[RFC] ubsan: signed integer overflow in setitimer()
From: Xishi Qiu
Date: Thu Jun 01 2017 - 08:04:19 EST
Hi, this is the test case, and then I got ubsan error
(signed integer overflow) report, so the root cause is from
user or kernel? Shall we change something in timeval_valid()?
struct itimerval new_value;
int ret;
new_value.it_interval.tv_sec = 140673496649799L;
new_value.it_interval.tv_usec = 6;
new_value.it_value.tv_sec = 140673496649807L;
new_value.it_value.tv_usec = 5;
ret = setitimer(ITIMER_VIRTUAL, &new_value, NULL);
[ 533.326588] ================================================================================
[ 533.335346] UBSAN: Undefined behaviour in ./include/linux/time.h:239:27
[ 533.342155] signed integer overflow:
[ 533.345837] 140673496649807 * 1000000000 cannot be represented in type 'long int'
[ 533.353540] CPU: 102 PID: 17797 Comm: test.exe Tainted: G B 4.12.0-rc3-327.44.58.18.x86_64+ #30
[ 533.363646] Hardware name: Huawei Technologies Co., Ltd. RH8100 V3/BC61PBIA, BIOS BLHSV028 11/11/2014
[ 533.373130] Call Trace:
[ 533.375670] dump_stack+0xbc/0x124
[ 533.379179] ? _atomic_dec_and_lock+0x14c/0x14c
[ 533.383850] ubsan_epilogue+0xd/0x4e
[ 533.387531] handle_overflow+0x186/0x1d5
[ 533.391571] ? __ubsan_handle_negate_overflow+0x15b/0x15b
[ 533.397133] ? unlock_page+0x20/0x60
[ 533.400815] ? filemap_map_pages+0x3e8/0x820
[ 533.405211] ? read_cache_page_gfp+0x80/0x80
[ 533.409613] ? tty_ldisc_deref+0x28/0x40
[ 533.413653] ? tty_write+0x344/0x560
[ 533.417335] __ubsan_handle_mul_overflow+0xe/0x19
[ 533.422181] set_cpu_itimer+0x49c/0x540
[ 533.426132] ? get_cpu_itimer+0x290/0x290
[ 533.430271] ? __getnstimeofday64+0x14c/0x210
[ 533.434762] ? __pmd_alloc+0x1b0/0x1b0
[ 533.438623] ? ktime_get+0xd0/0xd0
[ 533.442127] do_setitimer+0xe1/0x540
[ 533.445817] ? __audit_syscall_entry+0x1cd/0x250
[ 533.450571] SyS_setitimer+0x1d6/0x210
[ 533.454431] ? SyS_alarm+0x150/0x150
[ 533.463453] ? trace_event_raw_event_sys_enter+0x590/0x590
[ 533.474508] ? handle_mm_fault+0x15a/0x530
[ 533.484144] ? __do_page_fault+0x3c9/0x740
[ 533.493712] ? SyS_alarm+0x150/0x150
[ 533.502553] do_syscall_64+0xf5/0x2a0
[ 533.511294] ? do_syscall_64+0xf5/0x2a0
[ 533.520031] entry_SYSCALL64_slow_path+0x25/0x25
[ 533.529410] RIP: 0033:0x7f32bbd71c67
[ 533.537565] RSP: 002b:00007ffe9b18df08 EFLAGS: 00000202 ORIG_RAX: 0000000000000026
[ 533.549766] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f32bbd71c67
[ 533.561530] RDX: 0000000000000000 RSI: 00007ffe9b18df30 RDI: 0000000000000001
[ 533.573237] RBP: 00007ffe9b18df60 R08: 00007f32bbd09d38 R09: 0000000000000012
[ 533.584794] R10: 00007ffe9b18dc90 R11: 0000000000000202 R12: 0000000000400490
[ 533.596218] R13: 00007ffe9b18e040 R14: 0000000000000000 R15: 0000000000000000
[ 533.607450] ================================================================================
[ 533.620059] ================================================================================
[ 533.632565] UBSAN: Undefined behaviour in ./include/linux/time.h:239:27
[ 533.643357] signed integer overflow:
[ 533.651093] 140673496649799 * 1000000000 cannot be represented in type 'long int'
[ 533.662927] CPU: 102 PID: 17797 Comm: test.exe Tainted: G B 4.12.0-rc3-327.44.58.18.x86_64+ #30
[ 533.681691] Hardware name: Huawei Technologies Co., Ltd. RH8100 V3/BC61PBIA, BIOS BLHSV028 11/11/2014
[ 533.700314] Call Trace:
[ 533.707469] dump_stack+0xbc/0x124
[ 533.715588] ? _atomic_dec_and_lock+0x14c/0x14c
[ 533.724911] ubsan_epilogue+0xd/0x4e
[ 533.733281] handle_overflow+0x186/0x1d5
[ 533.741952] ? __ubsan_handle_negate_overflow+0x15b/0x15b
[ 533.752190] ? unlock_page+0x20/0x60
[ 533.760592] ? filemap_map_pages+0x3e8/0x820
[ 533.769709] ? read_cache_page_gfp+0x80/0x80
[ 533.778844] ? tty_ldisc_deref+0x28/0x40
[ 533.787641] ? tty_write+0x344/0x560
[ 533.796126] __ubsan_handle_mul_overflow+0xe/0x19
[ 533.805696] set_cpu_itimer+0x438/0x540
[ 533.814412] ? get_cpu_itimer+0x290/0x290
[ 533.823259] ? __getnstimeofday64+0x14c/0x210
[ 533.832504] ? __pmd_alloc+0x1b0/0x1b0
[ 533.841082] ? ktime_get+0xd0/0xd0
[ 533.849294] do_setitimer+0xe1/0x540
[ 533.857675] ? __audit_syscall_entry+0x1cd/0x250
[ 533.867146] SyS_setitimer+0x1d6/0x210
[ 533.875731] ? SyS_alarm+0x150/0x150
[ 533.884099] ? trace_event_raw_event_sys_enter+0x590/0x590
[ 533.894388] ? handle_mm_fault+0x15a/0x530
[ 533.903209] ? __do_page_fault+0x3c9/0x740
[ 533.911953] ? SyS_alarm+0x150/0x150
[ 533.920154] do_syscall_64+0xf5/0x2a0
[ 533.928504] ? do_syscall_64+0xf5/0x2a0
[ 533.936997] entry_SYSCALL64_slow_path+0x25/0x25
[ 533.946160] RIP: 0033:0x7f32bbd71c67
[ 533.954353] RSP: 002b:00007ffe9b18df08 EFLAGS: 00000202 ORIG_RAX: 0000000000000026
[ 533.966657] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f32bbd71c67
[ 533.978452] RDX: 0000000000000000 RSI: 00007ffe9b18df30 RDI: 0000000000000001
[ 533.990192] RBP: 00007ffe9b18df60 R08: 00007f32bbd09d38 R09: 0000000000000012
[ 534.001811] R10: 00007ffe9b18dc90 R11: 0000000000000202 R12: 0000000000400490
[ 534.013274] R13: 00007ffe9b18e040 R14: 0000000000000000 R15: 0000000000000000
[ 534.024538] ================================================================================