2018-11-09 17:13:19

by Christophe Leroy

Subject: UBSAN: Undefined behaviour in kernel/rcu/tree_plugin.h in 4.20-rc1

(Resending due to error in Paul's address)

Paul

I get the following UBSAN reports in 4.20-rc1 on an MPC8321E
(powerpc/book3s/32)

I bisected it to 3e31009898699dfc ("rcu: Defer reporting RCU-preempt
quiescent states when disabled")

Thanks
Christophe

[ 4.919995]
================================================================================
[ 4.928428] UBSAN: Undefined behaviour in kernel/rcu/tree_plugin.h:623:28
[ 4.935198] signed integer overflow:
[ 4.938766] 0 - -2147483648 cannot be represented in type 'int'
[ 4.944678] CPU: 0 PID: 119 Comm: mkdir Not tainted
4.19.0-rc1-s3k-dev-00005-g5a60513 #214
[ 4.952908] Call Trace:
[ 4.955382] [dec4fd20] [c02cb0d0] ubsan_epilogue+0x18/0x74 (unreliable)
[ 4.962003] [dec4fd30] [c02cb5e0] handle_overflow+0xd0/0xe0
[ 4.967588] [dec4fdb0] [c007b424] rcu_preempt_deferred_qs+0xc0/0xc8
[ 4.973857] [dec4fdd0] [c007be28] rcu_note_context_switch+0x74/0x608
[ 4.980217] [dec4fe10] [c064b790] __schedule+0x58/0x6e0
[ 4.985448] [dec4fe50] [c064bfdc] preempt_schedule_common+0x48/0x9c
[ 4.991717] [dec4fe70] [c01308c8] handle_mm_fault+0x10fc/0x1ecc
[ 4.997639] [dec4fee0] [c001339c] do_page_fault+0x10c/0x760
[ 5.003225] [dec4ff40] [c001234c] handle_page_fault+0x14/0x40
[ 5.008968] --- interrupt: 401 at 0xff9cff8
[ 5.008968] LR = 0xfeefd78
[ 5.016170]
================================================================================
[ 5.024591]
================================================================================
[ 5.033005] UBSAN: Undefined behaviour in kernel/rcu/tree_plugin.h:627:28
[ 5.039775] signed integer overflow:
[ 5.043342] -2147483648 + -2147483648 cannot be represented in type 'int'
[ 5.050118] CPU: 0 PID: 119 Comm: mkdir Not tainted
4.19.0-rc1-s3k-dev-00005-g5a60513 #214
[ 5.058348] Call Trace:
[ 5.060813] [dec4fd20] [c02cb0d0] ubsan_epilogue+0x18/0x74 (unreliable)
[ 5.067433] [dec4fd30] [c02cb5e0] handle_overflow+0xd0/0xe0
[ 5.073014] [dec4fdb0] [c007b408] rcu_preempt_deferred_qs+0xa4/0xc8
[ 5.079283] [dec4fdd0] [c007be28] rcu_note_context_switch+0x74/0x608
[ 5.085640] [dec4fe10] [c064b790] __schedule+0x58/0x6e0
[ 5.090871] [dec4fe50] [c064bfdc] preempt_schedule_common+0x48/0x9c
[ 5.097139] [dec4fe70] [c01308c8] handle_mm_fault+0x10fc/0x1ecc
[ 5.103059] [dec4fee0] [c001339c] do_page_fault+0x10c/0x760
[ 5.108642] [dec4ff40] [c001234c] handle_page_fault+0x14/0x40
[ 5.114385] --- interrupt: 401 at 0xff9cff8
[ 5.114385] LR = 0xfeefd78
[ 5.121588]
================================================================================

2018-11-09 20:11:37

by Paul E. McKenney

Subject: Re: UBSAN: Undefined behaviour in kernel/rcu/tree_plugin.h in 4.20-rc1

On Fri, Nov 09, 2018 at 06:11:20PM +0100, Christophe LEROY wrote:
> (Resending due to error in Paul's address)
>
> Paul
>
> I get the following UBSAN reports in 4.20-rc1 on an MPC8321E
> (powerpc/book3s/32)
>
> I bisected it to 3e31009898699dfc ("rcu: Defer reporting RCU-preempt
> quiescent states when disabled")

Fixed by dfdc33585b0a ("rcu: Avoid signed integer overflow in
rcu_preempt_deferred_qs()") in my -rcu tree and in -next, which I intend
to push into the next merge window.

Thanx, Paul

> Thanks
> Christophe
>
> [ 4.919995] ================================================================================
> [ 4.928428] UBSAN: Undefined behaviour in kernel/rcu/tree_plugin.h:623:28
> [ 4.935198] signed integer overflow:
> [ 4.938766] 0 - -2147483648 cannot be represented in type 'int'
> [ 4.944678] CPU: 0 PID: 119 Comm: mkdir Not tainted
> 4.19.0-rc1-s3k-dev-00005-g5a60513 #214
> [ 4.952908] Call Trace:
> [ 4.955382] [dec4fd20] [c02cb0d0] ubsan_epilogue+0x18/0x74 (unreliable)
> [ 4.962003] [dec4fd30] [c02cb5e0] handle_overflow+0xd0/0xe0
> [ 4.967588] [dec4fdb0] [c007b424] rcu_preempt_deferred_qs+0xc0/0xc8
> [ 4.973857] [dec4fdd0] [c007be28] rcu_note_context_switch+0x74/0x608
> [ 4.980217] [dec4fe10] [c064b790] __schedule+0x58/0x6e0
> [ 4.985448] [dec4fe50] [c064bfdc] preempt_schedule_common+0x48/0x9c
> [ 4.991717] [dec4fe70] [c01308c8] handle_mm_fault+0x10fc/0x1ecc
> [ 4.997639] [dec4fee0] [c001339c] do_page_fault+0x10c/0x760
> [ 5.003225] [dec4ff40] [c001234c] handle_page_fault+0x14/0x40
> [ 5.008968] --- interrupt: 401 at 0xff9cff8
> [ 5.008968] LR = 0xfeefd78
> [ 5.016170] ================================================================================
> [ 5.024591] ================================================================================
> [ 5.033005] UBSAN: Undefined behaviour in kernel/rcu/tree_plugin.h:627:28
> [ 5.039775] signed integer overflow:
> [ 5.043342] -2147483648 + -2147483648 cannot be represented in type 'int'
> [ 5.050118] CPU: 0 PID: 119 Comm: mkdir Not tainted
> 4.19.0-rc1-s3k-dev-00005-g5a60513 #214
> [ 5.058348] Call Trace:
> [ 5.060813] [dec4fd20] [c02cb0d0] ubsan_epilogue+0x18/0x74 (unreliable)
> [ 5.067433] [dec4fd30] [c02cb5e0] handle_overflow+0xd0/0xe0
> [ 5.073014] [dec4fdb0] [c007b408] rcu_preempt_deferred_qs+0xa4/0xc8
> [ 5.079283] [dec4fdd0] [c007be28] rcu_note_context_switch+0x74/0x608
> [ 5.085640] [dec4fe10] [c064b790] __schedule+0x58/0x6e0
> [ 5.090871] [dec4fe50] [c064bfdc] preempt_schedule_common+0x48/0x9c
> [ 5.097139] [dec4fe70] [c01308c8] handle_mm_fault+0x10fc/0x1ecc
> [ 5.103059] [dec4fee0] [c001339c] do_page_fault+0x10c/0x760
> [ 5.108642] [dec4ff40] [c001234c] handle_page_fault+0x14/0x40
> [ 5.114385] --- interrupt: 401 at 0xff9cff8
> [ 5.114385] LR = 0xfeefd78
> [ 5.121588] ================================================================================
>

2018-11-11 00:53:31

by Paul E. McKenney

Subject: Re: UBSAN: Undefined behaviour in kernel/rcu/tree_plugin.h in 4.20-rc1

On Fri, Nov 09, 2018 at 12:10:30PM -0800, Paul E. McKenney wrote:
> On Fri, Nov 09, 2018 at 06:11:20PM +0100, Christophe LEROY wrote:
> > (Resending due to error in Paul's address)
> >
> > Paul
> >
> > I get the following UBSAN reports in 4.20-rc1 on an MPC8321E
> > (powerpc/book3s/32)
> >
> > I bisected it to 3e31009898699dfc ("rcu: Defer reporting RCU-preempt
> > quiescent states when disabled")
>
> Fixed by dfdc33585b0a ("rcu: Avoid signed integer overflow in
> rcu_preempt_deferred_qs()") in my -rcu tree and in -next, which I intend
> to push into the next merge window.

And while I am at it... The C++ Standards Committee just yesterday
voted "Signed integers are twos complement" into the C++20 standard. ;-)

Yeah, C++20 rather than now, and C++ rather than C, but there you have it!

Thanx, Paul

> > Thanks
> > Christophe
> >
> > [ 4.919995] ================================================================================
> > [ 4.928428] UBSAN: Undefined behaviour in kernel/rcu/tree_plugin.h:623:28
> > [ 4.935198] signed integer overflow:
> > [ 4.938766] 0 - -2147483648 cannot be represented in type 'int'
> > [ 4.944678] CPU: 0 PID: 119 Comm: mkdir Not tainted
> > 4.19.0-rc1-s3k-dev-00005-g5a60513 #214
> > [ 4.952908] Call Trace:
> > [ 4.955382] [dec4fd20] [c02cb0d0] ubsan_epilogue+0x18/0x74 (unreliable)
> > [ 4.962003] [dec4fd30] [c02cb5e0] handle_overflow+0xd0/0xe0
> > [ 4.967588] [dec4fdb0] [c007b424] rcu_preempt_deferred_qs+0xc0/0xc8
> > [ 4.973857] [dec4fdd0] [c007be28] rcu_note_context_switch+0x74/0x608
> > [ 4.980217] [dec4fe10] [c064b790] __schedule+0x58/0x6e0
> > [ 4.985448] [dec4fe50] [c064bfdc] preempt_schedule_common+0x48/0x9c
> > [ 4.991717] [dec4fe70] [c01308c8] handle_mm_fault+0x10fc/0x1ecc
> > [ 4.997639] [dec4fee0] [c001339c] do_page_fault+0x10c/0x760
> > [ 5.003225] [dec4ff40] [c001234c] handle_page_fault+0x14/0x40
> > [ 5.008968] --- interrupt: 401 at 0xff9cff8
> > [ 5.008968] LR = 0xfeefd78
> > [ 5.016170] ================================================================================
> > [ 5.024591] ================================================================================
> > [ 5.033005] UBSAN: Undefined behaviour in kernel/rcu/tree_plugin.h:627:28
> > [ 5.039775] signed integer overflow:
> > [ 5.043342] -2147483648 + -2147483648 cannot be represented in type 'int'
> > [ 5.050118] CPU: 0 PID: 119 Comm: mkdir Not tainted
> > 4.19.0-rc1-s3k-dev-00005-g5a60513 #214
> > [ 5.058348] Call Trace:
> > [ 5.060813] [dec4fd20] [c02cb0d0] ubsan_epilogue+0x18/0x74 (unreliable)
> > [ 5.067433] [dec4fd30] [c02cb5e0] handle_overflow+0xd0/0xe0
> > [ 5.073014] [dec4fdb0] [c007b408] rcu_preempt_deferred_qs+0xa4/0xc8
> > [ 5.079283] [dec4fdd0] [c007be28] rcu_note_context_switch+0x74/0x608
> > [ 5.085640] [dec4fe10] [c064b790] __schedule+0x58/0x6e0
> > [ 5.090871] [dec4fe50] [c064bfdc] preempt_schedule_common+0x48/0x9c
> > [ 5.097139] [dec4fe70] [c01308c8] handle_mm_fault+0x10fc/0x1ecc
> > [ 5.103059] [dec4fee0] [c001339c] do_page_fault+0x10c/0x760
> > [ 5.108642] [dec4ff40] [c001234c] handle_page_fault+0x14/0x40
> > [ 5.114385] --- interrupt: 401 at 0xff9cff8
> > [ 5.114385] LR = 0xfeefd78
> > [ 5.121588] ================================================================================
> >

2018-11-14 14:44:45

by Christophe Leroy

Subject: Re: UBSAN: Undefined behaviour in kernel/rcu/tree_plugin.h in 4.20-rc1

Le 09/11/2018 à 21:10, Paul E. McKenney a écrit :
> On Fri, Nov 09, 2018 at 06:11:20PM +0100, Christophe LEROY wrote:
>> (Resending due to error in Paul's address)
>>
>> Paul
>>
>> I get the following UBSAN reports in 4.20-rc1 on an MPC8321E
>> (powerpc/book3s/32)
>>
>> I bisected it to 3e31009898699dfc ("rcu: Defer reporting RCU-preempt
>> quiescent states when disabled")
>
> Fixed by dfdc33585b0a ("rcu: Avoid signed integer overflow in
> rcu_preempt_deferred_qs()") in my -rcu tree and in -next, which I intend
> to push into the next merge window.
>

Thanks, I confirm it fixes the issue.

Do you intend to push it into 4.20-rc3 or do you mean 4.21 ?

Christophe

> Thanx, Paul
>
>> Thanks
>> Christophe
>>
>> [ 4.919995] ================================================================================
>> [ 4.928428] UBSAN: Undefined behaviour in kernel/rcu/tree_plugin.h:623:28
>> [ 4.935198] signed integer overflow:
>> [ 4.938766] 0 - -2147483648 cannot be represented in type 'int'
>> [ 4.944678] CPU: 0 PID: 119 Comm: mkdir Not tainted
>> 4.19.0-rc1-s3k-dev-00005-g5a60513 #214
>> [ 4.952908] Call Trace:
>> [ 4.955382] [dec4fd20] [c02cb0d0] ubsan_epilogue+0x18/0x74 (unreliable)
>> [ 4.962003] [dec4fd30] [c02cb5e0] handle_overflow+0xd0/0xe0
>> [ 4.967588] [dec4fdb0] [c007b424] rcu_preempt_deferred_qs+0xc0/0xc8
>> [ 4.973857] [dec4fdd0] [c007be28] rcu_note_context_switch+0x74/0x608
>> [ 4.980217] [dec4fe10] [c064b790] __schedule+0x58/0x6e0
>> [ 4.985448] [dec4fe50] [c064bfdc] preempt_schedule_common+0x48/0x9c
>> [ 4.991717] [dec4fe70] [c01308c8] handle_mm_fault+0x10fc/0x1ecc
>> [ 4.997639] [dec4fee0] [c001339c] do_page_fault+0x10c/0x760
>> [ 5.003225] [dec4ff40] [c001234c] handle_page_fault+0x14/0x40
>> [ 5.008968] --- interrupt: 401 at 0xff9cff8
>> [ 5.008968] LR = 0xfeefd78
>> [ 5.016170] ================================================================================
>> [ 5.024591] ================================================================================
>> [ 5.033005] UBSAN: Undefined behaviour in kernel/rcu/tree_plugin.h:627:28
>> [ 5.039775] signed integer overflow:
>> [ 5.043342] -2147483648 + -2147483648 cannot be represented in type 'int'
>> [ 5.050118] CPU: 0 PID: 119 Comm: mkdir Not tainted
>> 4.19.0-rc1-s3k-dev-00005-g5a60513 #214
>> [ 5.058348] Call Trace:
>> [ 5.060813] [dec4fd20] [c02cb0d0] ubsan_epilogue+0x18/0x74 (unreliable)
>> [ 5.067433] [dec4fd30] [c02cb5e0] handle_overflow+0xd0/0xe0
>> [ 5.073014] [dec4fdb0] [c007b408] rcu_preempt_deferred_qs+0xa4/0xc8
>> [ 5.079283] [dec4fdd0] [c007be28] rcu_note_context_switch+0x74/0x608
>> [ 5.085640] [dec4fe10] [c064b790] __schedule+0x58/0x6e0
>> [ 5.090871] [dec4fe50] [c064bfdc] preempt_schedule_common+0x48/0x9c
>> [ 5.097139] [dec4fe70] [c01308c8] handle_mm_fault+0x10fc/0x1ecc
>> [ 5.103059] [dec4fee0] [c001339c] do_page_fault+0x10c/0x760
>> [ 5.108642] [dec4ff40] [c001234c] handle_page_fault+0x14/0x40
>> [ 5.114385] --- interrupt: 401 at 0xff9cff8
>> [ 5.114385] LR = 0xfeefd78
>> [ 5.121588] ================================================================================
>>

2018-11-14 15:31:33

by Paul E. McKenney

Subject: Re: UBSAN: Undefined behaviour in kernel/rcu/tree_plugin.h in 4.20-rc1

On Wed, Nov 14, 2018 at 03:43:05PM +0100, Christophe LEROY wrote:
>
>
> Le 09/11/2018 ? 21:10, Paul E. McKenney a ?crit?:
> >On Fri, Nov 09, 2018 at 06:11:20PM +0100, Christophe LEROY wrote:
> >>(Resending due to error in Paul's address)
> >>
> >>Paul
> >>
> >>I get the following UBSAN reports in 4.20-rc1 on an MPC8321E
> >>(powerpc/book3s/32)
> >>
> >>I bisected it to 3e31009898699dfc ("rcu: Defer reporting RCU-preempt
> >>quiescent states when disabled")
> >
> >Fixed by dfdc33585b0a ("rcu: Avoid signed integer overflow in
> >rcu_preempt_deferred_qs()") in my -rcu tree and in -next, which I intend
> >to push into the next merge window.
>
> Thanks, I confirm it fixes the issue.
>
> Do you intend to push it into 4.20-rc3 or do you mean 4.21 ?

The next merge window, which will be either v4.21 or v5.0. The v4.20
merge window is over and done. ;-)

Please note that the gcc command-line arguments used by the Linux kernel
prevent the compiler from taking advantage of the C-standard signed
integer overflow aspect of undefined behavior, so this is a aesthetic
issue rather than a failure case. Plus the C++ standards committee just
voted in a change that gets rid of signed integer overflow completely.
It is not clear whether the C language will also make this change, but
it does require that the usual compilers have the ability to operate in
this manner.

Thanx, Paul

> Christophe
>
> > Thanx, Paul
> >
> >>Thanks
> >>Christophe
> >>
> >>[ 4.919995] ================================================================================
> >>[ 4.928428] UBSAN: Undefined behaviour in kernel/rcu/tree_plugin.h:623:28
> >>[ 4.935198] signed integer overflow:
> >>[ 4.938766] 0 - -2147483648 cannot be represented in type 'int'
> >>[ 4.944678] CPU: 0 PID: 119 Comm: mkdir Not tainted
> >>4.19.0-rc1-s3k-dev-00005-g5a60513 #214
> >>[ 4.952908] Call Trace:
> >>[ 4.955382] [dec4fd20] [c02cb0d0] ubsan_epilogue+0x18/0x74 (unreliable)
> >>[ 4.962003] [dec4fd30] [c02cb5e0] handle_overflow+0xd0/0xe0
> >>[ 4.967588] [dec4fdb0] [c007b424] rcu_preempt_deferred_qs+0xc0/0xc8
> >>[ 4.973857] [dec4fdd0] [c007be28] rcu_note_context_switch+0x74/0x608
> >>[ 4.980217] [dec4fe10] [c064b790] __schedule+0x58/0x6e0
> >>[ 4.985448] [dec4fe50] [c064bfdc] preempt_schedule_common+0x48/0x9c
> >>[ 4.991717] [dec4fe70] [c01308c8] handle_mm_fault+0x10fc/0x1ecc
> >>[ 4.997639] [dec4fee0] [c001339c] do_page_fault+0x10c/0x760
> >>[ 5.003225] [dec4ff40] [c001234c] handle_page_fault+0x14/0x40
> >>[ 5.008968] --- interrupt: 401 at 0xff9cff8
> >>[ 5.008968] LR = 0xfeefd78
> >>[ 5.016170] ================================================================================
> >>[ 5.024591] ================================================================================
> >>[ 5.033005] UBSAN: Undefined behaviour in kernel/rcu/tree_plugin.h:627:28
> >>[ 5.039775] signed integer overflow:
> >>[ 5.043342] -2147483648 + -2147483648 cannot be represented in type 'int'
> >>[ 5.050118] CPU: 0 PID: 119 Comm: mkdir Not tainted
> >>4.19.0-rc1-s3k-dev-00005-g5a60513 #214
> >>[ 5.058348] Call Trace:
> >>[ 5.060813] [dec4fd20] [c02cb0d0] ubsan_epilogue+0x18/0x74 (unreliable)
> >>[ 5.067433] [dec4fd30] [c02cb5e0] handle_overflow+0xd0/0xe0
> >>[ 5.073014] [dec4fdb0] [c007b408] rcu_preempt_deferred_qs+0xa4/0xc8
> >>[ 5.079283] [dec4fdd0] [c007be28] rcu_note_context_switch+0x74/0x608
> >>[ 5.085640] [dec4fe10] [c064b790] __schedule+0x58/0x6e0
> >>[ 5.090871] [dec4fe50] [c064bfdc] preempt_schedule_common+0x48/0x9c
> >>[ 5.097139] [dec4fe70] [c01308c8] handle_mm_fault+0x10fc/0x1ecc
> >>[ 5.103059] [dec4fee0] [c001339c] do_page_fault+0x10c/0x760
> >>[ 5.108642] [dec4ff40] [c001234c] handle_page_fault+0x14/0x40
> >>[ 5.114385] --- interrupt: 401 at 0xff9cff8
> >>[ 5.114385] LR = 0xfeefd78
> >>[ 5.121588] ================================================================================
> >>
>