From mboxrd@z Thu Jan 1 00:00:00 1970 From: Leon Romanovsky Subject: Re: [PATCH rdma-next 09/12] RDMA/mlx5: Fix shift overflow in mlx5_ib_create_wq Date: Mon, 25 Jun 2018 11:10:41 +0300 Message-ID: <20180625081041.GI17747@mtr-leonro.mtl.com> References: <20180624082353.16138-1-leon@kernel.org> <20180624082353.16138-10-leon@kernel.org> <20180624195624.GL19151@ziepe.ca> Mime-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="dfmC41YZQlborXoK" Cc: Doug Ledford , RDMA mailing list , Hadar Hen Zion , Matan Barak , Michael J Ruhl , Noa Osherovich , Raed Salem , Yishai Hadas , Saeed Mahameed , linux-netdev To: Jason Gunthorpe Return-path: Received: from mail.kernel.org ([198.145.29.99]:49418 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752519AbeFYIKp (ORCPT ); Mon, 25 Jun 2018 04:10:45 -0400 Content-Disposition: inline In-Reply-To: <20180624195624.GL19151@ziepe.ca> Sender: netdev-owner@vger.kernel.org List-ID: --dfmC41YZQlborXoK Content-Type: text/plain; charset=us-ascii Content-Disposition: inline On Sun, Jun 24, 2018 at 01:56:24PM -0600, Jason Gunthorpe wrote: > On Sun, Jun 24, 2018 at 11:23:50AM +0300, Leon Romanovsky wrote: > > From: Leon Romanovsky > > > > [ 61.182439] UBSAN: Undefined behaviour in drivers/infiniband/hw/mlx5/qp.c:5366:34 > > [ 61.183673] shift exponent 4294967288 is too large for 32-bit type 'unsigned int' > > [ 61.185530] CPU: 0 PID: 639 Comm: qp Not tainted 4.18.0-rc1-00037-g4aa1d69a9c60-dirty #96 > > [ 61.186981] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-2.fc27 04/01/2014 > > [ 61.188315] Call Trace: > > [ 61.188661] dump_stack+0xc7/0x13b > > [ 61.190427] ubsan_epilogue+0x9/0x49 > > [ 61.190899] __ubsan_handle_shift_out_of_bounds+0x1ea/0x22f > > [ 61.197040] mlx5_ib_create_wq+0x1c99/0x1d50 > > [ 61.206632] ib_uverbs_ex_create_wq+0x499/0x820 > > [ 61.213892] ib_uverbs_write+0x77e/0xae0 > > [ 61.248018] vfs_write+0x121/0x3b0 > > [ 61.249831] ksys_write+0xa1/0x120 > > [ 61.254024] do_syscall_64+0x7c/0x2a0 > > [ 61.256178] entry_SYSCALL_64_after_hwframe+0x44/0xa9 > > [ 61.259211] RIP: 0033:0x7f54bab70e99 > > [ 61.262125] Code: 00 f3 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 > > [ 61.268678] RSP: 002b:00007ffe1541c318 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 > > [ 61.271076] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f54bab70e99 > > [ 61.273795] RDX: 0000000000000070 RSI: 0000000020000240 RDI: 0000000000000003 > > [ 61.276982] RBP: 00007ffe1541c330 R08: 00000000200078e0 R09: 0000000000000002 > > [ 61.280035] R10: 0000000000000000 R11: 0000000000000246 R12: 00000000004005c0 > > [ 61.283279] R13: 00007ffe1541c420 R14: 0000000000000000 R15: 0000000000000000 > > > > Cc: # 4.7 > > Fixes: 79b20a6c3014 ("IB/mlx5: Add receive Work Queue verbs") > > Cc: syzkaller > > Reported-by: Noa Osherovich > > Signed-off-by: Leon Romanovsky > > drivers/infiniband/hw/mlx5/qp.c | 6 +++++- > > 1 file changed, 5 insertions(+), 1 deletion(-) > > > > diff --git a/drivers/infiniband/hw/mlx5/qp.c b/drivers/infiniband/hw/mlx5/qp.c > > index 6034a670859f..8e40263fd40e 100644 > > +++ b/drivers/infiniband/hw/mlx5/qp.c > > @@ -5377,7 +5377,11 @@ static int set_user_rq_size(struct mlx5_ib_dev *dev, > > > > rwq->wqe_count = ucmd->rq_wqe_count; > > rwq->wqe_shift = ucmd->rq_wqe_shift; > > - rwq->buf_size = (rwq->wqe_count << rwq->wqe_shift); > > + rwq->buf_size = > > + shift_overflow((size_t)rwq->wqe_count, (size_t)rwq->wqe_shift); > > The casts are redundant, the function argument is already size_t so > implicit promotion is guaranteed. rwq->wqe_count and rwq->wqe_shift are declared as u32 and not as size_t. https://elixir.bootlin.com/linux/latest/source/drivers/infiniband/hw/mlx5/mlx5_ib.h#L296 Thanks > > Jason --dfmC41YZQlborXoK Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQIcBAEBAgAGBQJbMKOBAAoJEORje4g2clin700P/jmZEKYIVoSKKq4+Xh556TCZ QA7EOhthIFwornfqGivjuXpfWhp3J/4loWwI8bmO5nP5TgivR0DWsXzQ+FrhRr+b DhZC1PmoU6CD5S/fkqStFq99avYxwUnHme9Hp/akXvL1GAkh3Me/eLypGaeuUFXq YHRXFu58rTMadm6Xbw0YDSGucusxKqROzZg5QcSAfX1G2c9hwuwIY46y4LrJmBpB 06lx49s3gpaSBxakc1EQrcVuNU3V92QctYbpQ3whJ0BA5gQgK5y5RhO2xe1H38Qd dD1fV0Lfr5+lmH8xtnANJpQ0+Y3UYGeIlNSHijqbTG5twlILhEaBCFmCeOa2pwwj QyzU3k0iRE+V9R39jibTd5SZdh+dDvKLeCbeq7Hzf+UeqUcDZQ86d/Gbm2ffM4vh bMVhUWtBRJkysfqFCttG+jy316a7WGORCsKjzColk1Dtdav3reSEUNz5xBYpicdo Qs4AbTx2+i/b3pM+Bj2bY2x0vUhacnotJ6BzBUdO+qmRJzE7SJ/tHI8H8eqMbtWW EoO4oeoA73/mA9bh8rhtynim9S1chgfLxSraXL3tUSMr5DSICPdwnTDP2wdkVIaB a52y3RwcSxjUszo1RIDQy6wHXHXUolIaczrgD31uRtn2EK9/zMHhNVTa9G/lTXR8 34eySfaKtSHGdkrOxWPB =0+FM -----END PGP SIGNATURE----- --dfmC41YZQlborXoK--