| Message ID | 20180125162429.7962-1-bart.vanassche@wdc.com (mailing list archive) |
|---|---|
| State | Accepted |
| Headers | show |
On Thu, 2018-01-25 at 08:24 -0800, Bart Van Assche wrote: > A left shift must shift less than the bit width of the left argument. > Avoid triggering undefined behavior if ha->mbx_count == 32. > > This patch avoids that UBSAN reports the following complaint: > > UBSAN: Undefined behaviour in drivers/scsi/qla2xxx/qla_isr.c:275:14 > shift exponent 32 is too large for 32-bit type 'int' > Call Trace: > dump_stack+0x4e/0x6c > ubsan_epilogue+0xd/0x3b > __ubsan_handle_shift_out_of_bounds+0x112/0x14c > qla2x00_mbx_completion+0x1c5/0x25d [qla2xxx] > qla2300_intr_handler+0x1ea/0x3bb [qla2xxx] > qla2x00_mailbox_command+0x77b/0x139a [qla2xxx] > qla2x00_mbx_reg_test+0x83/0x114 [qla2xxx] > qla2x00_chip_diag+0x354/0x45f [qla2xxx] > qla2x00_initialize_adapter+0x2c2/0xa4e [qla2xxx] > qla2x00_probe_one+0x1681/0x392e [qla2xxx] > pci_device_probe+0x10b/0x1f1 > driver_probe_device+0x21f/0x3a4 > __driver_attach+0xa9/0xe1 > bus_for_each_dev+0x6e/0xb5 > driver_attach+0x22/0x3c > bus_add_driver+0x1d1/0x2ae > driver_register+0x78/0x130 > __pci_register_driver+0x75/0xa8 > qla2x00_module_init+0x21b/0x267 [qla2xxx] > do_one_initcall+0x5a/0x1e2 > do_init_module+0x9d/0x285 > load_module+0x20db/0x38e3 > SYSC_finit_module+0xa8/0xbc > SyS_finit_module+0x9/0xb > do_syscall_64+0x77/0x271 > entry_SYSCALL64_slow_path+0x25/0x25 > > Reported-by: Meelis Roos <mroos@linux.ee> > Signed-off-by: Bart Van Assche <bart.vanassche@wdc.com> > Cc: Himanshu Madhani <himanshu.madhani@cavium.com> > --- > drivers/scsi/qla2xxx/qla_isr.c | 6 ++++-- > 1 file changed, 4 insertions(+), 2 deletions(-) > > diff --git a/drivers/scsi/qla2xxx/qla_isr.c > b/drivers/scsi/qla2xxx/qla_isr.c > index 16c43bd9bb83..79f538448364 100644 > --- a/drivers/scsi/qla2xxx/qla_isr.c > +++ b/drivers/scsi/qla2xxx/qla_isr.c > @@ -272,7 +272,8 @@ qla2x00_mbx_completion(scsi_qla_host_t *vha, > uint16_t mb0) > struct device_reg_2xxx __iomem *reg = &ha->iobase->isp; > > /* Read all mbox registers? */ > - mboxes = (1 << ha->mbx_count) - 1; > + WARN_ON_ONCE(ha->mbx_count > 32); > + mboxes = (1ULL << ha->mbx_count) - 1; > if (!ha->mcp) > ql_dbg(ql_dbg_async, vha, 0x5001, "MBX pointer > ERROR.\n"); > else > @@ -2884,7 +2885,8 @@ qla24xx_mbx_completion(scsi_qla_host_t *vha, > uint16_t mb0) > struct device_reg_24xx __iomem *reg = &ha->iobase->isp24; > > /* Read all mbox registers? */ > - mboxes = (1 << ha->mbx_count) - 1; > + WARN_ON_ONCE(ha->mbx_count > 32); > + mboxes = (1ULL << ha->mbx_count) - 1; > if (!ha->mcp) > ql_dbg(ql_dbg_async, vha, 0x504e, "MBX pointer > ERROR.\n"); > else This looks fine to me and I tested the earlier patch suggestion supplied by Meelis. Reviewed-by: Laurence Oberman <loberman@redhat.com>
> On Jan 25, 2018, at 8:24 AM, Bart Van Assche <bart.vanassche@wdc.com> wrote: > > A left shift must shift less than the bit width of the left argument. > Avoid triggering undefined behavior if ha->mbx_count == 32. > > This patch avoids that UBSAN reports the following complaint: > > UBSAN: Undefined behaviour in drivers/scsi/qla2xxx/qla_isr.c:275:14 > shift exponent 32 is too large for 32-bit type 'int' > Call Trace: > dump_stack+0x4e/0x6c > ubsan_epilogue+0xd/0x3b > __ubsan_handle_shift_out_of_bounds+0x112/0x14c > qla2x00_mbx_completion+0x1c5/0x25d [qla2xxx] > qla2300_intr_handler+0x1ea/0x3bb [qla2xxx] > qla2x00_mailbox_command+0x77b/0x139a [qla2xxx] > qla2x00_mbx_reg_test+0x83/0x114 [qla2xxx] > qla2x00_chip_diag+0x354/0x45f [qla2xxx] > qla2x00_initialize_adapter+0x2c2/0xa4e [qla2xxx] > qla2x00_probe_one+0x1681/0x392e [qla2xxx] > pci_device_probe+0x10b/0x1f1 > driver_probe_device+0x21f/0x3a4 > __driver_attach+0xa9/0xe1 > bus_for_each_dev+0x6e/0xb5 > driver_attach+0x22/0x3c > bus_add_driver+0x1d1/0x2ae > driver_register+0x78/0x130 > __pci_register_driver+0x75/0xa8 > qla2x00_module_init+0x21b/0x267 [qla2xxx] > do_one_initcall+0x5a/0x1e2 > do_init_module+0x9d/0x285 > load_module+0x20db/0x38e3 > SYSC_finit_module+0xa8/0xbc > SyS_finit_module+0x9/0xb > do_syscall_64+0x77/0x271 > entry_SYSCALL64_slow_path+0x25/0x25 > > Reported-by: Meelis Roos <mroos@linux.ee> > Signed-off-by: Bart Van Assche <bart.vanassche@wdc.com> > Cc: Himanshu Madhani <himanshu.madhani@cavium.com> > --- > drivers/scsi/qla2xxx/qla_isr.c | 6 ++++-- > 1 file changed, 4 insertions(+), 2 deletions(-) > > diff --git a/drivers/scsi/qla2xxx/qla_isr.c b/drivers/scsi/qla2xxx/qla_isr.c > index 16c43bd9bb83..79f538448364 100644 > --- a/drivers/scsi/qla2xxx/qla_isr.c > +++ b/drivers/scsi/qla2xxx/qla_isr.c > @@ -272,7 +272,8 @@ qla2x00_mbx_completion(scsi_qla_host_t *vha, uint16_t mb0) > struct device_reg_2xxx __iomem *reg = &ha->iobase->isp; > > /* Read all mbox registers? */ > - mboxes = (1 << ha->mbx_count) - 1; > + WARN_ON_ONCE(ha->mbx_count > 32); > + mboxes = (1ULL << ha->mbx_count) - 1; > if (!ha->mcp) > ql_dbg(ql_dbg_async, vha, 0x5001, "MBX pointer ERROR.\n"); > else > @@ -2884,7 +2885,8 @@ qla24xx_mbx_completion(scsi_qla_host_t *vha, uint16_t mb0) > struct device_reg_24xx __iomem *reg = &ha->iobase->isp24; > > /* Read all mbox registers? */ > - mboxes = (1 << ha->mbx_count) - 1; > + WARN_ON_ONCE(ha->mbx_count > 32); > + mboxes = (1ULL << ha->mbx_count) - 1; > if (!ha->mcp) > ql_dbg(ql_dbg_async, vha, 0x504e, "MBX pointer ERROR.\n"); > else > -- > 2.16.0 > Thanks for the formal patch. Acked-by: Himanshu Madhani <himanshu.madhani@cavium.com> Thanks, - Himanshu
Bart, > A left shift must shift less than the bit width of the left argument. > Avoid triggering undefined behavior if ha->mbx_count == 32. Applied to 4.16/scsi-fixes. Thank you!
diff --git a/drivers/scsi/qla2xxx/qla_isr.c b/drivers/scsi/qla2xxx/qla_isr.c index 16c43bd9bb83..79f538448364 100644 --- a/drivers/scsi/qla2xxx/qla_isr.c +++ b/drivers/scsi/qla2xxx/qla_isr.c @@ -272,7 +272,8 @@ qla2x00_mbx_completion(scsi_qla_host_t *vha, uint16_t mb0) struct device_reg_2xxx __iomem *reg = &ha->iobase->isp; /* Read all mbox registers? */ - mboxes = (1 << ha->mbx_count) - 1; + WARN_ON_ONCE(ha->mbx_count > 32); + mboxes = (1ULL << ha->mbx_count) - 1; if (!ha->mcp) ql_dbg(ql_dbg_async, vha, 0x5001, "MBX pointer ERROR.\n"); else @@ -2884,7 +2885,8 @@ qla24xx_mbx_completion(scsi_qla_host_t *vha, uint16_t mb0) struct device_reg_24xx __iomem *reg = &ha->iobase->isp24; /* Read all mbox registers? */ - mboxes = (1 << ha->mbx_count) - 1; + WARN_ON_ONCE(ha->mbx_count > 32); + mboxes = (1ULL << ha->mbx_count) - 1; if (!ha->mcp) ql_dbg(ql_dbg_async, vha, 0x504e, "MBX pointer ERROR.\n"); else
A left shift must shift less than the bit width of the left argument. Avoid triggering undefined behavior if ha->mbx_count == 32. This patch avoids that UBSAN reports the following complaint: UBSAN: Undefined behaviour in drivers/scsi/qla2xxx/qla_isr.c:275:14 shift exponent 32 is too large for 32-bit type 'int' Call Trace: dump_stack+0x4e/0x6c ubsan_epilogue+0xd/0x3b __ubsan_handle_shift_out_of_bounds+0x112/0x14c qla2x00_mbx_completion+0x1c5/0x25d [qla2xxx] qla2300_intr_handler+0x1ea/0x3bb [qla2xxx] qla2x00_mailbox_command+0x77b/0x139a [qla2xxx] qla2x00_mbx_reg_test+0x83/0x114 [qla2xxx] qla2x00_chip_diag+0x354/0x45f [qla2xxx] qla2x00_initialize_adapter+0x2c2/0xa4e [qla2xxx] qla2x00_probe_one+0x1681/0x392e [qla2xxx] pci_device_probe+0x10b/0x1f1 driver_probe_device+0x21f/0x3a4 __driver_attach+0xa9/0xe1 bus_for_each_dev+0x6e/0xb5 driver_attach+0x22/0x3c bus_add_driver+0x1d1/0x2ae driver_register+0x78/0x130 __pci_register_driver+0x75/0xa8 qla2x00_module_init+0x21b/0x267 [qla2xxx] do_one_initcall+0x5a/0x1e2 do_init_module+0x9d/0x285 load_module+0x20db/0x38e3 SYSC_finit_module+0xa8/0xbc SyS_finit_module+0x9/0xb do_syscall_64+0x77/0x271 entry_SYSCALL64_slow_path+0x25/0x25 Reported-by: Meelis Roos <mroos@linux.ee> Signed-off-by: Bart Van Assche <bart.vanassche@wdc.com> Cc: Himanshu Madhani <himanshu.madhani@cavium.com> --- drivers/scsi/qla2xxx/qla_isr.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)