[syzbot] UBSAN: shift-out-of-bounds in profile_init

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: 3dbdb38e Merge branch 'for-5.14' of git://git.kernel.org/p..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=11342328300000
kernel config: https://syzkaller.appspot.com/x/.config?x=a1fcf15a09815757
dashboard link: https://syzkaller.appspot.com/bug?extid=e68c89a9510c159d9684
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=149a96d2300000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=114e5bc4300000

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+e68c89...@syzkaller.appspotmail.com

kernel profiling enabled (shift: 1000000)
================================================================================
UBSAN: shift-out-of-bounds in kernel/profile.c:110:31
shift exponent 1000000 is too large for 64-bit type 'long int'
CPU: 0 PID: 8453 Comm: syz-executor969 Tainted: G W 5.13.0-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:79 [inline]
dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:96
ubsan_epilogue+0xb/0x5a lib/ubsan.c:148
__ubsan_handle_shift_out_of_bounds.cold+0xb1/0x181 lib/ubsan.c:327
profile_init+0xfc/0x110 kernel/profile.c:110
profiling_store+0x5e/0xd0 kernel/ksysfs.c:80
kobj_attr_store+0x50/0x80 lib/kobject.c:856
sysfs_kf_write+0x110/0x160 fs/sysfs/file.c:139
kernfs_fop_write_iter+0x342/0x500 fs/kernfs/file.c:296
call_write_iter include/linux/fs.h:2114 [inline]
new_sync_write+0x426/0x650 fs/read_write.c:518
vfs_write+0x796/0xa30 fs/read_write.c:605
ksys_write+0x12d/0x250 fs/read_write.c:658
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x43ee69
Code: 28 c3 e8 2a 14 00 00 66 2e 0f 1f 84 00 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffee8801868 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 0000000000400488 RCX: 000000000043ee69
RDX: 00000000ffffff82 RSI: 00000000200000c0 RDI: 0000000000000003
RBP: 0000000000402e50 R08: 0000000000000000 R09: 0000000000400488
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000402ee0
R13: 0000000000000000 R14: 00000000004ac018 R15: 0000000000400488
================================================================================


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot can test patches for this issue, for details see:
https://goo.gl/tpsmEJ#testing-patches

[Pavel Skripkin]

I believe, something like this should fix it:


diff --git a/kernel/ksysfs.c b/kernel/ksysfs.c
index 35859da8bd4f..ca075d9f671a 100644
--- a/kernel/ksysfs.c
+++ b/kernel/ksysfs.c
@@ -76,7 +76,9 @@ static ssize_t profiling_store(struct kobject *kobj,
* has a ton of callers and is not const. It is
* easiest to cast it away here.
*/
- profile_setup((char *)buf);
+ ret = profile_setup((char *)buf);
+ if (!ret)
+ return -EINVAL;
ret = profile_init();
if (ret)
return ret;
diff --git a/kernel/profile.c b/kernel/profile.c
index c2ebddb5e974..5c61677030f4 100644
--- a/kernel/profile.c
+++ b/kernel/profile.c
@@ -42,6 +42,7 @@ struct profile_hit {

static atomic_t *prof_buffer;
static unsigned long prof_len, prof_shift;
+#define MAX_PROF_SHIFT sizeof(prof_shift) * 8

int prof_on __read_mostly;
EXPORT_SYMBOL_GPL(prof_on);
@@ -66,8 +67,11 @@ int profile_setup(char *str)
prof_on = SLEEP_PROFILING;
if (str[strlen(sleepstr)] == ',')
str += strlen(sleepstr) + 1;
- if (get_option(&str, &par))
+ if (get_option(&str, &par)) {
+ if (par >= MAX_PROF_SHIFT)
+ return 0;
prof_shift = par;
+ }
pr_info("kernel sleep profiling enabled (shift: %ld)\n",
prof_shift);
#else
@@ -77,19 +81,27 @@ int profile_setup(char *str)
prof_on = SCHED_PROFILING;
if (str[strlen(schedstr)] == ',')
str += strlen(schedstr) + 1;
- if (get_option(&str, &par))
+ if (get_option(&str, &par)) {
+ if (par >= MAX_PROF_SHIFT)
+ return 0;
prof_shift = par;
+ }
pr_info("kernel schedule profiling enabled (shift: %ld)\n",
prof_shift);
} else if (!strncmp(str, kvmstr, strlen(kvmstr))) {
prof_on = KVM_PROFILING;
if (str[strlen(kvmstr)] == ',')
str += strlen(kvmstr) + 1;
- if (get_option(&str, &par))
+ if (get_option(&str, &par)) {
+ if (par >= MAX_PROF_SHIFT)
+ return 0;
prof_shift = par;
+ }
pr_info("kernel KVM profiling enabled (shift: %ld)\n",
prof_shift);
} else if (get_option(&str, &par)) {
+ if (par >= MAX_PROF_SHIFT)
+ return 0;
prof_shift = par;
prof_on = CPU_PROFILING;
pr_info("kernel profiling enabled (shift: %ld)\n",



But this function can be called not only from sysfs and I can't
understand will my patch break something or not. And, I think, error
message is needed somewhere here to inform callers about wrong shift
value.


Thoughts?


--
With regards,
Pavel Skripkin

[Pavel Skripkin]

On Wed, 14 Jul 2021 05:47:21 -0700
syzbot <syzbot+e68c89...@syzkaller.appspotmail.com> wrote:

> Hello,
>
> syzbot found the following issue on:
>
> HEAD commit: 3dbdb38e Merge branch 'for-5.14' of
> git://git.kernel.org/p.. git tree: upstream
> console output:
> https://syzkaller.appspot.com/x/log.txt?x=11342328300000 kernel
> config: https://syzkaller.appspot.com/x/.config?x=a1fcf15a09815757
> dashboard link:
> https://syzkaller.appspot.com/bug?extid=e68c89a9510c159d9684 syz
> repro:
> https://syzkaller.appspot.com/x/repro.syz?x=149a96d2300000 C
> reproducer: https://syzkaller.appspot.com/x/repro.c?x=114e5bc4300000
>
> IMPORTANT: if you fix the issue, please add the following tag to the
> commit: Reported-by:
> syzbot+e68c89...@syzkaller.appspotmail.com
>

#syz test
git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master



With regards,
Pavel Skripkin

[Tetsuo Handa]

On 2021/07/16 21:24, Pavel Skripkin wrote:
> But this function can be called not only from sysfs and I can't
> understand will my patch break something or not. And, I think, error
> message is needed somewhere here to inform callers about wrong shift
> value.
>
>
> Thoughts?

Subsequent profiling_store() attempts will return -EEXIST if
profile_setup() once set prof_on to non-zero value. Therefore,
if you try to return -EINVAL when profile_setup() returns 0,
you need to make sure that prof_on is set to non-zero value
only if prof_shift is valid.

But, the userspace might not be aware of the value of MAX_PROF_SHIFT
because it is an architecture dependent value, and par might become negative
value because get_option() accepts negative value. Therefore, it might be
better to

+ par = clamp(par, 0, MAX_PROF_SHIFT - 1);

than

+ if (par < 0 || par >= MAX_PROF_SHIFT)
+ return 0;

.

[Pavel Skripkin]

Yes, this sounds much better, thank you. I will send reworked patch to
syzbot. Do you mind if I add

Suggested-by: Tetsuo Handa <penguin...@i-love.sakura.ne.jp>

tag to final patch?



With regards,
Pavel Skripkin

[Pavel Skripkin]

On Wed, 14 Jul 2021 05:47:21 -0700
syzbot <syzbot+e68c89...@syzkaller.appspotmail.com> wrote:

> Hello,
>
> syzbot found the following issue on:
>
> HEAD commit: 3dbdb38e Merge branch 'for-5.14' of
> git://git.kernel.org/p.. git tree: upstream
> console output:
> https://syzkaller.appspot.com/x/log.txt?x=11342328300000 kernel
> config: https://syzkaller.appspot.com/x/.config?x=a1fcf15a09815757
> dashboard link:
> https://syzkaller.appspot.com/bug?extid=e68c89a9510c159d9684 syz
> repro:
> https://syzkaller.appspot.com/x/repro.syz?x=149a96d2300000 C
> reproducer: https://syzkaller.appspot.com/x/repro.c?x=114e5bc4300000
>
> IMPORTANT: if you fix the issue, please add the following tag to the
> commit: Reported-by:
> syzbot+e68c89...@syzkaller.appspotmail.com
>

With clamp() call suggested by Tetsuo

[syzbot]

Hello,

syzbot has tested the proposed patch and the reproducer did not trigger any issue:

Reported-and-tested-by: syzbot+e68c89...@syzkaller.appspotmail.com

Tested on:

commit: d936eb23 Revert "Makefile: Enable -Wimplicit-fallthrou..
git tree: upstream
kernel config: https://syzkaller.appspot.com/x/.config?x=7d53336580099d6
dashboard link: https://syzkaller.appspot.com/bug?extid=e68c89a9510c159d9684
compiler:
patch: https://syzkaller.appspot.com/x/patch.diff?x=16750fe2300000

Note: testing is done by a robot and is best-effort only.

[syzbot]

Hello,

syzbot has tested the proposed patch and the reproducer did not trigger any issue:

Reported-and-tested-by: syzbot+e68c89...@syzkaller.appspotmail.com

Tested on:

commit: d936eb23 Revert "Makefile: Enable -Wimplicit-fallthrou..
git tree: upstream
kernel config: https://syzkaller.appspot.com/x/.config?x=7d53336580099d6
dashboard link: https://syzkaller.appspot.com/bug?extid=e68c89a9510c159d9684
compiler:

patch: https://syzkaller.appspot.com/x/patch.diff?x=108cb7d2300000