Thread (3 messages) flat view 3 messages, 3 authors, 2024-05-20

Re: UBSAN: shift-out-of-bounds in validate_sb_layout

From: Kent Overstreet <kent.overstreet@linux.dev>
Date: 2024-05-20 14:42:52
Also in: lkml

On Mon, May 20, 2024 at 10:31:53AM -0400, Steven Rostedt wrote:
On Mon, 20 May 2024 15:02:26 +0800
"Ubisectech Sirius" [off-list ref] wrote:
quoted
Hello.
We are Ubisectech Sirius Team, the vulnerability lab of China ValiantSec. Recently, our team has discovered a issue in Linux kernel 6.7. Attached to the email were a PoC file of the issue.

Stack dump:
UBSAN: shift-out-of-bounds in fs/bcachefs/super-io.c:310:18
shift exponent 127 is too large for 32-bit type 'int'
CPU: 0 PID: 14408 Comm: syz-executor.3 Not tainted 6.7.0 #2
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x136/0x150 lib/dump_stack.c:106
 ubsan_epilogue lib/ubsan.c:217 [inline]
 __ubsan_handle_shift_out_of_bounds+0x24b/0x430 lib/ubsan.c:387
 validate_sb_layout.cold+0x1a/0x51 fs/bcachefs/super-io.c:310
 bch2_read_super+0x980/0x1000 fs/bcachefs/super-io.c:786
 bch2_fs_open+0x471/0x3890 fs/bcachefs/super.c:1922
 bch2_mount+0x538/0x13c0 fs/bcachefs/fs.c:1863
 legacy_get_tree+0x109/0x220 fs/fs_context.c:662
 vfs_get_tree+0x93/0x380 fs/super.c:1771
 do_new_mount fs/namespace.c:3337 [inline]
 path_mount+0x679/0x1e40 fs/namespace.c:3664
 do_mount fs/namespace.c:3677 [inline]
 __do_sys_mount fs/namespace.c:3886 [inline]
 __se_sys_mount fs/namespace.c:3863 [inline]
 __x64_sys_mount+0x287/0x310 fs/namespace.c:3863
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0x43/0x120 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x6f/0x77
RIP: 0033:0x7f41e1091b3e
Code: 48 c7 c0 ff ff ff ff eb aa e8 be 0d 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 f3 0f 1e fa 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f41e1d22e38 EFLAGS: 00000202 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 0000000000005d82 RCX: 00007f41e1091b3e
RDX: 0000000020005d80 RSI: 0000000020000100 RDI: 00007f41e1d22e90
RBP: 00007f41e1d22ed0 R08: 00007f41e1d22ed0 R09: 0000000000000080
R10: 0000000000000080 R11: 0000000000000202 R12: 0000000020005d80
R13: 0000000020000100 R14: 00007f41e1d22e90 R15: 0000000020005e00
 </TASK>

Thank you for taking the time to read this email and we look forward to working with you further.
I'm not sure why this is getting Cc'd to linux-trace-kernel. That's for
anything to do with the tracing code (trace events, tracepoints, kprobes,
uprobes, function tracer etc).

What part of tracing is this for?
Everything I've seen from Ubisectech has been duplicates of stuff syzbot
found awhile ago and is already fixed.
Keyboard shortcuts
hback out one level
jnext message in thread
kprevious message in thread
ldrill in
Escclose help / fold thread tree
?toggle this help