Bug 114701

Summary: ubsan: "shift exponent -1 is negative" in fs/ext4/mballoc.c:2612:15
Product: File System Reporter: Peter Gerber (peter)
Component: ext4Assignee: fs_ext4 (fs_ext4)
Status: RESOLVED CODE_FIX    
Severity: normal CC: navinp1912, szg00000, tytso
Priority: P1    
Hardware: All   
OS: Linux   
Kernel Version: 4.5.0 Subsystem:
Regression: No Bisected commit-id:

Description Peter Gerber 2016-03-15 19:53:38 UTC 
The following message appeared during boot:

Mar 15 12:09:22 ivy kernel: ================================================================================
Mar 15 12:09:22 ivy kernel: UBSAN: Undefined behaviour in fs/ext4/mballoc.c:2612:15
Mar 15 12:09:22 ivy kernel: shift exponent -1 is negative
Mar 15 12:09:22 ivy kernel: CPU: 1 PID: 657 Comm: mount Not tainted 4.5.0-pege1 #1
Mar 15 12:09:22 ivy kernel: Hardware name: Hewlett-Packard HP ENVY dv6 Notebook PC/181B, BIOS F.29 10/03/2013
Mar 15 12:09:22 ivy kernel:  0000000000000000 00000000450d838f ffffffff816fcef7 0000000000000001
Mar 15 12:09:22 ivy kernel:  00000000450d838f ffff880449cfbb90 ffff880449cfbc10 ffffffff817952a9
Mar 15 12:09:22 ivy kernel:  ffffffffc324f17e ffffffff81795caa 0000000000000202 000000000000312d
Mar 15 12:09:22 ivy kernel: Call Trace:
Mar 15 12:09:22 ivy kernel:  [<ffffffff816fcef7>] ? dump_stack+0x70/0xb9
Mar 15 12:09:22 ivy kernel:  [<ffffffff817952a9>] ? ubsan_epilogue+0x9/0x40
Mar 15 12:09:22 ivy kernel:  [<ffffffff81795caa>] ? __ubsan_handle_shift_out_of_bounds+0xfa/0x150
Mar 15 12:09:22 ivy kernel:  [<ffffffff81380031>] ? use_mm+0x3e1/0x5d0
Mar 15 12:09:22 ivy kernel:  [<ffffffffc310e408>] ? ext4_mb_init+0xbf8/0xf70 [ext4]
Mar 15 12:09:22 ivy kernel:  [<ffffffffc31146db>] ? ext4_setup_system_zone+0x20b/0x4d0 [ext4]
Mar 15 12:09:22 ivy kernel:  [<ffffffffc30cbd5e>] ? ext4_fill_super+0x52fe/0x83a0 [ext4]
Mar 15 12:09:22 ivy kernel:  [<ffffffff817252b9>] ? snprintf+0x49/0x60
Mar 15 12:09:22 ivy kernel:  [<ffffffffc30c6a60>] ? ext4_calculate_overhead+0xc90/0xc90 [ext4]
Mar 15 12:09:22 ivy kernel:  [<ffffffff8145a549>] ? mount_bdev+0x1a9/0x290
Mar 15 12:09:22 ivy kernel:  [<ffffffff8145bbba>] ? mount_fs+0x4a/0x280
Mar 15 12:09:22 ivy kernel:  [<ffffffff81499906>] ? vfs_kern_mount+0x76/0x290
Mar 15 12:09:22 ivy kernel:  [<ffffffff814a118c>] ? do_mount+0x2ac/0x1be0
Mar 15 12:09:22 ivy kernel:  [<ffffffff814a0bd5>] ? copy_mount_options+0x35/0x320
Mar 15 12:09:22 ivy kernel:  [<ffffffff814a3274>] ? SyS_mount+0x84/0xc0
Mar 15 12:09:22 ivy kernel:  [<ffffffff81dfbcf6>] ? entry_SYSCALL_64_fastpath+0x16/0x75
Mar 15 12:09:22 ivy kernel: ================================================================================

Let me know if you need more information.
Comment 1 Navin 2016-03-30 09:12:29 UTC 
diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c
index 50e05df..8ccfcf7 100644
--- a/fs/ext4/mballoc.c
+++ b/fs/ext4/mballoc.c
@@ -1278,6 +1278,8 @@ static int mb_find_order_for_block(struct ext4_buddy *e4b, int block)
                        /* this block is part of buddy of order 'order' */
                        return order;
                }
+               if (order > e4b->bd_blkbits)
+                       break;
                bb += 1 << (e4b->bd_blkbits - order);
                order++;
        }
@@ -2616,6 +2618,8 @@ int ext4_mb_init(struct super_block *sb)
        do {
                sbi->s_mb_offsets[i] = offset;
                sbi->s_mb_maxs[i] = max;
+               if (i > sb->s_blocksize_bits)
+                       break;
                offset += 1 << (sb->s_blocksize_bits - i);
                max = max >> 1;
                i++;


The only case if when i>b you compute off and max but those are not assigned . So those values can be ignored. It keeps the old behaviour intact and fixes the undefined behaviour.


offset += 1 << (sb->s_blocksize_bits - i);


/* Remove the if to see trap error at runtime */
/* gcc -fsanitize=undefined x.c */
int main()
{
	int i=1;
	int b=12;
	unsigned ub=12;
	unsigned off=0,uoff=0;
	do{
		if(i> b) break;
		off+=1<<(b-i);
		uoff+=1<<(ub-i);
		i++;
	} while(i<=b+1);
}
Comment 2 Theodore Tso 2016-05-06 01:19:48 UTC 
I will be applying these patches:

        http://patchwork.ozlabs.org/patch/599805/
        http://patchwork.ozlabs.org/patch/599804/