Received-SPF: pass (google.com: domain of linux-kernel+bounces-45595-linux.lists.archive=gmail.com@vger.kernel.org designates 147.75.80.249 as permitted sender) client-ip=147.75.80.249;
Date: Wed, 31 Jan 2024 09:34:19 +0800
From: Oliver Sang <oliver.sang@intel.com>
To: Kees Cook <keescook@chromium.org>
CC: <oe-lkp@lists.linux.dev>, <lkp@intel.com>, Justin Stitt
	<justinstitt@google.com>, Miguel Ojeda <ojeda@kernel.org>, Nathan Chancellor
	<nathan@kernel.org>, Nick Desaulniers <ndesaulniers@google.com>, "Peter
 Zijlstra" <peterz@infradead.org>, Marco Elver <elver@google.com>, Hao Luo
	<haoluo@google.com>, Przemek Kitszel <przemyslaw.kitszel@intel.com>,
	<workflows@vger.kernel.org>, <linux-kernel@vger.kernel.org>,
	<linux-kbuild@vger.kernel.org>, <oliver.sang@intel.com>
Subject: Re: [kees:devel/overflow/sanitizers] [overflow] 660787b56e:
 UBSAN:signed-integer-overflow_in_lib/test_memcat_p.c
Message-ID: <ZbmjmyoGGmGNaLbN@xsang-OptiPlex-9020>
References: <202401302219.db90a6d5-oliver.sang@intel.com>
 <202401301604.7B7BD5664@keescook>
Content-Type: text/plain; charset="us-ascii"
Content-Disposition: inline
In-Reply-To: <202401301604.7B7BD5664@keescook>
Precedence: bulk
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?yqsyxbP9YS9XJmQ1U0RzGkhbWwI4q1fvGUp8QsdLKotvF9w9AgoRPVqjMEV1?=
 =?us-ascii?Q?5dmxZpx3j9W0H+lZPDGuVMxCrAqvFLL1QdPnnnq/qrUkB7wfA4+OFsk3JqeL?=
 =?us-ascii?Q?w0uJMph52qtVdn/n/ggBT5u0wiAV8vZBugY8hut9t0K2EXu3+7+AYxJ/8VLT?=
 =?us-ascii?Q?d5fPRnb+FN4/vFX1bVufGdF2+xC4AJllFshfnBs0r+Q3YYtL8JHdKZB76P2O?=
 =?us-ascii?Q?55nRBaYiHduKgf13kNZmvWaX3uFdiWUhOUhqKpKtjS5K1dlBXKUMHCFPtrWn?=
 =?us-ascii?Q?gq/+5j1kigCv5ufX5JO1ctbuHKe5aUahFVJoAbtX1hT6nDl75G5ygXnw6mHO?=
 =?us-ascii?Q?NW/+ze1NhzTdESZfk+gSirDGwL29K4psSrUpc9QbnXTlFXa8QNPXYPAFOLV/?=
 =?us-ascii?Q?u0R5YRQJieAwMc6X3NbmrcOoZ0rwUH5/gy2nu9p+LV212tpBoUUcOw68KcZe?=
 =?us-ascii?Q?hkgRD4BxrKm65WNujgcah7gQ4TnLLg+zUxZkVH5N1d+kso25RWw2xSglZC1A?=
 =?us-ascii?Q?WmhLNNQYvjoQJCGGbpZuJEq+R2Zprj6B8HNrkrfhCVGelamAD4EGYMPbHtND?=
 =?us-ascii?Q?kYBLiGVUqPiZ+oZeWqOxYPp+6JESME6l1A5O9HgK+JMxzjXQvUM1tyGqhdAh?=
 =?us-ascii?Q?4f+MXGhZetsctxWtGWw+0zLiGdndQdheqQWuJ36pXdfOOMIevABFZrTD01IQ?=
 =?us-ascii?Q?rvHZu0n0AcbJB3ECVRM++a6XQVTkrEBpZr3Q8s/2I0ZwkqXaSI6xsp0RdEdG?=
 =?us-ascii?Q?w2LcNrrgEgt6YG/hBzEmNTn5IX3UNAWqOQT+f4+MPZJi+hjfma5owiwM/9Ak?=
 =?us-ascii?Q?2Uy8qv/nqwjczx0hBO8VTOAuLAvEgtK/Q+pHVn9ds7ND+prDWO0l0mIx+fm+?=
 =?us-ascii?Q?wBdj9UbqzjKBnXVo2PCvMif+F3NnOdtdw31v+kDQTbPex7cWr3Mhopo3q6Tr?=
 =?us-ascii?Q?mZdD6G7b4vpo0s1uHLjlJQP+Onm2RJv1Z5b8aYpz9MDoLV1hA8N6Anbq3BHS?=
 =?us-ascii?Q?VXYSC66aCD/7c0tmLDTt3vygpvZjqY4ZAN7XGsCfSejKgxv104+H2k+QGr6F?=
 =?us-ascii?Q?qFsRiXbY5ZNP+R9dkxZeLUn0t6S/emREl1w7k3RQSNjdI/nwcwV4ES0fuGMu?=
 =?us-ascii?Q?pl3SZ5kcJwsTpkaLqXMbu1RDEmvPv1RVVH5Cbw2YvnMCF0hvoTrWc5h2zjjK?=
 =?us-ascii?Q?3sT95QTODSgIF2J7ZEdLQGrpCbfNlzuj5YNZqLhywIvIFkDI/eGmhrmXaoer?=
 =?us-ascii?Q?SGMfdNxOl+T0yvFYlRnkC+bDCsloiLOEutfh4BFHDG1b9qBhEo9XMj/+dJgE?=
 =?us-ascii?Q?9YGne0QaE9Pdm0taE7XmuIjKY6X4xKOARoYchtJd83iUUq+GIYux5E/8nBLV?=
 =?us-ascii?Q?Gv1pQXDIx9C+DZh0rxOG7l0qZ4xOJ99DaFpdBGNi5pSE6H6ewT8uK7QHYqPH?=
 =?us-ascii?Q?7UAM1LlS4JJfhLIu64yuZaErn3KjfEkGUTEl4KmG5X7DuqDzPcz65fqff6Y2?=
 =?us-ascii?Q?i2hDN/zUPx2VTLSus6NhzPJwaYJ8WNuzZi+Zy0LpqLPuyyRGuMmOYAVWhQoA?=
 =?us-ascii?Q?nCN0B0rMxIRysCywPLrxV+lKb6mSeaKNZcpF+yvDwr3ADOnMn2fix/f6VBGG?=
 =?us-ascii?Q?tA=3D=3D?=
X-MS-Exchange-CrossTenant-Network-Message-Id: 5e3bd7c6-120d-414a-915c-08dc21fcc46d
X-MS-Exchange-CrossTenant-AuthSource: LV3PR11MB8603.namprd11.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 31 Jan 2024 01:34:29.1875
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 46c98d88-e344-4ed4-8496-4ed7712e255d
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: aAF0+HuvRuq8TENy8691ZfK+iNpYiuQMD58OJAJkt0DwRcG2o10nbqAD14M4czwkkHGsXvZ0lUHlN01xe0jtmw==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: CH0PR11MB5428
X-OriginatorOrg: intel.com

hi, Kees,

On Tue, Jan 30, 2024 at 04:23:06PM -0800, Kees Cook wrote:
> On Tue, Jan 30, 2024 at 10:52:56PM +0800, kernel test robot wrote:
> > 

..
 
> > while testing, we observed below different (and same part) between parent and
> > this commit:
> > 
> > ea804316c9db5148 660787b56e6e97ddc34c7882cbe
> > ---------------- ---------------------------
> >        fail:runs  %reproduction    fail:runs
> >            |             |             |
> >           6:6            0%           6:6     dmesg.UBSAN:shift-out-of-bounds_in_arch/x86/kernel/cpu/intel.c
> >           6:6            0%           6:6     dmesg.UBSAN:shift-out-of-bounds_in_arch/x86/kernel/cpu/topology.c
> >           6:6            0%           6:6     dmesg.UBSAN:shift-out-of-bounds_in_fs/namespace.c
> >           6:6            0%           6:6     dmesg.UBSAN:shift-out-of-bounds_in_fs/read_write.c
> >           6:6            0%           6:6     dmesg.UBSAN:shift-out-of-bounds_in_include/linux/rhashtable.h
> >           6:6            0%           6:6     dmesg.UBSAN:shift-out-of-bounds_in_include/net/tcp.h
> 
> Are these shift-out-of-bounds warnings new?

no, they also happen on parent commit.

thanks a lot for all guildance!

> 
> >            :6          100%           6:6     dmesg.UBSAN:signed-integer-overflow_in_lib/test_memcat_p.c
> 
> This is new for sure, catching an issue you show below...
> 
> > this looks like the commit uncovered issue. but since it's hard for us to back
> > port this commit to each commit while bisecting, we cannot capture the real
> > first bad commit. not sure if this report could help somebody to investigate
> > the real issue?
> 
> Yeah, I think there is an unexpected wrap-around in test_memcat_p.c:
> 
> > If you fix the issue in a separate patch/commit (i.e. not just a new version of
> > the same patch/commit), kindly add following tags
> > | Reported-by: kernel test robot <oliver.sang@intel.com>
> > | Closes: https://lore.kernel.org/oe-lkp/202401302219.db90a6d5-oliver.sang@intel.com
> > 
> > 
> > [   42.894536][    T1] ------------[ cut here ]------------
> > [   42.895474][    T1] UBSAN: signed-integer-overflow in lib/test_memcat_p.c:47:10
> > [   42.897128][    T1] 6570 * 725861 cannot be represented in type 'int'
> 
> I'm surprised to see the sanitizer catching anything here since the
> kernel is built with -fno-strict-overflow, but regardless, I'll send a
> patch...
> 
> -Kees
> 
> -- 
> Kees Cook