From: Andrey Ryabinin <aryabinin@virtuozzo.com>
To: Andrew Morton <akpm@linux-foundation.org>, icytxw@gmail.com
Cc: bugzilla-daemon@bugzilla.kernel.org, linux-mm@kvack.org,
Alexander Potapenko <glider@google.com>,
Dmitry Vyukov <dvyukov@google.com>
Subject: Re:
Date: Fri, 29 Jun 2018 21:44:44 +0300 [thread overview]
Message-ID: <61b427f0-978c-fdbf-8b16-226705131220@virtuozzo.com> (raw)
In-Reply-To: <20180627204808.99988d94180dd144b14aa38b@linux-foundation.org>
On 06/28/2018 06:48 AM, Andrew Morton wrote:
>> Hi,
>> This bug was found in Linux Kernel v4.18-rc2
>>
>> $ cat report0
>> ================================================================================
>> UBSAN: Undefined behaviour in mm/fadvise.c:76:10
>> signed integer overflow:
>> 4 + 9223372036854775805 cannot be represented in type 'long long int'
>> CPU: 0 PID: 13477 Comm: syz-executor1 Not tainted 4.18.0-rc1 #2
>> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
>> rel-1.10.2-0-g5f4c7b1-prebuilt.qemu-project.org 04/01/2014
>> Call Trace:
>> __dump_stack lib/dump_stack.c:77 [inline]
>> dump_stack+0x122/0x1c8 lib/dump_stack.c:113
>> ubsan_epilogue+0x12/0x86 lib/ubsan.c:159
>> handle_overflow+0x1c2/0x21f lib/ubsan.c:190
>> __ubsan_handle_add_overflow+0x2a/0x31 lib/ubsan.c:198
>> ksys_fadvise64_64+0xbf0/0xd10 mm/fadvise.c:76
>> __do_sys_fadvise64 mm/fadvise.c:198 [inline]
>> __se_sys_fadvise64 mm/fadvise.c:196 [inline]
>> __x64_sys_fadvise64+0xa9/0x120 mm/fadvise.c:196
>> do_syscall_64+0xb8/0x3a0 arch/x86/entry/common.c:290
>
> That overflow is deliberate:
>
> endbyte = offset + len;
> if (!len || endbyte < len)
> endbyte = -1;
> else
> endbyte--; /* inclusive */
>
> Or is there a hole in this logic?
>
> If not, I guess ee can do this another way to keep the checker happy.
It should be enough to make overflow unsigned. Unsigned overflow is defined by the C standard.
next prev parent reply other threads:[~2018-06-29 18:43 UTC|newest]
Thread overview: 26+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <bug-200209-27@https.bugzilla.kernel.org/>
2018-06-28 3:48 ` Andrew Morton
2018-06-29 18:44 ` Andrey Ryabinin [this message]
2018-06-29 18:44 ` [PATCH] mm/fadvise: Fix signed overflow UBSAN complaint Andrey Ryabinin
2018-06-30 1:37 ` Andrew Morton
2024-02-27 17:42 [PATCH v3 00/18] Rearrange batched folio freeing Matthew Wilcox (Oracle)
2024-02-27 17:42 ` [PATCH v3 10/18] mm: Allow non-hugetlb large folios to be batch processed Matthew Wilcox (Oracle)
2024-03-06 13:42 ` Ryan Roberts
2024-03-06 16:09 ` Matthew Wilcox
2024-03-06 16:19 ` Ryan Roberts
2024-03-06 17:41 ` Ryan Roberts
2024-03-06 18:41 ` Zi Yan
2024-03-06 19:55 ` Matthew Wilcox
2024-03-06 21:55 ` Matthew Wilcox
2024-03-07 8:56 ` Ryan Roberts
2024-03-07 13:50 ` Yin, Fengwei
2024-03-07 14:05 ` Re: Matthew Wilcox
2024-03-07 15:24 ` Re: Ryan Roberts
2024-03-07 16:24 ` Re: Ryan Roberts
2024-03-07 23:02 ` Re: Matthew Wilcox
2024-03-08 1:06 ` Re: Yin, Fengwei
-- strict thread matches above, loose matches on Subject: below --
2024-01-18 22:19 [RFC] [PATCH 0/3] xfs: use large folios for buffers Dave Chinner
2024-01-22 10:13 ` Andi Kleen
2024-01-22 11:53 ` Dave Chinner
2023-05-11 12:58 Ryan Roberts
2023-05-11 13:13 ` Ryan Roberts
2022-08-26 22:03 Zach O'Keefe
2022-08-31 21:47 ` Yang Shi
2022-09-01 0:24 ` Re: Zach O'Keefe
[not found] <20220421164138.1250943-1-yury.norov@gmail.com>
2022-04-21 23:04 ` Re: John Hubbard
2022-04-21 23:09 ` Re: John Hubbard
2022-04-21 23:17 ` Re: Yury Norov
2022-04-21 23:21 ` Re: John Hubbard
2021-08-12 9:21 Valdis Klētnieks
2021-08-12 9:42 ` SeongJae Park
2021-08-12 20:19 ` Re: Andrew Morton
2021-08-13 8:14 ` Re: SeongJae Park
2018-06-24 20:09 [PATCH 3/3] mm: list_lru: Add lock_irq member to __list_lru_init() Vladimir Davydov
2018-07-03 14:52 ` Sebastian Andrzej Siewior
2018-07-03 21:14 ` Andrew Morton
2018-07-03 21:44 ` Re: Sebastian Andrzej Siewior
2018-07-04 14:44 ` Re: Vladimir Davydov
2007-04-03 18:41 Royal VIP Casino
[not found] <F265RQAOCop3wyv9kI3000143b1@hotmail.com>
2001-10-08 11:48 ` Joseph A Knapka
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=61b427f0-978c-fdbf-8b16-226705131220@virtuozzo.com \
--to=aryabinin@virtuozzo.com \
--cc=akpm@linux-foundation.org \
--cc=bugzilla-daemon@bugzilla.kernel.org \
--cc=dvyukov@google.com \
--cc=glider@google.com \
--cc=icytxw@gmail.com \
--cc=linux-mm@kvack.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).