lkml.org 
[lkml]   [2017]   [Sep]   [6]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
Date
SubjectUBSAN: Undefined error in log2.h
Hi,

I am hitting this bug when running the syzkaller fuzzer on kernel 4.13-rc7

Syzkaller hit 'UBSAN: Undefined behaviour in ./include/linux/log2.h:LINE' bug.

Guilty file: fs/pipe.c

Maintainers: []

UBSAN: Undefined behaviour in ./include/linux/log2.h:57:13
shift exponent 64 is too large for 64-bit type 'long unsigned int'
CPU: 3 PID: 2712 Comm: syz-executor0 Not tainted 4.13.0-rc7 #2
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
Ubuntu-1.8.2-1ubuntu1 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:16 [inline]
dump_stack+0xf7/0x1ae lib/dump_stack.c:52
ubsan_epilogue+0x12/0x8f lib/ubsan.c:164
__ubsan_handle_shift_out_of_bounds+0x2b2/0x32c lib/ubsan.c:421
__roundup_pow_of_two include/linux/log2.h:57 [inline]
round_pipe_size fs/pipe.c:1027 [inline]
pipe_set_size fs/pipe.c:1041 [inline]
pipe_fcntl+0x6b6/0x7b0 fs/pipe.c:1158
do_fcntl+0x362/0x1250 fs/fcntl.c:416
SYSC_fcntl fs/fcntl.c:462 [inline]
SyS_fcntl+0xd6/0x110 fs/fcntl.c:447
entry_SYSCALL_64_fastpath+0x18/0xad
RIP: 0033:0x451e59
RSP: 002b:00007ffe1469d358 EFLAGS: 00000212 ORIG_RAX: 0000000000000048
RAX: ffffffffffffffda RBX: 0000000000718000 RCX: 0000000000451e59
RDX: 0000000000000000 RSI: 0000000000000407 RDI: 0000000000000003
RBP: 0000000000000046 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000212 R12: 0000000020011ff8
R13: 0000000000718000 R14: 0000000000000000 R15: 0000000000000000
================================================================================

I have the full reproducer program here: https://pastebin.com/mLZx0ySS

The main code is below:

long r[4];
void loop()
{
syscall(SYS_write, 1, "executing program\n", strlen("executing program\n"));
memset(r, -1, sizeof(r));
r[0] = syscall(__NR_mmap, 0x20000000ul, 0x12000ul, 0x3ul, 0x32ul,
0xfffffffffffffffful, 0x0ul);
r[1] = syscall(__NR_pipe, 0x20011ff8ul);
if (r[1] != -1)
NONFAILING(r[2] = *(uint32_t*)0x20011ff8);
r[3] = syscall(__NR_fcntl, r[2], 0x407ul, 0x0ul);
}

\
 
 \ /
  Last update: 2017-09-06 06:59    [W:0.056 / U:3.104 seconds]
©2003-2017 Jasper Spaans. hosted at Digital OceanAdvertise on this site