Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754516AbdIFNiY (ORCPT ); Wed, 6 Sep 2017 09:38:24 -0400 Received: from outprodmail01.cc.columbia.edu ([128.59.72.39]:58710 "EHLO outprodmail01.cc.columbia.edu" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753034AbdIFNiX (ORCPT ); Wed, 6 Sep 2017 09:38:23 -0400 X-Google-Smtp-Source: ADKCNb54WpYPYNR+I/azQOtMkNa5e2H7FPcxF2cbeQQ5QdWSyC9wYqTgXVqg+OBqmqLTgMOHU7DlcXx65w94HYARgYw= MIME-Version: 1.0 From: Shankara Pailoor Date: Wed, 6 Sep 2017 09:38:19 -0400 Message-ID: Subject: UBSAN undefined behavior in arch/x86/include/futex.h To: linux-kernel@vger.kernel.org Cc: mingo@redhat.com, tglx@linutronix.de, hpa@zytor.com, syzkaller Content-Type: text/plain; charset="UTF-8" X-No-Spam-Score: Local Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1481 Lines: 35 Hi, I encountered this bug in kernel 4.13-rc7 while fuzzing with Syzkaller: ================================================================================ UBSAN: Undefined behaviour in ./arch/x86/include/asm/futex.h:53:13 shift exponent -1 is negative CPU: 0 PID: 8469 Comm: syz-executor2 Not tainted 4.13.0-rc7 #2 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:16 [inline] dump_stack+0xf7/0x1ae lib/dump_stack.c:52 ubsan_epilogue+0x12/0x8f lib/ubsan.c:164 __ubsan_handle_shift_out_of_bounds+0x2b2/0x32c lib/ubsan.c:421 futex_atomic_op_inuser arch/x86/include/asm/futex.h:53 [inline] futex_wake_op kernel/futex.c:1577 [inline] do_futex+0x1a7f/0x2600 kernel/futex.c:3404 SYSC_futex kernel/futex.c:3454 [inline] SyS_futex+0x285/0x380 kernel/futex.c:3422 entry_SYSCALL_64_fastpath+0x18/0xad RIP: 0033:0x451e59 RSP: 002b:00007f6cbefecc08 EFLAGS: 00000216 ORIG_RAX: 00000000000000ca RAX: ffffffffffffffda RBX: 0000000000718000 RCX: 0000000000451e59 RDX: 0000000000000000 RSI: 8000000000000005 RDI: 0000000020005000 RBP: 0000000000000046 R08: 0000000020005ffc R09: fffffffffffffffe R10: 0000000020005ff0 R11: 0000000000000216 R12: 0000000000000000 R13: 00007ffe5d358caf R14: 00007f6cbefed9c0 R15: 0000000000000000 ================================================================================ Here is the link to the repro program: https://pastebin.com/RDX3q4nM Regards, Shankara