Hi, this is the test case, and then I got ubsan error
(signed integer overflow) report, so the root cause is from
user or kernel? Shall we change something in timeval_valid()?
struct itimerval new_value;
int ret;
new_value.it_interval.tv_sec = 140673496649799L;
new_value.it_interval.tv_usec = 6;
new_value.it_value.tv_sec = 140673496649807L;
new_value.it_value.tv_usec = 5;
ret = setitimer(ITIMER_VIRTUAL, &new_value, NULL);
[ 533.326588] ================================================================================
[ 533.335346] UBSAN: Undefined behaviour in ./include/linux/time.h:239:27
[ 533.342155] signed integer overflow:
[ 533.345837] 140673496649807 * 1000000000 cannot be represented in type 'long int'
[ 533.353540] CPU: 102 PID: 17797 Comm: test.exe Tainted: G B 4.12.0-rc3-327.44.58.18.x86_64+ #30
[ 533.363646] Hardware name: Huawei Technologies Co., Ltd. RH8100 V3/BC61PBIA, BIOS BLHSV028 11/11/2014
[ 533.373130] Call Trace:
[ 533.375670] dump_stack+0xbc/0x124
[ 533.379179] ? _atomic_dec_and_lock+0x14c/0x14c
[ 533.383850] ubsan_epilogue+0xd/0x4e
[ 533.387531] handle_overflow+0x186/0x1d5
[ 533.391571] ? __ubsan_handle_negate_overflow+0x15b/0x15b
[ 533.397133] ? unlock_page+0x20/0x60
[ 533.400815] ? filemap_map_pages+0x3e8/0x820
[ 533.405211] ? read_cache_page_gfp+0x80/0x80
[ 533.409613] ? tty_ldisc_deref+0x28/0x40
[ 533.413653] ? tty_write+0x344/0x560
[ 533.417335] __ubsan_handle_mul_overflow+0xe/0x19
[ 533.422181] set_cpu_itimer+0x49c/0x540
[ 533.426132] ? get_cpu_itimer+0x290/0x290
[ 533.430271] ? __getnstimeofday64+0x14c/0x210
[ 533.434762] ? __pmd_alloc+0x1b0/0x1b0
[ 533.438623] ? ktime_get+0xd0/0xd0
[ 533.442127] do_setitimer+0xe1/0x540
[ 533.445817] ? __audit_syscall_entry+0x1cd/0x250
[ 533.450571] SyS_setitimer+0x1d6/0x210
[ 533.454431] ? SyS_alarm+0x150/0x150
[ 533.463453] ? trace_event_raw_event_sys_enter+0x590/0x590
[ 533.474508] ? handle_mm_fault+0x15a/0x530
[ 533.484144] ? __do_page_fault+0x3c9/0x740
[ 533.493712] ? SyS_alarm+0x150/0x150
[ 533.502553] do_syscall_64+0xf5/0x2a0
[ 533.511294] ? do_syscall_64+0xf5/0x2a0
[ 533.520031] entry_SYSCALL64_slow_path+0x25/0x25
[ 533.529410] RIP: 0033:0x7f32bbd71c67
[ 533.537565] RSP: 002b:00007ffe9b18df08 EFLAGS: 00000202 ORIG_RAX: 0000000000000026
[ 533.549766] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f32bbd71c67
[ 533.561530] RDX: 0000000000000000 RSI: 00007ffe9b18df30 RDI: 0000000000000001
[ 533.573237] RBP: 00007ffe9b18df60 R08: 00007f32bbd09d38 R09: 0000000000000012
[ 533.584794] R10: 00007ffe9b18dc90 R11: 0000000000000202 R12: 0000000000400490
[ 533.596218] R13: 00007ffe9b18e040 R14: 0000000000000000 R15: 0000000000000000
[ 533.607450] ================================================================================
[ 533.620059] ================================================================================
[ 533.632565] UBSAN: Undefined behaviour in ./include/linux/time.h:239:27
[ 533.643357] signed integer overflow:
[ 533.651093] 140673496649799 * 1000000000 cannot be represented in type 'long int'
[ 533.662927] CPU: 102 PID: 17797 Comm: test.exe Tainted: G B 4.12.0-rc3-327.44.58.18.x86_64+ #30
[ 533.681691] Hardware name: Huawei Technologies Co., Ltd. RH8100 V3/BC61PBIA, BIOS BLHSV028 11/11/2014
[ 533.700314] Call Trace:
[ 533.707469] dump_stack+0xbc/0x124
[ 533.715588] ? _atomic_dec_and_lock+0x14c/0x14c
[ 533.724911] ubsan_epilogue+0xd/0x4e
[ 533.733281] handle_overflow+0x186/0x1d5
[ 533.741952] ? __ubsan_handle_negate_overflow+0x15b/0x15b
[ 533.752190] ? unlock_page+0x20/0x60
[ 533.760592] ? filemap_map_pages+0x3e8/0x820
[ 533.769709] ? read_cache_page_gfp+0x80/0x80
[ 533.778844] ? tty_ldisc_deref+0x28/0x40
[ 533.787641] ? tty_write+0x344/0x560
[ 533.796126] __ubsan_handle_mul_overflow+0xe/0x19
[ 533.805696] set_cpu_itimer+0x438/0x540
[ 533.814412] ? get_cpu_itimer+0x290/0x290
[ 533.823259] ? __getnstimeofday64+0x14c/0x210
[ 533.832504] ? __pmd_alloc+0x1b0/0x1b0
[ 533.841082] ? ktime_get+0xd0/0xd0
[ 533.849294] do_setitimer+0xe1/0x540
[ 533.857675] ? __audit_syscall_entry+0x1cd/0x250
[ 533.867146] SyS_setitimer+0x1d6/0x210
[ 533.875731] ? SyS_alarm+0x150/0x150
[ 533.884099] ? trace_event_raw_event_sys_enter+0x590/0x590
[ 533.894388] ? handle_mm_fault+0x15a/0x530
[ 533.903209] ? __do_page_fault+0x3c9/0x740
[ 533.911953] ? SyS_alarm+0x150/0x150
[ 533.920154] do_syscall_64+0xf5/0x2a0
[ 533.928504] ? do_syscall_64+0xf5/0x2a0
[ 533.936997] entry_SYSCALL64_slow_path+0x25/0x25
[ 533.946160] RIP: 0033:0x7f32bbd71c67
[ 533.954353] RSP: 002b:00007ffe9b18df08 EFLAGS: 00000202 ORIG_RAX: 0000000000000026
[ 533.966657] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f32bbd71c67
[ 533.978452] RDX: 0000000000000000 RSI: 00007ffe9b18df30 RDI: 0000000000000001
[ 533.990192] RBP: 00007ffe9b18df60 R08: 00007f32bbd09d38 R09: 0000000000000012
[ 534.001811] R10: 00007ffe9b18dc90 R11: 0000000000000202 R12: 0000000000400490
[ 534.013274] R13: 00007ffe9b18e040 R14: 0000000000000000 R15: 0000000000000000
[ 534.024538] ================================================================================
On Thu, 1 Jun 2017, Xishi Qiu wrote:
Cc'ed John Stultz
> Hi, this is the test case, and then I got ubsan error
> (signed integer overflow) report, so the root cause is from
> user or kernel? Shall we change something in timeval_valid()?
>
>
> struct itimerval new_value;
> int ret;
>
> new_value.it_interval.tv_sec = 140673496649799L;
> new_value.it_interval.tv_usec = 6;
> new_value.it_value.tv_sec = 140673496649807L;
> new_value.it_value.tv_usec = 5;
>
> ret = setitimer(ITIMER_VIRTUAL, &new_value, NULL);
>
>
> [ 533.326588] ================================================================================
> [ 533.335346] UBSAN: Undefined behaviour in ./include/linux/time.h:239:27
> [ 533.342155] signed integer overflow:
> [ 533.345837] 140673496649807 * 1000000000 cannot be represented in type 'long int'
> [ 533.422181] set_cpu_itimer+0x49c/0x540
> [ 533.442127] do_setitimer+0xe1/0x540
We need a similar clamping of the conversion as we have for
timespec/val_to_ktime(). I'll have a look in the next days unless John
beats me to it.
Thanks,
tglx
On 2017/6/4 23:06, Thomas Gleixner wrote:
> On Thu, 1 Jun 2017, Xishi Qiu wrote:
>
> Cc'ed John Stultz
>
>> Hi, this is the test case, and then I got ubsan error
>> (signed integer overflow) report, so the root cause is from
>> user or kernel? Shall we change something in timeval_valid()?
>>
>>
>> struct itimerval new_value;
>> int ret;
>>
>> new_value.it_interval.tv_sec = 140673496649799L;
>> new_value.it_interval.tv_usec = 6;
>> new_value.it_value.tv_sec = 140673496649807L;
>> new_value.it_value.tv_usec = 5;
>>
>> ret = setitimer(ITIMER_VIRTUAL, &new_value, NULL);
>>
>>
>> [ 533.326588] ================================================================================
>> [ 533.335346] UBSAN: Undefined behaviour in ./include/linux/time.h:239:27
>> [ 533.342155] signed integer overflow:
>> [ 533.345837] 140673496649807 * 1000000000 cannot be represented in type 'long int'
>> [ 533.422181] set_cpu_itimer+0x49c/0x540
>> [ 533.442127] do_setitimer+0xe1/0x540
>
> We need a similar clamping of the conversion as we have for
> timespec/val_to_ktime(). I'll have a look in the next days unless John
> beats me to it.
>
Hi Thomas, anything new?
Thanks,
Xishi Qiu
> Thanks,
>
> tglx
>
> .
>
On Tue, 6 Jun 2017, Xishi Qiu wrote:
> On 2017/6/4 23:06, Thomas Gleixner wrote:
> > On Thu, 1 Jun 2017, Xishi Qiu wrote:
> >
> > Cc'ed John Stultz
> >
> >> Hi, this is the test case, and then I got ubsan error
> >> (signed integer overflow) report, so the root cause is from
> >> user or kernel? Shall we change something in timeval_valid()?
> >>
> >>
> >> struct itimerval new_value;
> >> int ret;
> >>
> >> new_value.it_interval.tv_sec = 140673496649799L;
> >> new_value.it_interval.tv_usec = 6;
> >> new_value.it_value.tv_sec = 140673496649807L;
> >> new_value.it_value.tv_usec = 5;
> >>
> >> ret = setitimer(ITIMER_VIRTUAL, &new_value, NULL);
> >>
> >>
> >> [ 533.326588] ================================================================================
> >> [ 533.335346] UBSAN: Undefined behaviour in ./include/linux/time.h:239:27
> >> [ 533.342155] signed integer overflow:
> >> [ 533.345837] 140673496649807 * 1000000000 cannot be represented in type 'long int'
> >> [ 533.422181] set_cpu_itimer+0x49c/0x540
> >> [ 533.442127] do_setitimer+0xe1/0x540
> >
> > We need a similar clamping of the conversion as we have for
> > timespec/val_to_ktime(). I'll have a look in the next days unless John
> > beats me to it.
> >
>
> Hi Thomas, anything new?
Let me spell it out to you again. I wrote on Sunday late night:
"I'll have a look in the next days ...."
Do you really think I need a reminder after 24 hours?
Thanks,
tglx