linux/fs/ext4
Nicolai Stange 935244cd54 ext4: silence UBSAN in ext4_mb_init()
Currently, in ext4_mb_init(), there's a loop like the following:

  do {
    ...
    offset += 1 << (sb->s_blocksize_bits - i);
    i++;
  } while (i <= sb->s_blocksize_bits + 1);

Note that the updated offset is used in the loop's next iteration only.

However, at the last iteration, that is at i == sb->s_blocksize_bits + 1,
the shift count becomes equal to (unsigned)-1 > 31 (c.f. C99 6.5.7(3))
and UBSAN reports

  UBSAN: Undefined behaviour in fs/ext4/mballoc.c:2621:15
  shift exponent 4294967295 is too large for 32-bit type 'int'
  [...]
  Call Trace:
   [<ffffffff818c4d25>] dump_stack+0xbc/0x117
   [<ffffffff818c4c69>] ? _atomic_dec_and_lock+0x169/0x169
   [<ffffffff819411ab>] ubsan_epilogue+0xd/0x4e
   [<ffffffff81941cac>] __ubsan_handle_shift_out_of_bounds+0x1fb/0x254
   [<ffffffff81941ab1>] ? __ubsan_handle_load_invalid_value+0x158/0x158
   [<ffffffff814b6dc1>] ? kmem_cache_alloc+0x101/0x390
   [<ffffffff816fc13b>] ? ext4_mb_init+0x13b/0xfd0
   [<ffffffff814293c7>] ? create_cache+0x57/0x1f0
   [<ffffffff8142948a>] ? create_cache+0x11a/0x1f0
   [<ffffffff821c2168>] ? mutex_lock+0x38/0x60
   [<ffffffff821c23ab>] ? mutex_unlock+0x1b/0x50
   [<ffffffff814c26ab>] ? put_online_mems+0x5b/0xc0
   [<ffffffff81429677>] ? kmem_cache_create+0x117/0x2c0
   [<ffffffff816fcc49>] ext4_mb_init+0xc49/0xfd0
   [...]

Observe that the mentioned shift exponent, 4294967295, equals (unsigned)-1.

Unless compilers start to do some fancy transformations (which at least
GCC 6.0.0 doesn't currently do), the issue is of cosmetic nature only: the
such calculated value of offset is never used again.

Silence UBSAN by introducing another variable, offset_incr, holding the
next increment to apply to offset and adjust that one by right shifting it
by one position per loop iteration.

Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=114701
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=112161

Cc: stable@vger.kernel.org
Signed-off-by: Nicolai Stange <nicstange@gmail.com>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
2016-05-05 19:46:19 -04:00
..
acl.c ext4: remove unused header files 2015-04-02 23:47:42 -04:00
acl.h ext2/3/4: use generic posix ACL infrastructure 2014-01-25 23:58:19 -05:00
balloc.c ext4: fix scheduling in atomic on group checksum failure 2016-02-11 23:15:12 -05:00
bitmap.c ext4: remove unused header files 2015-04-02 23:47:42 -04:00
block_validity.c ext4: call out CRC and corruption errors with specific error codes 2015-10-17 16:16:04 -04:00
crypto_fname.c ext4: Use skcipher 2016-01-27 20:35:55 +08:00
crypto_key.c ext4: Use skcipher 2016-01-27 20:35:55 +08:00
crypto_policy.c ext4 crypto: replace some BUG_ON()'s with error checks 2015-10-03 10:49:27 -04:00
crypto.c ext4/fscrypto: avoid RCU lookup in d_revalidate 2016-04-12 20:01:35 -07:00
dir.c ext4: allow readdir()'s of large empty directories to be interrupted 2016-04-23 22:50:07 -04:00
ext4_crypto.h ext4: Use skcipher 2016-01-27 20:35:55 +08:00
ext4_extents.h ext4: fix misspellings in comments. 2016-03-09 23:49:05 -05:00
ext4_jbd2.c ext4: fix potential use after free in __ext4_journal_stop 2015-10-17 22:57:06 -04:00
ext4_jbd2.h ext4: do not ask jbd2 to write data for delalloc buffers 2016-04-24 00:56:08 -04:00
ext4.h ext4: fix races between changing inode journal mode and ext4_writepages 2016-04-25 23:22:35 -04:00
extents_status.c ext4: remove trailing \n from ext4_warning/ext4_error calls 2016-04-27 01:11:21 -04:00
extents_status.h ext4: move procfs registration code to fs/ext4/sysfs.c 2015-09-23 12:46:17 -04:00
extents.c ext4: remove trailing \n from ext4_warning/ext4_error calls 2016-04-27 01:11:21 -04:00
file.c ext4: remove trailing \n from ext4_warning/ext4_error calls 2016-04-27 01:11:21 -04:00
fsync.c Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs 2015-04-26 17:22:07 -07:00
hash.c ext4: remove unused header files 2015-04-02 23:47:42 -04:00
ialloc.c ext4: clean up error handling when orphan list is corrupted 2016-04-30 00:49:54 -04:00
indirect.c ext4: return hole from ext4_map_blocks() 2016-03-09 22:54:00 -05:00
inline.c ext4: remove trailing \n from ext4_warning/ext4_error calls 2016-04-27 01:11:21 -04:00
inode.c ext4: fix races between changing inode journal mode and ext4_writepages 2016-04-25 23:22:35 -04:00
ioctl.c ext4: fix check of dqget() return value in ext4_ioctl_setproject() 2016-05-05 10:52:38 -04:00
Kconfig ext4: Update EXT4_USE_FOR_EXT2 description 2015-09-24 13:27:47 +02:00
Makefile ext4: move sysfs code from super.c to fs/ext4/sysfs.c 2015-09-23 12:44:17 -04:00
mballoc.c ext4: silence UBSAN in ext4_mb_init() 2016-05-05 19:46:19 -04:00
mballoc.h ext4: fix compile error while opening the macro DOUBLE_CHECK 2016-03-13 17:18:12 -04:00
migrate.c ext4: fix misspellings in comments. 2016-03-09 23:49:05 -05:00
mmp.c ext4: remove trailing \n from ext4_warning/ext4_error calls 2016-04-27 01:11:21 -04:00
move_extent.c ext4: do not ask jbd2 to write data for delalloc buffers 2016-04-24 00:56:08 -04:00
namei.c ext4: fix oops on corrupted filesystem 2016-05-05 11:10:15 -04:00
page-io.c These changes contains a fix for overlayfs interacting with some 2016-04-07 17:22:20 -07:00
readpage.c These changes contains a fix for overlayfs interacting with some 2016-04-07 17:22:20 -07:00
resize.c ext4: remove trailing \n from ext4_warning/ext4_error calls 2016-04-27 01:11:21 -04:00
super.c ext4: fix races between changing inode journal mode and ext4_writepages 2016-04-25 23:22:35 -04:00
symlink.c mm, fs: get rid of PAGE_CACHE_* and page_cache_{get,release} macros 2016-04-04 10:41:08 -07:00
sysfs.c ext4: add "static" to ext4_seq_##name##_fops struct 2015-11-26 15:52:24 -05:00
truncate.h ext4: fix races between page faults and hole punching 2015-12-07 14:28:03 -05:00
xattr_security.c xattr handlers: Simplify list operation 2015-12-13 19:46:12 -05:00
xattr_trusted.c xattr handlers: Simplify list operation 2015-12-13 19:46:12 -05:00
xattr_user.c xattr handlers: Simplify list operation 2015-12-13 19:46:12 -05:00
xattr.c ext4: check if in-inode xattr is corrupted in ext4_expand_extra_isize_ea() 2016-03-22 16:13:15 -04:00
xattr.h mbcache2: rename to mbcache 2016-02-22 22:35:22 -05:00