From: Qian Cai <cai@lca.pw>
To: Alexei Starovoitov <ast@kernel.org>,
Daniel Borkmann <daniel@iogearbox.net>
Cc: Martin KaFai Lau <kafai@fb.com>, Song Liu <songliubraving@fb.com>,
Yonghong Song <yhs@fb.com>, Andrii Nakryiko <andriin@fb.com>,
John Fastabend <john.fastabend@gmail.com>,
KP Singh <kpsingh@chromium.org>,
Linux Netdev List <netdev@vger.kernel.org>,
bpf@vger.kernel.org,
Linux Kernel Mailing List <linux-kernel@vger.kernel.org>,
clang-built-linux <clang-built-linux@googlegroups.com>
Subject: UBSAN: array-index-out-of-bounds in kernel/bpf/arraymap.c:177
Date: Sun, 17 May 2020 22:44:31 -0400 [thread overview]
Message-ID: <CAG=TAF6mfrwxF1-xEJJ9dL675uMUa7RZrOa_eL2mJizZJ-U7iQ@mail.gmail.com> (raw)
With Clang 9.0.1,
return array->value + array->elem_size * (index & array->index_mask);
but array->value is,
char value[0] __aligned(8);
[ 506.031548][ T4134] LTP: starting bpf_prog02
[ 506.125326][ T4352]
================================================================================
[ 506.134603][ T4352] UBSAN: array-index-out-of-bounds in
kernel/bpf/arraymap.c:177:22
[ 506.142521][ T4352] index 8 is out of range for type 'char [0]'
[ 506.148613][ T4352] CPU: 222 PID: 4352 Comm: bpf_prog02 Tainted: G
L 5.7.0-rc5-next-20200515 #2
[ 506.158632][ T4352] Hardware name: HPE Apollo 70
/C01_APACHE_MB , BIOS L50_5.13_1.11 06/18/2019
[ 506.169084][ T4352] Call trace:
[ 506.172256][ T4352] dump_backtrace+0x0/0x22c
[ 506.176634][ T4352] show_stack+0x28/0x34
[ 506.180666][ T4352] dump_stack+0x104/0x194
[ 506.184877][ T4352] __ubsan_handle_out_of_bounds+0xf0/0x120
[ 506.190565][ T4352] array_map_lookup_elem+0x90/0x94
[ 506.195560][ T4352] bpf_map_lookup_elem+0x48/0x60
[ 506.200383][ T4352] ___bpf_prog_run+0xe9c/0x2840
[ 506.205109][ T4352] __bpf_prog_run32+0x80/0xac
[ 506.209673][ T4352] __bpf_prog_run_save_cb+0x104/0x46c
[ 506.214919][ T4352] sk_filter_trim_cap+0x21c/0x2c4
[ 506.219823][ T4352] unix_dgram_sendmsg+0x45c/0x860
[ 506.224725][ T4352] sock_sendmsg+0x4c/0x74
[ 506.228935][ T4352] sock_write_iter+0x158/0x1a4
[ 506.233584][ T4352] __vfs_write+0x190/0x1d8
[ 506.237874][ T4352] vfs_write+0x13c/0x1b8
[ 506.241992][ T4352] ksys_write+0xb0/0x120
[ 506.246108][ T4352] __arm64_sys_write+0x54/0x88
[ 506.250747][ T4352] do_el0_svc+0x128/0x1dc
[ 506.254957][ T4352] el0_sync_handler+0xd0/0x268
[ 506.259594][ T4352] el0_sync+0x164/0x180
[ 506.263747][ T4352]
next reply other threads:[~2020-05-18 2:44 UTC|newest]
Thread overview: 12+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-05-18 2:44 Qian Cai [this message]
2020-05-18 23:55 ` UBSAN: array-index-out-of-bounds in kernel/bpf/arraymap.c:177 Andrii Nakryiko
2020-05-19 0:09 ` Qian Cai
2020-05-19 0:25 ` Andrii Nakryiko
2020-05-19 1:00 ` Yonghong Song
2020-05-19 1:30 ` Andrii Nakryiko
2020-05-19 1:36 ` Yonghong Song
2020-05-19 15:00 ` Qian Cai
2020-05-19 19:29 ` Andrii Nakryiko
2020-05-19 20:18 ` Qian Cai
2020-05-19 23:23 ` Andrii Nakryiko
2020-05-20 1:55 ` Qian Cai
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to='CAG=TAF6mfrwxF1-xEJJ9dL675uMUa7RZrOa_eL2mJizZJ-U7iQ@mail.gmail.com' \
--to=cai@lca.pw \
--cc=andriin@fb.com \
--cc=ast@kernel.org \
--cc=bpf@vger.kernel.org \
--cc=clang-built-linux@googlegroups.com \
--cc=daniel@iogearbox.net \
--cc=john.fastabend@gmail.com \
--cc=kafai@fb.com \
--cc=kpsingh@chromium.org \
--cc=linux-kernel@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=songliubraving@fb.com \
--cc=yhs@fb.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).