Received-SPF: pass (google.com: domain of linux-kernel+bounces-143417-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:45d1:ec00::1 as permitted sender) client-ip=2604:1380:45d1:ec00::1;
Message-ID: <2ab31b48-5f89-4ada-848d-89b844f6a6f5@acm.org>
Date: Fri, 12 Apr 2024 15:49:24 -0700
Precedence: bulk
MIME-Version: 1.0
User-Agent: Mozilla Thunderbird
Subject: Re: [Bug] UBSAN: shift-out-of-bounds in sg_build_indirect
To: Sam Sun <samsun1006219@gmail.com>
Cc: linux-kernel@vger.kernel.org, linux-scsi@vger.kernel.org,
 martin.petersen@oracle.com, jejb@linux.ibm.com, dgilbert@interlog.com,
 syzkaller@googlegroups.com, xrivendell7@gmail.com
References: <CAEkJfYOs-szTK0rYvDw5UNGfzbTG_7RvjqFOZA=c6LXvxdUt2g@mail.gmail.com>
 <CAEkJfYMcdmXAhe9oTpEPGL+_661PNAvM58Y+irwnbLW8FKohNw@mail.gmail.com>
 <2d5e3b6c-3a66-4f74-8367-51fa55bf0a1a@acm.org>
 <CAEkJfYMcLycLfaRzhn=DmQjAuLHn29wSXN0b0Zf0oJr=sDVBTg@mail.gmail.com>
Content-Language: en-US
From: Bart Van Assche <bvanassche@acm.org>
In-Reply-To: <CAEkJfYMcLycLfaRzhn=DmQjAuLHn29wSXN0b0Zf0oJr=sDVBTg@mail.gmail.com>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: quoted-printable

On 4/10/24 6:17 PM, Sam Sun wrote:
> On Wed, Apr 10, 2024 at 12:59=E2=80=AFAM Bart Van Assche <bvanassche@ac=
m.org> wrote:
>>
>> On 4/9/24 05:51, Sam Sun wrote:
>>> We further analyzed the root cause of this bug. In function
>>> sg_build_indirect of drivers/scsi/sg.c, variable order of line 1900 i=
s
>>> calculated out using get_order(num), and num comes from
>>> scatter_elem_sz. If scatter_elem_sz is equal or below zero, the order
>>> returned will be 52, so that PAGE_SHIFT + order is 64, which is large=
r
>>> than 32 bits int range, causing shift-out-of bound. This bug is teste=
d
>>> and still remains in the latest upstream linux (6.9-rc3).
>>> If you have any questions, please contact us.
>>
>> Thank you for having root-caused this issue and also for having shared
>> your root-cause analysis. Do you perhaps plan to post a patch that fix=
es
>> this issue?
>=20
> Sure, I am glad to help! But it is my first time submitting a patch, I
> need to find some instructions. I would appreciate if you could help
> me out. Also, I need to double check the patch to avoid introducing a
> new one. It might take some time.

The process for contributing a patch is as follows:
1. Clone the Linux kernel tree for the subsystem you want to contribute
    to. For SCSI, this is the for-next branch in
    git://git.kernel.org/pub/scm/linux/kernel/git/mkp/scsi.git
2. Make your changes to the code.
3. Commit your changes (git commit -as), chose a patch title and explain
    what has been changed and also why.
4. Convert your changes into a patch, e.g. by running this command:
      git format-patch -1
5. Check the patch with scripts/checkpatch.pl.
6. Send your patch with git send-email to Martin Petersen and Cc the
    linux-scsi mailing list.

More information is available here:
https://docs.kernel.org/process/submitting-patches.html

Best regards,

Bart.