Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751153AbdFAMEP (ORCPT ); Thu, 1 Jun 2017 08:04:15 -0400 Received: from szxga01-in.huawei.com ([45.249.212.187]:7299 "EHLO szxga01-in.huawei.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750952AbdFAMEO (ORCPT ); Thu, 1 Jun 2017 08:04:14 -0400 Message-ID: <59300285.6090105@huawei.com> Date: Thu, 1 Jun 2017 20:03:17 +0800 From: Xishi Qiu User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:12.0) Gecko/20120428 Thunderbird/12.0.1 MIME-Version: 1.0 To: LKML , Thomas Gleixner , Ingo Molnar , , Peter Zijlstra Subject: [RFC] ubsan: signed integer overflow in setitimer() Content-Type: text/plain; charset="ISO-8859-1" Content-Transfer-Encoding: 7bit X-Originating-IP: [10.177.25.179] X-CFilter-Loop: Reflected X-Mirapoint-Virus-RAPID-Raw: score=unknown(0), refid=str=0001.0A020202.5930028F.026E,ss=1,re=0.000,recu=0.000,reip=0.000,cl=1,cld=1,fgs=0, ip=0.0.0.0, so=2014-11-16 11:51:01, dmn=2013-03-21 17:37:32 X-Mirapoint-Loop-Id: b31e23c9aa633eca5b06f8c701ad07d8 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 5222 Lines: 100 Hi, this is the test case, and then I got ubsan error (signed integer overflow) report, so the root cause is from user or kernel? Shall we change something in timeval_valid()? struct itimerval new_value; int ret; new_value.it_interval.tv_sec = 140673496649799L; new_value.it_interval.tv_usec = 6; new_value.it_value.tv_sec = 140673496649807L; new_value.it_value.tv_usec = 5; ret = setitimer(ITIMER_VIRTUAL, &new_value, NULL); [ 533.326588] ================================================================================ [ 533.335346] UBSAN: Undefined behaviour in ./include/linux/time.h:239:27 [ 533.342155] signed integer overflow: [ 533.345837] 140673496649807 * 1000000000 cannot be represented in type 'long int' [ 533.353540] CPU: 102 PID: 17797 Comm: test.exe Tainted: G B 4.12.0-rc3-327.44.58.18.x86_64+ #30 [ 533.363646] Hardware name: Huawei Technologies Co., Ltd. RH8100 V3/BC61PBIA, BIOS BLHSV028 11/11/2014 [ 533.373130] Call Trace: [ 533.375670] dump_stack+0xbc/0x124 [ 533.379179] ? _atomic_dec_and_lock+0x14c/0x14c [ 533.383850] ubsan_epilogue+0xd/0x4e [ 533.387531] handle_overflow+0x186/0x1d5 [ 533.391571] ? __ubsan_handle_negate_overflow+0x15b/0x15b [ 533.397133] ? unlock_page+0x20/0x60 [ 533.400815] ? filemap_map_pages+0x3e8/0x820 [ 533.405211] ? read_cache_page_gfp+0x80/0x80 [ 533.409613] ? tty_ldisc_deref+0x28/0x40 [ 533.413653] ? tty_write+0x344/0x560 [ 533.417335] __ubsan_handle_mul_overflow+0xe/0x19 [ 533.422181] set_cpu_itimer+0x49c/0x540 [ 533.426132] ? get_cpu_itimer+0x290/0x290 [ 533.430271] ? __getnstimeofday64+0x14c/0x210 [ 533.434762] ? __pmd_alloc+0x1b0/0x1b0 [ 533.438623] ? ktime_get+0xd0/0xd0 [ 533.442127] do_setitimer+0xe1/0x540 [ 533.445817] ? __audit_syscall_entry+0x1cd/0x250 [ 533.450571] SyS_setitimer+0x1d6/0x210 [ 533.454431] ? SyS_alarm+0x150/0x150 [ 533.463453] ? trace_event_raw_event_sys_enter+0x590/0x590 [ 533.474508] ? handle_mm_fault+0x15a/0x530 [ 533.484144] ? __do_page_fault+0x3c9/0x740 [ 533.493712] ? SyS_alarm+0x150/0x150 [ 533.502553] do_syscall_64+0xf5/0x2a0 [ 533.511294] ? do_syscall_64+0xf5/0x2a0 [ 533.520031] entry_SYSCALL64_slow_path+0x25/0x25 [ 533.529410] RIP: 0033:0x7f32bbd71c67 [ 533.537565] RSP: 002b:00007ffe9b18df08 EFLAGS: 00000202 ORIG_RAX: 0000000000000026 [ 533.549766] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f32bbd71c67 [ 533.561530] RDX: 0000000000000000 RSI: 00007ffe9b18df30 RDI: 0000000000000001 [ 533.573237] RBP: 00007ffe9b18df60 R08: 00007f32bbd09d38 R09: 0000000000000012 [ 533.584794] R10: 00007ffe9b18dc90 R11: 0000000000000202 R12: 0000000000400490 [ 533.596218] R13: 00007ffe9b18e040 R14: 0000000000000000 R15: 0000000000000000 [ 533.607450] ================================================================================ [ 533.620059] ================================================================================ [ 533.632565] UBSAN: Undefined behaviour in ./include/linux/time.h:239:27 [ 533.643357] signed integer overflow: [ 533.651093] 140673496649799 * 1000000000 cannot be represented in type 'long int' [ 533.662927] CPU: 102 PID: 17797 Comm: test.exe Tainted: G B 4.12.0-rc3-327.44.58.18.x86_64+ #30 [ 533.681691] Hardware name: Huawei Technologies Co., Ltd. RH8100 V3/BC61PBIA, BIOS BLHSV028 11/11/2014 [ 533.700314] Call Trace: [ 533.707469] dump_stack+0xbc/0x124 [ 533.715588] ? _atomic_dec_and_lock+0x14c/0x14c [ 533.724911] ubsan_epilogue+0xd/0x4e [ 533.733281] handle_overflow+0x186/0x1d5 [ 533.741952] ? __ubsan_handle_negate_overflow+0x15b/0x15b [ 533.752190] ? unlock_page+0x20/0x60 [ 533.760592] ? filemap_map_pages+0x3e8/0x820 [ 533.769709] ? read_cache_page_gfp+0x80/0x80 [ 533.778844] ? tty_ldisc_deref+0x28/0x40 [ 533.787641] ? tty_write+0x344/0x560 [ 533.796126] __ubsan_handle_mul_overflow+0xe/0x19 [ 533.805696] set_cpu_itimer+0x438/0x540 [ 533.814412] ? get_cpu_itimer+0x290/0x290 [ 533.823259] ? __getnstimeofday64+0x14c/0x210 [ 533.832504] ? __pmd_alloc+0x1b0/0x1b0 [ 533.841082] ? ktime_get+0xd0/0xd0 [ 533.849294] do_setitimer+0xe1/0x540 [ 533.857675] ? __audit_syscall_entry+0x1cd/0x250 [ 533.867146] SyS_setitimer+0x1d6/0x210 [ 533.875731] ? SyS_alarm+0x150/0x150 [ 533.884099] ? trace_event_raw_event_sys_enter+0x590/0x590 [ 533.894388] ? handle_mm_fault+0x15a/0x530 [ 533.903209] ? __do_page_fault+0x3c9/0x740 [ 533.911953] ? SyS_alarm+0x150/0x150 [ 533.920154] do_syscall_64+0xf5/0x2a0 [ 533.928504] ? do_syscall_64+0xf5/0x2a0 [ 533.936997] entry_SYSCALL64_slow_path+0x25/0x25 [ 533.946160] RIP: 0033:0x7f32bbd71c67 [ 533.954353] RSP: 002b:00007ffe9b18df08 EFLAGS: 00000202 ORIG_RAX: 0000000000000026 [ 533.966657] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f32bbd71c67 [ 533.978452] RDX: 0000000000000000 RSI: 00007ffe9b18df30 RDI: 0000000000000001 [ 533.990192] RBP: 00007ffe9b18df60 R08: 00007f32bbd09d38 R09: 0000000000000012 [ 534.001811] R10: 00007ffe9b18dc90 R11: 0000000000000202 R12: 0000000000400490 [ 534.013274] R13: 00007ffe9b18e040 R14: 0000000000000000 R15: 0000000000000000 [ 534.024538] ================================================================================