diff mbox series

drm/selftests: fix a shift-out-of-bounds bug

Message ID 20220303201602.2365-1-Arunpravin.PaneerSelvam@amd.com (mailing list archive)
State New, archived
Headers show
Series drm/selftests: fix a shift-out-of-bounds bug | expand

Commit Message

Paneer Selvam, Arunpravin March 3, 2022, 8:16 p.m. UTC 
pass the correct size value computed using the max_order.

<log snip>

[ 68.124177][ T1] UBSAN: shift-out-of-bounds in include/linux/log2.h:67:13
[ 68.125333][ T1] shift exponent 4294967295 is too large for 32-bit type 'long
unsigned int'
[ 68.126563][ T1] CPU: 0 PID: 1 Comm: swapper Not tainted
5.17.0-rc2-00311-g39ec47bbfd5d #2
[ 68.127758][ T1] Call Trace:
[ 68.128187][ T1] dump_stack_lvl (lib/dump_stack.c:108)
[ 68.128793][ T1] dump_stack (lib/dump_stack.c:114)
[ 68.129331][ T1] ubsan_epilogue (lib/ubsan.c:152)
[ 68.129958][ T1] __ubsan_handle_shift_out_of_bounds.cold (arch/x86/include/asm/smap.h:85)

[ 68.130791][ T1] ? drm_block_alloc+0x28/0x80
[ 68.131582][ T1] ? rcu_read_lock_sched_held (kernel/rcu/update.c:125)
[ 68.132215][ T1] ? kmem_cache_alloc (include/trace/events/kmem.h:54 mm/slab.c:3501)
[ 68.132878][ T1] ? mark_free+0x2e/0x80
[ 68.133524][ T1] drm_buddy_init.cold (include/linux/log2.h:67
drivers/gpu/drm/drm_buddy.c:131)
[ 68.134145][ T1] ? test_drm_cmdline_init (drivers/gpu/drm/selftests/test-drm_buddy.c:87)

[ 68.134770][ T1] igt_buddy_alloc_limit (drivers/gpu/drm/selftests/test-drm_buddy.c:30)
[ 68.135472][ T1] ? vprintk_default (kernel/printk/printk.c:2257)
[ 68.136057][ T1] ? test_drm_cmdline_init (drivers/gpu/drm/selftests/test-drm_buddy.c:87)

[ 68.136812][ T1] test_drm_buddy_init (drivers/gpu/drm/selftests/drm_selftest.c:77
drivers/gpu/drm/selftests/test-drm_buddy.c:95)
[ 68.137475][ T1] do_one_initcall (init/main.c:1300)
[ 68.138111][ T1] ? parse_args (kernel/params.c:609 kernel/params.c:146
kernel/params.c:188)
[ 68.138717][ T1] do_basic_setup (init/main.c:1372 init/main.c:1389 init/main.c:1408)
[ 68.139366][ T1] kernel_init_freeable (init/main.c:1617)
[ 68.140040][ T1] ? rest_init (init/main.c:1494)
[ 68.140634][ T1] kernel_init (init/main.c:1504)
[ 68.141155][ T1] ret_from_fork (arch/x86/entry/entry_32.S:772)
[ 68.141607][ T1]
================================================================================
[ 68.146730][ T1] ------------[ cut here ]------------
[ 68.147460][ T1] kernel BUG at drivers/gpu/drm/drm_buddy.c:140!
[ 68.148280][ T1] invalid opcode: 0000 [#1]
[ 68.148895][ T1] CPU: 0 PID: 1 Comm: swapper Not tainted
5.17.0-rc2-00311-g39ec47bbfd5d #2
[ 68.149896][ T1] EIP: drm_buddy_init (drivers/gpu/drm/drm_buddy.c:140 (discriminator 1))

For more details: https://lists.01.org/hyperkitty/list/lkp@lists.01.org/thread/FDIF3HCILZNN5UQAZMOR7E3MQSMHHKWU/

Signed-off-by: Arunpravin <Arunpravin.PaneerSelvam@amd.com>
Reported-by: kernel test robot <oliver.sang@intel.com>
---
 drivers/gpu/drm/selftests/test-drm_buddy.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)


base-commit: 6be340ee8f5beae574dae6f5e17a22e67beeff3e

Comments

Christian König March 4, 2022, 8:33 a.m. UTC | #1 
Am 03.03.22 um 21:16 schrieb Arunpravin:
> pass the correct size value computed using the max_order.
>
> <log snip>
>
> [ 68.124177][ T1] UBSAN: shift-out-of-bounds in include/linux/log2.h:67:13
> [ 68.125333][ T1] shift exponent 4294967295 is too large for 32-bit type 'long
> unsigned int'
> [ 68.126563][ T1] CPU: 0 PID: 1 Comm: swapper Not tainted
> 5.17.0-rc2-00311-g39ec47bbfd5d #2
> [ 68.127758][ T1] Call Trace:
> [ 68.128187][ T1] dump_stack_lvl (lib/dump_stack.c:108)
> [ 68.128793][ T1] dump_stack (lib/dump_stack.c:114)
> [ 68.129331][ T1] ubsan_epilogue (lib/ubsan.c:152)
> [ 68.129958][ T1] __ubsan_handle_shift_out_of_bounds.cold (arch/x86/include/asm/smap.h:85)
>
> [ 68.130791][ T1] ? drm_block_alloc+0x28/0x80
> [ 68.131582][ T1] ? rcu_read_lock_sched_held (kernel/rcu/update.c:125)
> [ 68.132215][ T1] ? kmem_cache_alloc (include/trace/events/kmem.h:54 mm/slab.c:3501)
> [ 68.132878][ T1] ? mark_free+0x2e/0x80
> [ 68.133524][ T1] drm_buddy_init.cold (include/linux/log2.h:67
> drivers/gpu/drm/drm_buddy.c:131)
> [ 68.134145][ T1] ? test_drm_cmdline_init (drivers/gpu/drm/selftests/test-drm_buddy.c:87)
>
> [ 68.134770][ T1] igt_buddy_alloc_limit (drivers/gpu/drm/selftests/test-drm_buddy.c:30)
> [ 68.135472][ T1] ? vprintk_default (kernel/printk/printk.c:2257)
> [ 68.136057][ T1] ? test_drm_cmdline_init (drivers/gpu/drm/selftests/test-drm_buddy.c:87)
>
> [ 68.136812][ T1] test_drm_buddy_init (drivers/gpu/drm/selftests/drm_selftest.c:77
> drivers/gpu/drm/selftests/test-drm_buddy.c:95)
> [ 68.137475][ T1] do_one_initcall (init/main.c:1300)
> [ 68.138111][ T1] ? parse_args (kernel/params.c:609 kernel/params.c:146
> kernel/params.c:188)
> [ 68.138717][ T1] do_basic_setup (init/main.c:1372 init/main.c:1389 init/main.c:1408)
> [ 68.139366][ T1] kernel_init_freeable (init/main.c:1617)
> [ 68.140040][ T1] ? rest_init (init/main.c:1494)
> [ 68.140634][ T1] kernel_init (init/main.c:1504)
> [ 68.141155][ T1] ret_from_fork (arch/x86/entry/entry_32.S:772)
> [ 68.141607][ T1]
> ================================================================================
> [ 68.146730][ T1] ------------[ cut here ]------------
> [ 68.147460][ T1] kernel BUG at drivers/gpu/drm/drm_buddy.c:140!
> [ 68.148280][ T1] invalid opcode: 0000 [#1]
> [ 68.148895][ T1] CPU: 0 PID: 1 Comm: swapper Not tainted
> 5.17.0-rc2-00311-g39ec47bbfd5d #2
> [ 68.149896][ T1] EIP: drm_buddy_init (drivers/gpu/drm/drm_buddy.c:140 (discriminator 1))
>
> For more details: https://lists.01.org/hyperkitty/list/lkp@lists.01.org/thread/FDIF3HCILZNN5UQAZMOR7E3MQSMHHKWU/
>
> Signed-off-by: Arunpravin <Arunpravin.PaneerSelvam@amd.com>
> Reported-by: kernel test robot <oliver.sang@intel.com>

Acked-by: Christian König <christian.koenig@amd.com>

> ---
>   drivers/gpu/drm/selftests/test-drm_buddy.c | 6 +++---
>   1 file changed, 3 insertions(+), 3 deletions(-)
>
> diff --git a/drivers/gpu/drm/selftests/test-drm_buddy.c b/drivers/gpu/drm/selftests/test-drm_buddy.c
> index fa997f89522b..913cbd7eae04 100644
> --- a/drivers/gpu/drm/selftests/test-drm_buddy.c
> +++ b/drivers/gpu/drm/selftests/test-drm_buddy.c
> @@ -902,14 +902,13 @@ static int igt_buddy_alloc_range(void *arg)
>   
>   static int igt_buddy_alloc_limit(void *arg)
>   {
> -	u64 end, size = U64_MAX, start = 0;
> +	u64 size = U64_MAX, start = 0;
>   	struct drm_buddy_block *block;
>   	unsigned long flags = 0;
>   	LIST_HEAD(allocated);
>   	struct drm_buddy mm;
>   	int err;
>   
> -	size = end = round_down(size, 4096);
>   	err = drm_buddy_init(&mm, size, PAGE_SIZE);
>   	if (err)
>   		return err;
> @@ -921,7 +920,8 @@ static int igt_buddy_alloc_limit(void *arg)
>   		goto out_fini;
>   	}
>   
> -	err = drm_buddy_alloc_blocks(&mm, start, end, size,
> +	size = mm.chunk_size << mm.max_order;
> +	err = drm_buddy_alloc_blocks(&mm, start, size, size,
>   				     PAGE_SIZE, &allocated, flags);
>   
>   	if (unlikely(err))
>
> base-commit: 6be340ee8f5beae574dae6f5e17a22e67beeff3e
diff mbox series

Patch

diff --git a/drivers/gpu/drm/selftests/test-drm_buddy.c b/drivers/gpu/drm/selftests/test-drm_buddy.c
index fa997f89522b..913cbd7eae04 100644
--- a/drivers/gpu/drm/selftests/test-drm_buddy.c
+++ b/drivers/gpu/drm/selftests/test-drm_buddy.c
@@ -902,14 +902,13 @@  static int igt_buddy_alloc_range(void *arg)
 
 static int igt_buddy_alloc_limit(void *arg)
 {
-	u64 end, size = U64_MAX, start = 0;
+	u64 size = U64_MAX, start = 0;
 	struct drm_buddy_block *block;
 	unsigned long flags = 0;
 	LIST_HEAD(allocated);
 	struct drm_buddy mm;
 	int err;
 
-	size = end = round_down(size, 4096);
 	err = drm_buddy_init(&mm, size, PAGE_SIZE);
 	if (err)
 		return err;
@@ -921,7 +920,8 @@  static int igt_buddy_alloc_limit(void *arg)
 		goto out_fini;
 	}
 
-	err = drm_buddy_alloc_blocks(&mm, start, end, size,
+	size = mm.chunk_size << mm.max_order;
+	err = drm_buddy_alloc_blocks(&mm, start, size, size,
 				     PAGE_SIZE, &allocated, flags);
 
 	if (unlikely(err))