From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751017AbcAUXfd (ORCPT ); Thu, 21 Jan 2016 18:35:33 -0500 Received: from aserp1040.oracle.com ([141.146.126.69]:31249 "EHLO aserp1040.oracle.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750758AbcAUXfa (ORCPT ); Thu, 21 Jan 2016 18:35:30 -0500 Subject: Re: perf/ring-buffer: Undefined behaviour in kernel/events/ring_buffer.c:685:22 To: Peter Zijlstra References: <5692C531.1030302@oracle.com> <20160119143111.GH6344@twins.programming.kicks-ass.net> Cc: Ingo Molnar , Arnaldo Carvalho de Melo , LKML From: Sasha Levin Message-ID: <56A16B1D.3050003@oracle.com> Date: Thu, 21 Jan 2016 18:34:53 -0500 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:38.0) Gecko/20100101 Thunderbird/38.4.0 MIME-Version: 1.0 In-Reply-To: <20160119143111.GH6344@twins.programming.kicks-ass.net> Content-Type: text/plain; charset=windows-1252 Content-Transfer-Encoding: 7bit X-Source-IP: userv0021.oracle.com [156.151.31.71] Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 01/19/2016 09:31 AM, Peter Zijlstra wrote: > On Sun, Jan 10, 2016 at 03:55:13PM -0500, Sasha Levin wrote: >> Hi all, >> >> While fuzzing with trinity inside a KVM tools guest, running the latest -next >> kernel, I've hit the following warning: >> >> [ 3494.030114] UBSAN: Undefined behaviour in kernel/events/ring_buffer.c:685:22 >> [ 3494.030647] shift exponent -1 is negative > > That's rb->page_order == -1, which should 'never' happen, curious! > > Funny though that rb::page_order is the exact field _after_ rb::work, ho > humm. > I've tested your theory using: diff --git a/kernel/events/internal.h b/kernel/events/internal.h index 2bbad9c..f627a40 100644 --- a/kernel/events/internal.h +++ b/kernel/events/internal.h @@ -14,6 +14,7 @@ struct ring_buffer { struct irq_work irq_work; #ifdef CONFIG_PERF_USE_VMALLOC struct work_struct work; + unsigned long dummy; int page_order; /* allocation order */ #endif int nr_pages; /* nr of data pages */ diff --git a/kernel/events/ring_buffer.c b/kernel/events/ring_buffer.c index adfdc05..65346f8 100644 --- a/kernel/events/ring_buffer.c +++ b/kernel/events/ring_buffer.c @@ -682,6 +682,8 @@ void rb_free(struct ring_buffer *rb) #else static int data_page_nr(struct ring_buffer *rb) { + if (page_order(rb) < 0 || rb->dummy) + pr_emerg("*** %lx\n", rb->dummy); return rb->nr_pages << page_order(rb); } But the output I'm seeing indicates that dummy isn't corrupted: [ 758.806091] *** 0 [ 758.806821] ================================================================================ [ 758.807961] UBSAN: Undefined behaviour in kernel/events/ring_buffer.c:687:22 [ 758.808833] shift exponent -1 is negative [...] Thanks, Sasha