/fs.h
index e654435f16512c1..a384741b1449457 100644
--- a/include/linux/fs.h
+++ b/include/linux/fs.h
@@ -1131,9 +1131,8 @@ struct file_lock_context {
 
 /* The following constant reflects the upper bound of the file/locking space */
 #ifndef OFFSET_MAX
-#define INT_LIMIT(x)	(~((x)1 << (sizeof(x)*8 - 1)))
-#define OFFSET_MAX	INT_LIMIT(loff_t)
-#define OFFT_OFFSET_MAX	INT_LIMIT(off_t)
+#define OFFSET_MAX	type_max(loff_t)
+#define OFFT_OFFSET_MAX	type_max(off_t)
 #endif
 
 extern void send_sigio(struct fown_struct *fown, int fd, int band);
-- 
2.25.1

Re: [PATCH v3 0/2] fs: clear a UBSAN shift-out-of-bounds warning

[Al Viro]

On Fri, Nov 25, 2022 at 05:13:56PM +0800, Zhen Lei wrote:
> v2 --> v3:
> Updated the commit message of patch 2/2 based on Alexander Viro's suggestion.

Not exactly what I meant...  I've tentatively applied it, with the
following commit message:

--------------------------------
get rid of INT_LIMIT, use type_max() instead

INT_LIMIT() tries to do what type_max() does, except that type_max()
doesn't rely upon undefined behaviour[*], might as well use type_max()
instead.

[*] if T is an N-bit signed integer type, the maximal value in T is
pow(2, N - 1) - 1, all right, but naive expression for that value
ends up with a couple of wraparounds and as usual for wraparounds
in signed types, that's an undefined behaviour.  type_max() takes
care to avoid those...

Caught-by: UBSAN
Suggested-by: Eric Biggers <ebiggers@kernel.org>
Signed-off-by: Zhen Lei <thunder.leizhen@huawei.com>
Reviewed-by: Eric Biggers <ebiggers@google.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
--------------------------------

Does anybody have objections against the commit message above?

Re: [PATCH v3 0/2] fs: clear a UBSAN shift-out-of-bounds warning

[Leizhen (ThunderTown)]

On 2022/11/26 5:00, Al Viro wrote:
> On Fri, Nov 25, 2022 at 05:13:56PM +0800, Zhen Lei wrote:
>> v2 --> v3:
>> Updated the commit message of patch 2/2 based on Alexander Viro's suggestion.
> 
> Not exactly what I meant...  I've tentatively applied it, with the

Haha, I felt like something was missing yesterday, too. But as far as my English
level is concerned, I usually copy the words suggested by others directly.

> following commit message:

Thanks.

> 
> --------------------------------
> get rid of INT_LIMIT, use type_max() instead
> 
> INT_LIMIT() tries to do what type_max() does, except that type_max()
> doesn't rely upon undefined behaviour[*], might as well use type_max()
> instead.
> 
> [*] if T is an N-bit signed integer type, the maximal value in T is
> pow(2, N - 1) - 1, all right, but naive expression for that value
> ends up with a couple of wraparounds and as usual for wraparounds
> in signed types, that's an undefined behaviour.  type_max() takes
> care to avoid those...
> 
> Caught-by: UBSAN
> Suggested-by: Eric Biggers <ebiggers@kernel.org>
> Signed-off-by: Zhen Lei <thunder.leizhen@huawei.com>
> Reviewed-by: Eric Biggers <ebiggers@google.com>
> Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
> --------------------------------
> 
> Does anybody have objections against the commit message above?

Looks good to me.

> 
> .
> 

-- 
Regards,
  Zhen Lei