Bug 120411

Summary: UBSAN splat in kernel/sched/fair.c:5066:17
Product: Other Reporter: Wilfried Klaebe (linux-kernel)
Component: OtherAssignee: other_other
Status: CLOSED CODE_FIX    
Severity: normal CC: regressions
Priority: P1    
Hardware: All   
OS: Linux   
Kernel Version: 4.7.0-rc3 Subsystem:
Regression: No Bisected commit-id:
Attachments: .config

Description Wilfried Klaebe 2016-06-15 15:32:17 UTC
Created attachment 220151 [details]
.config

[   90.407195] ================================================================================
[   90.407213] UBSAN: Undefined behaviour in /usr/local/src/kernel/linux-git/kernel/sched/fair.c:5066:17
[   90.407221] signed integer overflow:
[   90.407226] -151732750385297 * 63612 cannot be represented in type 'long long int'
[   90.407236] CPU: 2 PID: 5465 Comm: panel-8-xfce4-o Tainted: G           O    4.7.0-rc3-00002-g44c5afa #1
[   90.407241] Hardware name: Apple Inc. MacBookPro8,2/Mac-94245A3940C91C80, BIOS    MBP81.88Z.0047.B27.1201241646 01/24/12
[   90.407247]  ffff75fff74fff6f ffff88024bf3b8a0 ffffffff815c8665 0000000000000007
[   90.407260]  ffff88024bf3b8d0 000000000000f87c ffff88024bf3b8b8 ffffffff8163e77d
[   90.407270]  ffffffff8211fda8 ffff88024bf3b948 ffffffff8163f1a8 0000002a00000046
[   90.407280] Call Trace:
[   90.407296]  [<ffffffff815c8665>] dump_stack+0x68/0xa3
[   90.407307]  [<ffffffff8163e77d>] ubsan_epilogue+0xd/0x40
[   90.407316]  [<ffffffff8163f1a8>] handle_overflow+0xc8/0x100
[   90.407326]  [<ffffffff8163f20e>] __ubsan_handle_mul_overflow+0xe/0x10
[   90.407336]  [<ffffffff81167efd>] select_task_rq_fair+0xfcd/0x1110
[   90.407344]  [<ffffffff8116704a>] ? select_task_rq_fair+0x11a/0x1110
[   90.407355]  [<ffffffff81154c5c>] try_to_wake_up+0xec/0x770
[   90.407362]  [<ffffffff81197aed>] ? __lock_acquire+0x1dd/0x20f0
[   90.407371]  [<ffffffff811553f2>] default_wake_function+0x22/0x50
[   90.407379]  [<ffffffff81369e42>] pollwake+0x82/0x100
[   90.407387]  [<ffffffff811553d0>] ? wake_up_q+0xd0/0xd0
[   90.407394]  [<ffffffff81185936>] __wake_up_common+0x66/0x120
[   90.407401]  [<ffffffff81185ab0>] __wake_up_sync_key+0x40/0x60
[   90.407412]  [<ffffffff8191e81c>] sock_def_readable+0xcc/0x3d0
[   90.407420]  [<ffffffff8191e750>] ? sock_def_error_report+0x3d0/0x3d0
[   90.407429]  [<ffffffff81a8ddc7>] unix_stream_sendmsg+0x1c7/0x510
[   90.407437]  [<ffffffff81916818>] sock_write_iter+0xb8/0x180
[   90.407447]  [<ffffffff81349e45>] do_iter_readv_writev+0xc5/0x210
[   90.407455]  [<ffffffff8134adbb>] do_readv_writev+0x12b/0x3c0
[   90.407463]  [<ffffffff8134b33e>] vfs_writev+0x4e/0x80
[   90.407471]  [<ffffffff8137e1b3>] ? __fdget_pos+0x13/0x70
[   90.407478]  [<ffffffff8134b3c0>] do_writev+0x50/0x110
[   90.407486]  [<ffffffff8134cccb>] SyS_writev+0xb/0x10
[   90.407496]  [<ffffffff81003aa6>] do_syscall_64+0x76/0x1d0
[   90.407507]  [<ffffffff81b3219e>] entry_SYSCALL64_slow_path+0x25/0x25
[   90.407512] ================================================================================
Comment 1 The Linux kernel's regression tracker (Thorsten Leemhuis) 2016-06-17 13:53:34 UTC
Do you know if is something new with 4.7-rc? if yes it will qualify as regression.
Comment 2 Wilfried Klaebe 2016-06-21 17:01:06 UTC
I don't know if this is new, I did not have UBSAN checks enabled before 4.7-rc.
Comment 3 Wilfried Klaebe 2016-06-22 18:31:22 UTC
I just found the time to compile and boot Linux 4.6.2 with as close as possible a config - no UBSAN splat in kernel/sched/fair.c there. I'd count that as a regression then.
Comment 4 Wilfried Klaebe 2017-02-22 20:08:44 UTC
Does not appear in (at least) 4.10 anymore.