android_kernel_oneplus_msm8998/fs/ext4
Nicolai Stange 8b8de1c929 ext4: silence UBSAN in ext4_mb_init()
commit 935244cd54b86ca46e69bc6604d2adfb1aec2d42 upstream.

Currently, in ext4_mb_init(), there's a loop like the following:

  do {
    ...
    offset += 1 << (sb->s_blocksize_bits - i);
    i++;
  } while (i <= sb->s_blocksize_bits + 1);

Note that the updated offset is used in the loop's next iteration only.

However, at the last iteration, that is at i == sb->s_blocksize_bits + 1,
the shift count becomes equal to (unsigned)-1 > 31 (c.f. C99 6.5.7(3))
and UBSAN reports

  UBSAN: Undefined behaviour in fs/ext4/mballoc.c:2621:15
  shift exponent 4294967295 is too large for 32-bit type 'int'
  [...]
  Call Trace:
   [<ffffffff818c4d25>] dump_stack+0xbc/0x117
   [<ffffffff818c4c69>] ? _atomic_dec_and_lock+0x169/0x169
   [<ffffffff819411ab>] ubsan_epilogue+0xd/0x4e
   [<ffffffff81941cac>] __ubsan_handle_shift_out_of_bounds+0x1fb/0x254
   [<ffffffff81941ab1>] ? __ubsan_handle_load_invalid_value+0x158/0x158
   [<ffffffff814b6dc1>] ? kmem_cache_alloc+0x101/0x390
   [<ffffffff816fc13b>] ? ext4_mb_init+0x13b/0xfd0
   [<ffffffff814293c7>] ? create_cache+0x57/0x1f0
   [<ffffffff8142948a>] ? create_cache+0x11a/0x1f0
   [<ffffffff821c2168>] ? mutex_lock+0x38/0x60
   [<ffffffff821c23ab>] ? mutex_unlock+0x1b/0x50
   [<ffffffff814c26ab>] ? put_online_mems+0x5b/0xc0
   [<ffffffff81429677>] ? kmem_cache_create+0x117/0x2c0
   [<ffffffff816fcc49>] ext4_mb_init+0xc49/0xfd0
   [...]

Observe that the mentioned shift exponent, 4294967295, equals (unsigned)-1.

Unless compilers start to do some fancy transformations (which at least
GCC 6.0.0 doesn't currently do), the issue is of cosmetic nature only: the
such calculated value of offset is never used again.

Silence UBSAN by introducing another variable, offset_incr, holding the
next increment to apply to offset and adjust that one by right shifting it
by one position per loop iteration.

Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=114701
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=112161

Signed-off-by: Nicolai Stange <nicstange@gmail.com>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2016-06-07 18:14:37 -07:00
..
acl.c ext4: remove unused header files 2015-04-02 23:47:42 -04:00
acl.h ext2/3/4: use generic posix ACL infrastructure 2014-01-25 23:58:19 -05:00
balloc.c ext4: fix scheduling in atomic on group checksum failure 2016-02-25 12:01:14 -08:00
bitmap.c ext4: remove unused header files 2015-04-02 23:47:42 -04:00
block_validity.c ext4: call out CRC and corruption errors with specific error codes 2015-10-17 16:16:04 -04:00
crypto.c ext4: fix an endianness bug in ext4_encrypted_zeroout() 2015-11-26 15:20:19 -05:00
crypto_fname.c ext4 crypto: replace some BUG_ON()'s with error checks 2015-10-03 10:49:27 -04:00
crypto_key.c ext4 crypto: add missing locking for keyring_key access 2016-02-17 12:31:02 -08:00
crypto_policy.c ext4 crypto: replace some BUG_ON()'s with error checks 2015-10-03 10:49:27 -04:00
dir.c ext4: clean up feature test macros with predicate functions 2015-10-17 16:18:43 -04:00
ext4.h ext4: fix races of writeback with punch hole and zero range 2016-05-04 14:48:53 -07:00
ext4_crypto.h ext4 crypto: allocate bounce pages using GFP_NOWAIT 2015-06-03 09:32:39 -04:00
ext4_extents.h ext4: teach ext4_ext_find_extent() to realloc path if necessary 2014-09-01 14:40:09 -04:00
ext4_jbd2.c ext4: fix potential use after free in __ext4_journal_stop 2015-10-17 22:57:06 -04:00
ext4_jbd2.h ext4: clean up feature test macros with predicate functions 2015-10-17 16:18:43 -04:00
extents.c ext4: fix races of writeback with punch hole and zero range 2016-05-04 14:48:53 -07:00
extents_status.c ext4: move procfs registration code to fs/ext4/sysfs.c 2015-09-23 12:46:17 -04:00
extents_status.h ext4: move procfs registration code to fs/ext4/sysfs.c 2015-09-23 12:46:17 -04:00
file.c ext4: fix races between page faults and hole punching 2016-05-04 14:48:53 -07:00
fsync.c Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs 2015-04-26 17:22:07 -07:00
hash.c ext4: remove unused header files 2015-04-02 23:47:42 -04:00
ialloc.c ext4: clean up error handling when orphan list is corrupted 2016-06-07 18:14:37 -07:00
indirect.c ext4: clean up feature test macros with predicate functions 2015-10-17 16:18:43 -04:00
inline.c ext4: clean up feature test macros with predicate functions 2015-10-17 16:18:43 -04:00
inode.c ext4: fix races of writeback with punch hole and zero range 2016-05-04 14:48:53 -07:00
ioctl.c ext4: clean up feature test macros with predicate functions 2015-10-17 16:18:43 -04:00
Kconfig ext4: Update EXT4_USE_FOR_EXT2 description 2015-09-24 13:27:47 +02:00
Makefile ext4: move sysfs code from super.c to fs/ext4/sysfs.c 2015-09-23 12:44:17 -04:00
mballoc.c ext4: silence UBSAN in ext4_mb_init() 2016-06-07 18:14:37 -07:00
mballoc.h ext4: remove unused ac_ex_scanned 2014-02-20 13:32:10 -05:00
migrate.c ext4: clean up feature test macros with predicate functions 2015-10-17 16:18:43 -04:00
mmp.c ext4: call out CRC and corruption errors with specific error codes 2015-10-17 16:16:04 -04:00
move_extent.c ext4: iterate over buffer heads correctly in move_extent_per_page() 2016-06-01 12:15:48 -07:00
namei.c ext4: fix oops on corrupted filesystem 2016-06-07 18:14:37 -07:00
page-io.c ext4 crypto: fix memory leak in ext4_bio_write_page() 2015-10-02 23:54:58 -04:00
readpage.c Merge branch 'akpm' (patches from Andrew) 2015-11-07 14:32:45 -08:00
resize.c ext4: fix potential integer overflow 2016-02-25 12:01:15 -08:00
super.c ext4: fix races between page faults and hole punching 2016-05-04 14:48:53 -07:00
symlink.c ext4: fix an endianness bug in ext4_encrypted_follow_link() 2015-11-26 15:20:50 -05:00
sysfs.c ext4: add "static" to ext4_seq_##name##_fops struct 2015-11-26 15:52:24 -05:00
truncate.h ext4: fix races between page faults and hole punching 2016-05-04 14:48:53 -07:00
xattr.c xattr handlers: Pass handler to operations instead of flags 2015-11-13 20:34:32 -05:00
xattr.h ext4 crypto: add encryption xattr support 2015-04-11 07:47:00 -04:00
xattr_security.c xattr handlers: Pass handler to operations instead of flags 2015-11-13 20:34:32 -05:00
xattr_trusted.c xattr handlers: Pass handler to operations instead of flags 2015-11-13 20:34:32 -05:00
xattr_user.c xattr handlers: Pass handler to operations instead of flags 2015-11-13 20:34:32 -05:00