| Message ID | 20190308224650.68955-1-cai@lca.pw (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | mm/compaction: fix an undefined behaviour | expand |
On Fri, Mar 08, 2019 at 05:46:50PM -0500, Qian Cai wrote: > In a low-memory situation, cc->fast_search_fail can keep increasing as > it is unable to find an available page to isolate in > fast_isolate_freepages(). As the result, it could trigger an error > below, so just compare with the maximum bits can be shifted first. > > UBSAN: Undefined behaviour in mm/compaction.c:1160:30 > shift exponent 64 is too large for 64-bit type 'unsigned long' > CPU: 131 PID: 1308 Comm: kcompactd1 Kdump: loaded Tainted: G > W L 5.0.0+ #17 > Call trace: > dump_backtrace+0x0/0x450 > show_stack+0x20/0x2c > dump_stack+0xc8/0x14c > __ubsan_handle_shift_out_of_bounds+0x7e8/0x8c4 > compaction_alloc+0x2344/0x2484 > unmap_and_move+0xdc/0x1dbc > migrate_pages+0x274/0x1310 > compact_zone+0x26ec/0x43bc > kcompactd+0x15b8/0x1a24 > kthread+0x374/0x390 > ret_from_fork+0x10/0x18 > > Fixes: 70b44595eafe ("mm, compaction: use free lists to quickly locate a migration source") > Signed-off-by: Qian Cai <cai@lca.pw> Acked-by: Mel Gorman <mgorman@techsingularity.net> FWIW, I had seen the same message when trying to isolate potential corruption (still unsuccessful, the tests always complete) but considered it relatively benign and harmless. Still worth fixing so thanks.
diff --git a/mm/compaction.c b/mm/compaction.c index f171a83707ce..6aebf1eb8d98 100644 --- a/mm/compaction.c +++ b/mm/compaction.c @@ -1157,7 +1157,9 @@ static bool suitable_migration_target(struct compact_control *cc, static inline unsigned int freelist_scan_limit(struct compact_control *cc) { - return (COMPACT_CLUSTER_MAX >> cc->fast_search_fail) + 1; + return (COMPACT_CLUSTER_MAX >> + min((unsigned short)(BITS_PER_LONG - 1), cc->fast_search_fail)) + + 1; } /*
In a low-memory situation, cc->fast_search_fail can keep increasing as it is unable to find an available page to isolate in fast_isolate_freepages(). As the result, it could trigger an error below, so just compare with the maximum bits can be shifted first. UBSAN: Undefined behaviour in mm/compaction.c:1160:30 shift exponent 64 is too large for 64-bit type 'unsigned long' CPU: 131 PID: 1308 Comm: kcompactd1 Kdump: loaded Tainted: G W L 5.0.0+ #17 Call trace: dump_backtrace+0x0/0x450 show_stack+0x20/0x2c dump_stack+0xc8/0x14c __ubsan_handle_shift_out_of_bounds+0x7e8/0x8c4 compaction_alloc+0x2344/0x2484 unmap_and_move+0xdc/0x1dbc migrate_pages+0x274/0x1310 compact_zone+0x26ec/0x43bc kcompactd+0x15b8/0x1a24 kthread+0x374/0x390 ret_from_fork+0x10/0x18 Fixes: 70b44595eafe ("mm, compaction: use free lists to quickly locate a migration source") Signed-off-by: Qian Cai <cai@lca.pw> --- mm/compaction.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)