Re: [RFC] ubsan: signed integer overflow in setitimer()
On Tue, 6 Jun 2017, Xishi Qiu wrote: > On 2017/6/4 23:06, Thomas Gleixner wrote: > > On Thu, 1 Jun 2017, Xishi Qiu wrote: > > > > Cc'ed John Stultz > > > >> Hi, this is the test case, and then I got ubsan error > >> (signed integer overflow) report, so the root cause is from > >> user or kernel? Shall we change something in timeval_valid()? > >> > >> > >> struct itimerval new_value; > >> int ret; > >> > >> new_value.it_interval.tv_sec = 140673496649799L; > >> new_value.it_interval.tv_usec = 6; > >> new_value.it_value.tv_sec = 140673496649807L; > >> new_value.it_value.tv_usec = 5; > >> > >> ret = setitimer(ITIMER_VIRTUAL, _value, NULL); > >> > >> > >> [ 533.326588] > >> > >> [ 533.335346] UBSAN: Undefined behaviour in ./include/linux/time.h:239:27 > >> [ 533.342155] signed integer overflow: > >> [ 533.345837] 140673496649807 * 10 cannot be represented in type > >> 'long int' > >> [ 533.422181] set_cpu_itimer+0x49c/0x540 > >> [ 533.442127] do_setitimer+0xe1/0x540 > > > > We need a similar clamping of the conversion as we have for > > timespec/val_to_ktime(). I'll have a look in the next days unless John > > beats me to it. > > > > Hi Thomas, anything new? Let me spell it out to you again. I wrote on Sunday late night: "I'll have a look in the next days " Do you really think I need a reminder after 24 hours? Thanks, tglx
Re: [RFC] ubsan: signed integer overflow in setitimer()
On Tue, 6 Jun 2017, Xishi Qiu wrote: > On 2017/6/4 23:06, Thomas Gleixner wrote: > > On Thu, 1 Jun 2017, Xishi Qiu wrote: > > > > Cc'ed John Stultz > > > >> Hi, this is the test case, and then I got ubsan error > >> (signed integer overflow) report, so the root cause is from > >> user or kernel? Shall we change something in timeval_valid()? > >> > >> > >> struct itimerval new_value; > >> int ret; > >> > >> new_value.it_interval.tv_sec = 140673496649799L; > >> new_value.it_interval.tv_usec = 6; > >> new_value.it_value.tv_sec = 140673496649807L; > >> new_value.it_value.tv_usec = 5; > >> > >> ret = setitimer(ITIMER_VIRTUAL, _value, NULL); > >> > >> > >> [ 533.326588] > >> > >> [ 533.335346] UBSAN: Undefined behaviour in ./include/linux/time.h:239:27 > >> [ 533.342155] signed integer overflow: > >> [ 533.345837] 140673496649807 * 10 cannot be represented in type > >> 'long int' > >> [ 533.422181] set_cpu_itimer+0x49c/0x540 > >> [ 533.442127] do_setitimer+0xe1/0x540 > > > > We need a similar clamping of the conversion as we have for > > timespec/val_to_ktime(). I'll have a look in the next days unless John > > beats me to it. > > > > Hi Thomas, anything new? Let me spell it out to you again. I wrote on Sunday late night: "I'll have a look in the next days " Do you really think I need a reminder after 24 hours? Thanks, tglx
Re: [RFC] ubsan: signed integer overflow in setitimer()
On 2017/6/4 23:06, Thomas Gleixner wrote: > On Thu, 1 Jun 2017, Xishi Qiu wrote: > > Cc'ed John Stultz > >> Hi, this is the test case, and then I got ubsan error >> (signed integer overflow) report, so the root cause is from >> user or kernel? Shall we change something in timeval_valid()? >> >> >> struct itimerval new_value; >> int ret; >> >> new_value.it_interval.tv_sec = 140673496649799L; >> new_value.it_interval.tv_usec = 6; >> new_value.it_value.tv_sec = 140673496649807L; >> new_value.it_value.tv_usec = 5; >> >> ret = setitimer(ITIMER_VIRTUAL, _value, NULL); >> >> >> [ 533.326588] >> >> [ 533.335346] UBSAN: Undefined behaviour in ./include/linux/time.h:239:27 >> [ 533.342155] signed integer overflow: >> [ 533.345837] 140673496649807 * 10 cannot be represented in type >> 'long int' >> [ 533.422181] set_cpu_itimer+0x49c/0x540 >> [ 533.442127] do_setitimer+0xe1/0x540 > > We need a similar clamping of the conversion as we have for > timespec/val_to_ktime(). I'll have a look in the next days unless John > beats me to it. > Hi Thomas, anything new? Thanks, Xishi Qiu > Thanks, > > tglx > > . >
Re: [RFC] ubsan: signed integer overflow in setitimer()
On 2017/6/4 23:06, Thomas Gleixner wrote: > On Thu, 1 Jun 2017, Xishi Qiu wrote: > > Cc'ed John Stultz > >> Hi, this is the test case, and then I got ubsan error >> (signed integer overflow) report, so the root cause is from >> user or kernel? Shall we change something in timeval_valid()? >> >> >> struct itimerval new_value; >> int ret; >> >> new_value.it_interval.tv_sec = 140673496649799L; >> new_value.it_interval.tv_usec = 6; >> new_value.it_value.tv_sec = 140673496649807L; >> new_value.it_value.tv_usec = 5; >> >> ret = setitimer(ITIMER_VIRTUAL, _value, NULL); >> >> >> [ 533.326588] >> >> [ 533.335346] UBSAN: Undefined behaviour in ./include/linux/time.h:239:27 >> [ 533.342155] signed integer overflow: >> [ 533.345837] 140673496649807 * 10 cannot be represented in type >> 'long int' >> [ 533.422181] set_cpu_itimer+0x49c/0x540 >> [ 533.442127] do_setitimer+0xe1/0x540 > > We need a similar clamping of the conversion as we have for > timespec/val_to_ktime(). I'll have a look in the next days unless John > beats me to it. > Hi Thomas, anything new? Thanks, Xishi Qiu > Thanks, > > tglx > > . >
Re: [RFC] ubsan: signed integer overflow in setitimer()
On Thu, 1 Jun 2017, Xishi Qiu wrote: Cc'ed John Stultz > Hi, this is the test case, and then I got ubsan error > (signed integer overflow) report, so the root cause is from > user or kernel? Shall we change something in timeval_valid()? > > > struct itimerval new_value; > int ret; > > new_value.it_interval.tv_sec = 140673496649799L; > new_value.it_interval.tv_usec = 6; > new_value.it_value.tv_sec = 140673496649807L; > new_value.it_value.tv_usec = 5; > > ret = setitimer(ITIMER_VIRTUAL, _value, NULL); > > > [ 533.326588] > > [ 533.335346] UBSAN: Undefined behaviour in ./include/linux/time.h:239:27 > [ 533.342155] signed integer overflow: > [ 533.345837] 140673496649807 * 10 cannot be represented in type > 'long int' > [ 533.422181] set_cpu_itimer+0x49c/0x540 > [ 533.442127] do_setitimer+0xe1/0x540 We need a similar clamping of the conversion as we have for timespec/val_to_ktime(). I'll have a look in the next days unless John beats me to it. Thanks, tglx
Re: [RFC] ubsan: signed integer overflow in setitimer()
On Thu, 1 Jun 2017, Xishi Qiu wrote: Cc'ed John Stultz > Hi, this is the test case, and then I got ubsan error > (signed integer overflow) report, so the root cause is from > user or kernel? Shall we change something in timeval_valid()? > > > struct itimerval new_value; > int ret; > > new_value.it_interval.tv_sec = 140673496649799L; > new_value.it_interval.tv_usec = 6; > new_value.it_value.tv_sec = 140673496649807L; > new_value.it_value.tv_usec = 5; > > ret = setitimer(ITIMER_VIRTUAL, _value, NULL); > > > [ 533.326588] > > [ 533.335346] UBSAN: Undefined behaviour in ./include/linux/time.h:239:27 > [ 533.342155] signed integer overflow: > [ 533.345837] 140673496649807 * 10 cannot be represented in type > 'long int' > [ 533.422181] set_cpu_itimer+0x49c/0x540 > [ 533.442127] do_setitimer+0xe1/0x540 We need a similar clamping of the conversion as we have for timespec/val_to_ktime(). I'll have a look in the next days unless John beats me to it. Thanks, tglx
[RFC] ubsan: signed integer overflow in setitimer()
Hi, this is the test case, and then I got ubsan error (signed integer overflow) report, so the root cause is from user or kernel? Shall we change something in timeval_valid()? struct itimerval new_value; int ret; new_value.it_interval.tv_sec = 140673496649799L; new_value.it_interval.tv_usec = 6; new_value.it_value.tv_sec = 140673496649807L; new_value.it_value.tv_usec = 5; ret = setitimer(ITIMER_VIRTUAL, _value, NULL); [ 533.326588] [ 533.335346] UBSAN: Undefined behaviour in ./include/linux/time.h:239:27 [ 533.342155] signed integer overflow: [ 533.345837] 140673496649807 * 10 cannot be represented in type 'long int' [ 533.353540] CPU: 102 PID: 17797 Comm: test.exe Tainted: GB 4.12.0-rc3-327.44.58.18.x86_64+ #30 [ 533.363646] Hardware name: Huawei Technologies Co., Ltd. RH8100 V3/BC61PBIA, BIOS BLHSV028 11/11/2014 [ 533.373130] Call Trace: [ 533.375670] dump_stack+0xbc/0x124 [ 533.379179] ? _atomic_dec_and_lock+0x14c/0x14c [ 533.383850] ubsan_epilogue+0xd/0x4e [ 533.387531] handle_overflow+0x186/0x1d5 [ 533.391571] ? __ubsan_handle_negate_overflow+0x15b/0x15b [ 533.397133] ? unlock_page+0x20/0x60 [ 533.400815] ? filemap_map_pages+0x3e8/0x820 [ 533.405211] ? read_cache_page_gfp+0x80/0x80 [ 533.409613] ? tty_ldisc_deref+0x28/0x40 [ 533.413653] ? tty_write+0x344/0x560 [ 533.417335] __ubsan_handle_mul_overflow+0xe/0x19 [ 533.422181] set_cpu_itimer+0x49c/0x540 [ 533.426132] ? get_cpu_itimer+0x290/0x290 [ 533.430271] ? __getnstimeofday64+0x14c/0x210 [ 533.434762] ? __pmd_alloc+0x1b0/0x1b0 [ 533.438623] ? ktime_get+0xd0/0xd0 [ 533.442127] do_setitimer+0xe1/0x540 [ 533.445817] ? __audit_syscall_entry+0x1cd/0x250 [ 533.450571] SyS_setitimer+0x1d6/0x210 [ 533.454431] ? SyS_alarm+0x150/0x150 [ 533.463453] ? trace_event_raw_event_sys_enter+0x590/0x590 [ 533.474508] ? handle_mm_fault+0x15a/0x530 [ 533.484144] ? __do_page_fault+0x3c9/0x740 [ 533.493712] ? SyS_alarm+0x150/0x150 [ 533.502553] do_syscall_64+0xf5/0x2a0 [ 533.511294] ? do_syscall_64+0xf5/0x2a0 [ 533.520031] entry_SYSCALL64_slow_path+0x25/0x25 [ 533.529410] RIP: 0033:0x7f32bbd71c67 [ 533.537565] RSP: 002b:7ffe9b18df08 EFLAGS: 0202 ORIG_RAX: 0026 [ 533.549766] RAX: ffda RBX: RCX: 7f32bbd71c67 [ 533.561530] RDX: RSI: 7ffe9b18df30 RDI: 0001 [ 533.573237] RBP: 7ffe9b18df60 R08: 7f32bbd09d38 R09: 0012 [ 533.584794] R10: 7ffe9b18dc90 R11: 0202 R12: 00400490 [ 533.596218] R13: 7ffe9b18e040 R14: R15: [ 533.607450] [ 533.620059] [ 533.632565] UBSAN: Undefined behaviour in ./include/linux/time.h:239:27 [ 533.643357] signed integer overflow: [ 533.651093] 140673496649799 * 10 cannot be represented in type 'long int' [ 533.662927] CPU: 102 PID: 17797 Comm: test.exe Tainted: GB 4.12.0-rc3-327.44.58.18.x86_64+ #30 [ 533.681691] Hardware name: Huawei Technologies Co., Ltd. RH8100 V3/BC61PBIA, BIOS BLHSV028 11/11/2014 [ 533.700314] Call Trace: [ 533.707469] dump_stack+0xbc/0x124 [ 533.715588] ? _atomic_dec_and_lock+0x14c/0x14c [ 533.724911] ubsan_epilogue+0xd/0x4e [ 533.733281] handle_overflow+0x186/0x1d5 [ 533.741952] ? __ubsan_handle_negate_overflow+0x15b/0x15b [ 533.752190] ? unlock_page+0x20/0x60 [ 533.760592] ? filemap_map_pages+0x3e8/0x820 [ 533.769709] ? read_cache_page_gfp+0x80/0x80 [ 533.778844] ? tty_ldisc_deref+0x28/0x40 [ 533.787641] ? tty_write+0x344/0x560 [ 533.796126] __ubsan_handle_mul_overflow+0xe/0x19 [ 533.805696] set_cpu_itimer+0x438/0x540 [ 533.814412] ? get_cpu_itimer+0x290/0x290 [ 533.823259] ? __getnstimeofday64+0x14c/0x210 [ 533.832504] ? __pmd_alloc+0x1b0/0x1b0 [ 533.841082] ? ktime_get+0xd0/0xd0 [ 533.849294] do_setitimer+0xe1/0x540 [ 533.857675] ? __audit_syscall_entry+0x1cd/0x250 [ 533.867146] SyS_setitimer+0x1d6/0x210 [ 533.875731] ? SyS_alarm+0x150/0x150 [ 533.884099] ? trace_event_raw_event_sys_enter+0x590/0x590 [ 533.894388] ? handle_mm_fault+0x15a/0x530 [ 533.903209] ? __do_page_fault+0x3c9/0x740 [ 533.911953] ? SyS_alarm+0x150/0x150 [ 533.920154] do_syscall_64+0xf5/0x2a0 [ 533.928504] ? do_syscall_64+0xf5/0x2a0 [ 533.936997] entry_SYSCALL64_slow_path+0x25/0x25 [ 533.946160] RIP: 0033:0x7f32bbd71c67 [ 533.954353] RSP: 002b:7ffe9b18df08 EFLAGS: 0202 ORIG_RAX: 0026 [ 533.966657] RAX: ffda RBX: RCX: 7f32bbd71c67 [ 533.978452] RDX: RSI: 7ffe9b18df30 RDI: 0001 [ 533.990192] RBP: 7ffe9b18df60 R08: 7f32bbd09d38 R09: 0012 [ 534.001811] R10:
[RFC] ubsan: signed integer overflow in setitimer()
Hi, this is the test case, and then I got ubsan error (signed integer overflow) report, so the root cause is from user or kernel? Shall we change something in timeval_valid()? struct itimerval new_value; int ret; new_value.it_interval.tv_sec = 140673496649799L; new_value.it_interval.tv_usec = 6; new_value.it_value.tv_sec = 140673496649807L; new_value.it_value.tv_usec = 5; ret = setitimer(ITIMER_VIRTUAL, _value, NULL); [ 533.326588] [ 533.335346] UBSAN: Undefined behaviour in ./include/linux/time.h:239:27 [ 533.342155] signed integer overflow: [ 533.345837] 140673496649807 * 10 cannot be represented in type 'long int' [ 533.353540] CPU: 102 PID: 17797 Comm: test.exe Tainted: GB 4.12.0-rc3-327.44.58.18.x86_64+ #30 [ 533.363646] Hardware name: Huawei Technologies Co., Ltd. RH8100 V3/BC61PBIA, BIOS BLHSV028 11/11/2014 [ 533.373130] Call Trace: [ 533.375670] dump_stack+0xbc/0x124 [ 533.379179] ? _atomic_dec_and_lock+0x14c/0x14c [ 533.383850] ubsan_epilogue+0xd/0x4e [ 533.387531] handle_overflow+0x186/0x1d5 [ 533.391571] ? __ubsan_handle_negate_overflow+0x15b/0x15b [ 533.397133] ? unlock_page+0x20/0x60 [ 533.400815] ? filemap_map_pages+0x3e8/0x820 [ 533.405211] ? read_cache_page_gfp+0x80/0x80 [ 533.409613] ? tty_ldisc_deref+0x28/0x40 [ 533.413653] ? tty_write+0x344/0x560 [ 533.417335] __ubsan_handle_mul_overflow+0xe/0x19 [ 533.422181] set_cpu_itimer+0x49c/0x540 [ 533.426132] ? get_cpu_itimer+0x290/0x290 [ 533.430271] ? __getnstimeofday64+0x14c/0x210 [ 533.434762] ? __pmd_alloc+0x1b0/0x1b0 [ 533.438623] ? ktime_get+0xd0/0xd0 [ 533.442127] do_setitimer+0xe1/0x540 [ 533.445817] ? __audit_syscall_entry+0x1cd/0x250 [ 533.450571] SyS_setitimer+0x1d6/0x210 [ 533.454431] ? SyS_alarm+0x150/0x150 [ 533.463453] ? trace_event_raw_event_sys_enter+0x590/0x590 [ 533.474508] ? handle_mm_fault+0x15a/0x530 [ 533.484144] ? __do_page_fault+0x3c9/0x740 [ 533.493712] ? SyS_alarm+0x150/0x150 [ 533.502553] do_syscall_64+0xf5/0x2a0 [ 533.511294] ? do_syscall_64+0xf5/0x2a0 [ 533.520031] entry_SYSCALL64_slow_path+0x25/0x25 [ 533.529410] RIP: 0033:0x7f32bbd71c67 [ 533.537565] RSP: 002b:7ffe9b18df08 EFLAGS: 0202 ORIG_RAX: 0026 [ 533.549766] RAX: ffda RBX: RCX: 7f32bbd71c67 [ 533.561530] RDX: RSI: 7ffe9b18df30 RDI: 0001 [ 533.573237] RBP: 7ffe9b18df60 R08: 7f32bbd09d38 R09: 0012 [ 533.584794] R10: 7ffe9b18dc90 R11: 0202 R12: 00400490 [ 533.596218] R13: 7ffe9b18e040 R14: R15: [ 533.607450] [ 533.620059] [ 533.632565] UBSAN: Undefined behaviour in ./include/linux/time.h:239:27 [ 533.643357] signed integer overflow: [ 533.651093] 140673496649799 * 10 cannot be represented in type 'long int' [ 533.662927] CPU: 102 PID: 17797 Comm: test.exe Tainted: GB 4.12.0-rc3-327.44.58.18.x86_64+ #30 [ 533.681691] Hardware name: Huawei Technologies Co., Ltd. RH8100 V3/BC61PBIA, BIOS BLHSV028 11/11/2014 [ 533.700314] Call Trace: [ 533.707469] dump_stack+0xbc/0x124 [ 533.715588] ? _atomic_dec_and_lock+0x14c/0x14c [ 533.724911] ubsan_epilogue+0xd/0x4e [ 533.733281] handle_overflow+0x186/0x1d5 [ 533.741952] ? __ubsan_handle_negate_overflow+0x15b/0x15b [ 533.752190] ? unlock_page+0x20/0x60 [ 533.760592] ? filemap_map_pages+0x3e8/0x820 [ 533.769709] ? read_cache_page_gfp+0x80/0x80 [ 533.778844] ? tty_ldisc_deref+0x28/0x40 [ 533.787641] ? tty_write+0x344/0x560 [ 533.796126] __ubsan_handle_mul_overflow+0xe/0x19 [ 533.805696] set_cpu_itimer+0x438/0x540 [ 533.814412] ? get_cpu_itimer+0x290/0x290 [ 533.823259] ? __getnstimeofday64+0x14c/0x210 [ 533.832504] ? __pmd_alloc+0x1b0/0x1b0 [ 533.841082] ? ktime_get+0xd0/0xd0 [ 533.849294] do_setitimer+0xe1/0x540 [ 533.857675] ? __audit_syscall_entry+0x1cd/0x250 [ 533.867146] SyS_setitimer+0x1d6/0x210 [ 533.875731] ? SyS_alarm+0x150/0x150 [ 533.884099] ? trace_event_raw_event_sys_enter+0x590/0x590 [ 533.894388] ? handle_mm_fault+0x15a/0x530 [ 533.903209] ? __do_page_fault+0x3c9/0x740 [ 533.911953] ? SyS_alarm+0x150/0x150 [ 533.920154] do_syscall_64+0xf5/0x2a0 [ 533.928504] ? do_syscall_64+0xf5/0x2a0 [ 533.936997] entry_SYSCALL64_slow_path+0x25/0x25 [ 533.946160] RIP: 0033:0x7f32bbd71c67 [ 533.954353] RSP: 002b:7ffe9b18df08 EFLAGS: 0202 ORIG_RAX: 0026 [ 533.966657] RAX: ffda RBX: RCX: 7f32bbd71c67 [ 533.978452] RDX: RSI: 7ffe9b18df30 RDI: 0001 [ 533.990192] RBP: 7ffe9b18df60 R08: 7f32bbd09d38 R09: 0012 [ 534.001811] R10:
