lkml.org 
[lkml]   [2024]   [Apr]   [11]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    From
    Date
    SubjectRe: [Bug] UBSAN: shift-out-of-bounds in sg_build_indirect
    On Wed, Apr 10, 2024 at 12:59 AM Bart Van Assche <bvanassche@acm.org> wrote:
    >
    > On 4/9/24 05:51, Sam Sun wrote:
    > > We further analyzed the root cause of this bug. In function
    > > sg_build_indirect of drivers/scsi/sg.c, variable order of line 1900 is
    > > calculated out using get_order(num), and num comes from
    > > scatter_elem_sz. If scatter_elem_sz is equal or below zero, the order
    > > returned will be 52, so that PAGE_SHIFT + order is 64, which is larger
    > > than 32 bits int range, causing shift-out-of bound. This bug is tested
    > > and still remains in the latest upstream linux (6.9-rc3).
    > > If you have any questions, please contact us.
    >
    > Thank you for having root-caused this issue and also for having shared
    > your root-cause analysis. Do you perhaps plan to post a patch that fixes
    > this issue?
    >
    > Thanks,
    >
    > Bart.
    >

    Sure, I am glad to help! But it is my first time submitting a patch, I
    need to find some instructions. I would appreciate if you could help
    me out. Also, I need to double check the patch to avoid introducing a
    new one. It might take some time.

    Best,
    Yue

    \
     
     \ /
      Last update: 2024-05-27 16:33    [W:4.735 / U:0.016 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site