Received-SPF: pass (google.com: domain of linux-kernel+bounces-137359-linux.lists.archive=gmail.com@vger.kernel.org designates 147.75.80.249 as permitted sender) client-ip=147.75.80.249;
Message-ID: <2d5e3b6c-3a66-4f74-8367-51fa55bf0a1a@acm.org>
Date: Tue, 9 Apr 2024 09:59:18 -0700
Precedence: bulk
MIME-Version: 1.0
User-Agent: Mozilla Thunderbird
Subject: Re: [Bug] UBSAN: shift-out-of-bounds in sg_build_indirect
Content-Language: en-US
To: Sam Sun <samsun1006219@gmail.com>, linux-kernel@vger.kernel.org
Cc: linux-scsi@vger.kernel.org, martin.petersen@oracle.com,
 jejb@linux.ibm.com, dgilbert@interlog.com, syzkaller@googlegroups.com,
 xrivendell7@gmail.com
References: <CAEkJfYOs-szTK0rYvDw5UNGfzbTG_7RvjqFOZA=c6LXvxdUt2g@mail.gmail.com>
 <CAEkJfYMcdmXAhe9oTpEPGL+_661PNAvM58Y+irwnbLW8FKohNw@mail.gmail.com>
From: Bart Van Assche <bvanassche@acm.org>
In-Reply-To: <CAEkJfYMcdmXAhe9oTpEPGL+_661PNAvM58Y+irwnbLW8FKohNw@mail.gmail.com>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit

On 4/9/24 05:51, Sam Sun wrote:
> We further analyzed the root cause of this bug. In function
> sg_build_indirect of drivers/scsi/sg.c, variable order of line 1900 is
> calculated out using get_order(num), and num comes from
> scatter_elem_sz. If scatter_elem_sz is equal or below zero, the order
> returned will be 52, so that PAGE_SHIFT + order is 64, which is larger
> than 32 bits int range, causing shift-out-of bound. This bug is tested
> and still remains in the latest upstream linux (6.9-rc3).
> If you have any questions, please contact us.

Thank you for having root-caused this issue and also for having shared
your root-cause analysis. Do you perhaps plan to post a patch that fixes
this issue?

Thanks,

Bart.