[BUG] UBSAN: shift-out-of-bounds in dm_integrity_map

[Farhad Alemi]

Hello,

As part of the kernel research at ASU's SEFCOM
lab, we hit the crash below. Crash reports can be found here:

  https://github.com/farhad-alemi/public_bug_reports/tree/main/193-ubsan-shift-out-of-bounds-in-dm-integrity-map/

  UBSAN: shift-out-of-bounds in drivers/md/dm-integrity.c:2106:52
  shift exponent 138 is too large for 32-bit type 'unsigned int'
  Call Trace:
   dm_integrity_map+0xe14/0xfe0 drivers/md/dm-integrity.c:2106
   __map_bio+0x5e8/0xa60 drivers/md/dm.c:1426
   __split_and_process_bio drivers/md/dm.c:1760 [inline]
   dm_split_and_process_bio drivers/md/dm.c:2034 [inline]
   dm_submit_bio+0x73f/0x2900 drivers/md/dm.c:2090
   __submit_bio+0x475/0x880 block/blk-core.c:644
   submit_bio_noacct_nocheck+0x467/0x990 block/blk-core.c:755
   __block_write_full_folio+0x7ee/0xdc0 fs/buffer.c:1830
   blkdev_writepages+0xef/0x1b0 block/fops.c:486
  Kernel panic - not syncing: UBSAN: panic_on_warn set ...

Our reproducer.c is available upon request.

Happy to test a patch if that would help.

Regards,