From patchwork Fri May 13 15:31:05 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Bartlomiej Zolnierkiewicz X-Patchwork-Id: 9092191 Return-Path: X-Original-To: patchwork-linux-block@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork1.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.136]) by patchwork1.web.kernel.org (Postfix) with ESMTP id 8E3569F441 for ; Fri, 13 May 2016 15:33:41 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id 97C7E201BC for ; Fri, 13 May 2016 15:33:40 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 7D601201CE for ; Fri, 13 May 2016 15:33:39 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753428AbcEMPdi (ORCPT ); Fri, 13 May 2016 11:33:38 -0400 Received: from mailout2.samsung.com ([203.254.224.25]:58420 "EHLO mailout2.samsung.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753076AbcEMPdg (ORCPT ); Fri, 13 May 2016 11:33:36 -0400 Received: from epcpsbgm1new.samsung.com (epcpsbgm1 [203.254.230.26]) by mailout2.samsung.com (Oracle Communications Messaging Server 7.0.5.31.0 64bit (built May 5 2014)) with ESMTP id <0O7400L0BG58KKA0@mailout2.samsung.com>; Sat, 14 May 2016 00:33:26 +0900 (KST) X-AuditID: cbfee61a-f79656d000001a01-1b-5735f3c60b18 Received: from epmmp1.local.host ( [203.254.227.16]) by epcpsbgm1new.samsung.com (EPCPMTA) with SMTP id 68.D7.06657.6C3F5375; Sat, 14 May 2016 00:33:26 +0900 (KST) Received: from amdc1976.localnet ([106.120.53.102]) by mmp1.samsung.com (Oracle Communications Messaging Server 7.0.5.31.0 64bit (built May 5 2014)) with ESMTPA id <0O7400BA7GJPTN10@mmp1.samsung.com>; Sat, 14 May 2016 00:33:26 +0900 (KST) From: Bartlomiej Zolnierkiewicz To: Meelis Roos Cc: Linux Kernel list , linux-ide@vger.kernel.org, linux-block@vger.kernel.org, Tejun Heo , Jens Axboe Subject: Re: UBSAN: Undefined behaviour in block/blk-mq.c:1459:27 with pata_amd Date: Fri, 13 May 2016 17:31:05 +0200 Message-id: <22191628.vH7YQZ1hRO@amdc1976> User-Agent: KMail/4.13.3 (Linux/3.13.0-74-generic; KDE/4.13.3; x86_64; ; ) In-reply-to: References: MIME-version: 1.0 Content-transfer-encoding: 7Bit Content-type: text/plain; charset=us-ascii X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFrrMLMWRmVeSWpSXmKPExsVy+t9jAd1jn03DDdb9lLBYfbefzWLvLW2L YzseMVlc3jWHzaLlfSubxa/lRxkd2Dwuny312LSqk83j5v797B6fN8kFsERx2aSk5mSWpRbp 2yVwZdze1c9esEKjYsWUz6wNjFMUuxg5OSQETCT2Nf9lhbDFJC7cW8/WxcjFISSwlFHi1JSr rBDOV0aJpl0LmUCq2ASsJCa2r2IEsUUEFCSalixmASliFljJKLHr/j2wUcIC/hJd656ydzFy cLAIqEr87U8GCfMKaElMOHSKHcQWFfCS2HFnN9hMTgEbidY5DWCtQgLWEscnTGSBqBeU+DH5 HpjNLCAvsW//VFYIW0ti/c7jTBMYBWYhKZuFpGwWkrIFjMyrGCVSC5ILipPScw3zUsv1ihNz i0vz0vWS83M3MYKD+pnUDsaDu9wPMQpwMCrx8CYomYYLsSaWFVfmHmKU4GBWEuFV/gQU4k1J rKxKLcqPLyrNSS0+xCjNwaIkzvv4/7owIYH0xJLU7NTUgtQimCwTB6dUA6PLvEWO94rTL27c nXXp8CvV6BMn3gV+mP/a/07D3TdewqrcOipZVQ9+9ay9XVvw6cR7vfD5ZgH7H/NOKpDTzVqy VLNrufz+U5J1M3frOp9NV95jaPnI6OIFLz9tYftkv5aOj0dvqGuunWEZuCKTw/SG6wE/sy27 H607tf/5jb5r1zLT3/peerxeiaU4I9FQi7moOBEAxkauX2YCAAA= Sender: linux-block-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-block@vger.kernel.org X-Spam-Status: No, score=-8.3 required=5.0 tests=BAYES_00, RCVD_IN_DNSWL_HI, RP_MATCHES_RCVD, UNPARSEABLE_RELAY autolearn=unavailable version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP Hi, On Thursday, May 12, 2016 07:05:52 PM Meelis Roos wrote: > This is form dual AthlonMP 32-bit x86 system with onboatrd AMD PATA > controller: > > [ 0.550152] pata_amd 0000:00:07.1: version 0.4.1 > [ 0.550865] scsi host0: pata_amd > [ 0.550966] ================================================================================ > [ 0.551124] UBSAN: Undefined behaviour in block/blk-mq.c:1459:27 > [ 0.551221] shift exponent 4294967295 is too large for 32-bit type 'unsigned int' > [ 0.551380] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 4.6.0-rc6-00072-g33656a1 #22 > [ 0.551536] Hardware name: Unknown Unknown/S2462 THUNDER K7, BIOS Guinness-8 04/07/2003 > [ 0.551695] 00000000 c134beac 00000046 f6461c28 00001000 c1381f8b f6461c1c 00000020 > [ 0.552053] c1382516 c1700128 f6461c2c 00000020 c18d66c0 00000202 34393234 32373639 > [ 0.552409] 00003539 c11a4799 00000020 00000000 f668bc00 00000000 f668bdc8 000001c0 > [ 0.552766] Call Trace: > [ 0.552868] [] ? dump_stack+0x45/0x69 > [ 0.552965] [] ? ubsan_epilogue+0xb/0x40 > [ 0.553060] [] ? __ubsan_handle_shift_out_of_bounds+0xd6/0x120 > [ 0.553160] [] ? kmem_cache_alloc+0xc9/0x130 > [ 0.553258] [] ? bt_alloc+0x60/0x160 > [ 0.553351] [] ? __kmalloc+0x130/0x1b0 > [ 0.553447] [] ? blk_mq_init_tags+0x84/0x110 > [ 0.553549] [] ? blk_mq_init_rq_map+0x6e/0x410 > [ 0.553647] [] ? blk_mq_init_rq_map+0x2d0/0x410 > [ 0.553747] [] ? dev_printk_emit+0x1b/0x20 > [ 0.553843] [] ? blk_mq_alloc_tag_set+0x7f/0x290 > [ 0.553940] [] ? blk_mq_alloc_tag_set+0xb3/0x290 > [ 0.554039] [] ? scsi_add_host_with_dma+0x23f/0x3b0 > [ 0.554139] [] ? ata_scsi_add_hosts+0xd4/0x200 > [ 0.554241] [] ? ata_host_register+0x113/0x460 > [ 0.554338] [] ? vscnprintf+0x14/0x40 > [ 0.554433] [] ? ata_port_desc+0x6b/0xe0 > [ 0.554531] [] ? ata_pci_sff_activate_host+0x8f/0x2e0 > [ 0.554629] [] ? ata_bmdma_port_intr+0x180/0x180 > [ 0.554726] [] ? ata_pci_init_one+0x14f/0x1c0 > [ 0.554824] [] ? pci_bus_write_config_byte+0x57/0x90 > [ 0.554848] [] ? ata_pci_bmdma_init_one+0x20/0x30 > [ 0.554848] [] ? amd_init_one+0xc5/0x1e0 > [ 0.554848] [] ? pci_device_probe+0x91/0x130 > [ 0.554848] [] ? driver_probe_device+0xc8/0x330 > [ 0.554848] [] ? driver_probe_device+0x330/0x330 > [ 0.554848] [] ? driver_probe_device+0x330/0x330 > [ 0.554848] [] ? __driver_attach+0x99/0xd0 > [ 0.554848] [] ? bus_for_each_dev+0x4c/0x90 > [ 0.554848] [] ? driver_attach+0x1a/0x40 > [ 0.554848] [] ? driver_probe_device+0x330/0x330 > [ 0.554848] [] ? bus_add_driver+0x127/0x290 > [ 0.554848] [] ? ata_sff_init+0x26/0x26 > [ 0.554848] [] ? driver_register+0x67/0x120 > [ 0.554848] [] ? do_one_initcall+0x8a/0x260 > [ 0.554848] [] ? ata_sff_init+0x26/0x26 > [ 0.554848] [] ? parameq+0xf/0xb0 > [ 0.554848] [] ? parse_args+0x205/0x510 > [ 0.554848] [] ? kernel_init_freeable+0x153/0x25c > [ 0.554848] [] ? kernel_init_freeable+0x1d0/0x25c > [ 0.554848] [] ? kernel_init+0x9/0x120 > [ 0.554848] [] ? schedule_tail+0xb/0xa0 > [ 0.554848] [] ? ret_from_kernel_thread+0x21/0x38 > [ 0.554848] [] ? rest_init+0x60/0x60 > [ 0.554848] ================================================================================ Does the patch below help? From: Bartlomiej Zolnierkiewicz Subject: [PATCH] blk-mq: fix undefined behaviour in order_to_size() When this_order variable in blk_mq_init_rq_map() becomes zero the code incorrectly decrements the variable and passes the result to order_to_size() helper causing undefined behaviour: UBSAN: Undefined behaviour in block/blk-mq.c:1459:27 shift exponent 4294967295 is too large for 32-bit type 'unsigned int' CPU: 0 PID: 1 Comm: swapper/0 Not tainted 4.6.0-rc6-00072-g33656a1 #22 Fix the code by checking this_order variable for not having the zero value first. Reported-by: Meelis Roos Fixes: 320ae51feed5 ("blk-mq: new multi-queue block IO queueing mechanism") Signed-off-by: Bartlomiej Zolnierkiewicz --- block/blk-mq.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/block/blk-mq.c b/block/blk-mq.c index 0c2ed83..7df9c92 100644 --- a/block/blk-mq.c +++ b/block/blk-mq.c @@ -1495,7 +1495,7 @@ static struct blk_mq_tags *blk_mq_init_rq_map(struct blk_mq_tag_set *set, int to_do; void *p; - while (left < order_to_size(this_order - 1) && this_order) + while (this_order && left < order_to_size(this_order - 1)) this_order--; do {