[BUG] UBSAN: shift-out-of-bounds in dln2_spi_probe

[Farhad Alemi]

Hello,

We are reporting the following crash (reproducer and a proposed patch attached):

Linux version 7.3.0-rc2 50d05c7c76c96b90462f24debacca971d2e86713
Build Config: UpstreamAppArmorKASAN (KASAN + UBSAN, panic_on_warn=1)

[   50.563179][  T987] usb 3-1: new high-speed USB device number 2
using dummy_hcd
[   50.724668][  T987] usb 3-1: New USB device found, idVendor=a257,
idProduct=2013, bcdDevice= 1.00
[   50.728082][  T987] usb 3-1: New USB device strings: Mfr=0,
Product=0, SerialNumber=0
[   50.757406][  T987] dln2 3-1:1.0: Diolan DLN2 serial 0
[   50.763502][  T987] gpiochip_add_data_with_key: GPIOs 0..-1 (dln2)
failed to register, -22
[   50.763517][  T987] dln2-gpio dln2-gpio.2.auto: failed to add gpio chip: -22
[   50.763525][  T987] dln2-gpio dln2-gpio.2.auto: probe with driver
dln2-gpio failed with error -22
[   50.789064][  T987] ------------[ cut here ]------------
[   50.789071][  T987] UBSAN: shift-out-of-bounds in
drivers/spi/spi-dln2.c:179:15
[   50.789083][  T987] shift exponent 18446744073709543487 is too
large for 64-bit type 'typeof(unsigned long)' (aka 'unsigned long')
[   50.789098][  T987] CPU: 1 UID: 0 PID: 987 Comm: kworker/1:3 Not
tainted 7.3.0-rc2-00099-g50d05c7c76c9 #1 PREEMPT(full)
[   50.789108][  T987] Hardware name: QEMU Standard PC (Q35 + ICH9,
2009), BIOS 1.17.0-debian-1.17.0-1ubuntu1 04/01/2014
[   50.789114][  T987] Workqueue: usb_hub_wq hub_event
[   50.791092][  T987] Call Trace:
[   50.791098][  T987]  <TASK>
[   50.791106][  T987]  dump_stack_lvl+0xe8/0x150
[   50.791118][  T987]  ubsan_epilogue+0xa/0x30
[   50.791129][  T987]  __ubsan_handle_shift_out_of_bounds+0x385/0x410
[
** replaying previous printk message **
[   50.791149][  T987]  dln2_spi_probe+0x104d/0x13c0
[   50.791165][  T987]  ? __pfx_dln2_spi_probe+0x10/0x10
[   50.791178][  T987]  ? up_write+0x1a5/0x4a0
[   50.791189][  T987]  ? kernfs_put+0x77b/0x7e0
[   50.791200][  T987]  ? acpi_has_method+0x20/0xe0
[   50.791211][  T987]  ? dev_pm_domain_attach+0xbd/0xf0
[   50.791222][  T987]  ? __pfx_dln2_spi_probe+0x10/0x10
[   50.791232][  T987]  platform_probe+0xf9/0x190
[   50.791241][  T987]  ? __pfx_platform_probe+0x10/0x10
[   50.791248][  T987]  really_probe+0x267/0xaf0
[   50.791259][  T987]  __driver_probe_device+0x1e2/0x350
[   50.791269][  T987]  driver_probe_device+0x4f/0x240
[   50.791279][  T987]  __device_attach_driver+0x270/0x410
[   50.791290][  T987]  bus_for_each_drv+0x258/0x2f0
[   50.791301][  T987]  ? __pfx___device_attach_driver+0x10/0x10
[   50.791310][  T987]  ? __pfx_bus_for_each_drv+0x10/0x10
[   50.791321][  T987]  ? _raw_spin_unlock_irqrestore+0x4c/0x80
[   50.792223][  T987]  __device_attach+0x2c5/0x450
[   50.792233][  T987]  ? __pfx___device_attach+0x10/0x10
[   50.792243][  T987]  ? _raw_spin_unlock+0x28/0x50
[   50.792254][  T987]  device_initial_probe+0xa1/0xd0
[   50.792263][  T987]  bus_probe_device+0x12a/0x220
[   50.792275][  T987]  device_add+0x7ec/0xb90
[   50.792285][  T987]  platform_device_add+0x46a/0x800
[   50.792296][  T987]  ? __asan_memcpy+0x40/0x70
[   50.792311][  T987]  mfd_add_devices+0x125c/0x17c0
[   50.792322][  T987]  ? __dev_printk+0x131/0x190
[   50.792339][  T987]  ? __pfx_mfd_add_devices+0x10/0x10
[   50.792353][  T987]  ? dln2_hw_init+0x25c/0x270
[   50.792362][  T987]  ? __pfx_dln2_hw_init+0x10/0x10
[   50.792374][  T987]  dln2_probe+0xef9/0xfd0
[   50.792383][  T987]  ? __pfx_do_raw_spin_lock+0x10/0x10
[   50.792398][  T987]  ? __pfx_dln2_probe+0x10/0x10
[   50.792406][  T987]  ? _raw_spin_unlock_irqrestore+0x4c/0x80
[   50.792416][  T987]  ? __pm_runtime_set_status+0x9d4/0xcd0
[   50.792428][  T987]  usb_probe_interface+0x71f/0xe00
[   50.792443][  T987]  ? __pfx_usb_probe_interface+0x10/0x10
[   50.792457][  T987]  ? driver_sysfs_add+0x1fe/0x210
[   50.792466][  T987]  ? __pfx_usb_probe_interface+0x10/0x10
[   50.792475][  T987]  really_probe+0x267/0xaf0
[   50.792486][  T987]  __driver_probe_device+0x1e2/0x350
[   50.792496][  T987]  driver_probe_device+0x4f/0x240
[   50.792506][  T987]  __device_attach_driver+0x270/0x410
[   50.792517][  T987]  bus_for_each_drv+0x258/0x2f0
[   50.792527][  T987]  ? __pfx___device_attach_driver+0x10/0x10
[   50.792536][  T987]  ? __pfx_bus_for_each_drv+0x10/0x10
[   50.792548][  T987]  ? _raw_spin_unlock_irqrestore+0x4c/0x80
[   50.792560][  T987]  __device_attach+0x2c5/0x450
[   50.792569][  T987]  ? __pfx___device_attach+0x10/0x10
[   50.792579][  T987]  ? _raw_spin_unlock+0x28/0x50
[   50.792590][  T987]  device_initial_probe+0xa1/0xd0
[   50.792599][  T987]  bus_probe_device+0x12a/0x220
[   50.792611][  T987]  device_add+0x7ec/0xb90
[   50.792621][  T987]  usb_set_configuration+0x1a87/0x2110
[   50.792642][  T987]  usb_generic_driver_probe+0x8d/0x150
[   50.792652][  T987]  usb_probe_device+0x1c4/0x3b0
[   50.792664][  T987]  ? __pfx_usb_probe_device+0x10/0x10
[   50.792673][  T987]  really_probe+0x267/0xaf0
[   50.792684][  T987]  __driver_probe_device+0x1e2/0x350
[   50.792694][  T987]  driver_probe_device+0x4f/0x240
[   50.792704][  T987]  __device_attach_driver+0x270/0x410
[   50.792714][  T987]  bus_for_each_drv+0x258/0x2f0
[   50.792724][  T987]  ? __pfx___device_attach_driver+0x10/0x10
[   50.792733][  T987]  ? __pfx_bus_for_each_drv+0x10/0x10
[   50.792745][  T987]  ? _raw_spin_unlock_irqrestore+0x4c/0x80
[   50.792756][  T987]  __device_attach+0x2c5/0x450
[   50.792766][  T987]  ? __pfx___device_attach+0x10/0x10
[   50.792776][  T987]  ? _raw_spin_unlock+0x28/0x50
[   50.792786][  T987]  device_initial_probe+0xa1/0xd0
[   50.792796][  T987]  bus_probe_device+0x12a/0x220
[   50.792807][  T987]  device_add+0x7ec/0xb90
[   50.792817][  T987]  usb_new_device+0xa14/0x1720
[   50.792830][  T987]  ? __pfx_usb_new_device+0x10/0x10
[   50.792840][  T987]  ? _raw_spin_unlock_irq+0x23/0x50
[   50.792851][  T987]  hub_event+0x2a1c/0x4f30
[   50.792860][  T987]  ? do_raw_spin_unlock+0xf5/0x200
[   50.792888][  T987]  ? __pfx_hub_event+0x10/0x10
[   50.792901][  T987]  ? process_scheduled_works+0x94e/0x1900
[   50.792913][  T987]  ? process_scheduled_works+0x94e/0x1900
[   50.792923][  T987]  ? process_scheduled_works+0x94e/0x1900
[   50.792935][  T987]  process_scheduled_works+0xc99/0x1900
[   50.792959][  T987]  ? __pfx_process_scheduled_works+0x10/0x10
[   50.792973][  T987]  ? assign_work+0x3d5/0x5e0
[   50.792987][  T987]  worker_thread+0xa53/0xfc0
[   50.793006][  T987]  kthread+0x38b/0x480
[   50.793015][  T987]  ? __pfx_worker_thread+0x10/0x10
[   50.793022][  T987]  ? __pfx_kthread+0x10/0x10
[   50.793031][  T987]  ret_from_fork+0x514/0xb70
[   50.793042][  T987]  ? __pfx_ret_from_fork+0x10/0x10
[   50.793086][  T987]  ? __switch_to+0xc79/0x1410
[   50.793096][  T987]  ? __pfx_kthread+0x10/0x10
[   50.793106][  T987]  ret_from_fork_asm+0x1a/0x30
[   50.793123][  T987]  </TASK>
[   50.800603][  T987] ---[ end trace ]---
[   50.800625][  T987] Kernel panic - not syncing: UBSAN: panic_on_warn set ...
[   50.853815][  T987] CPU: 1 UID: 0 PID: 987 Comm: kworker/1:3 Not
tainted 7.3.0-rc2-00099-g50d05c7c76c9 #1 PREEMPT(full)
[   50.854873][  T987] Hardware name: QEMU Standard PC (Q35 + ICH9,
2009), BIOS 1.17.0-debian-1.17.0-1ubuntu1 04/01/2014
[   50.855914][  T987] Workqueue: usb_hub_wq hub_event
[   50.856422][  T987] Call Trace:
[   50.856764][  T987]  <TASK>
[   50.857132][  T987]  vpanic+0x56d/0xa60
[   50.857549][  T987]  ? __pfx_vpanic+0x10/0x10
[   50.858014][  T987]  ? irqentry_exit+0x218/0x760
[   50.858498][  T987]  panic+0xc5/0xd0
[   50.858872][  T987]  ? __pfx_panic+0x10/0x10
[   50.859323][  T987]  ? __pfx__printk+0x10/0x10
[   50.859785][  T987]  check_panic_on_warn+0x89/0xb0
[   50.860298][  T987]  __ubsan_handle_shift_out_of_bounds+0x385/0x410
[   50.860938][  T987]  dln2_spi_probe+0x104d/0x13c0
[   50.861434][  T987]  ? __pfx_dln2_spi_probe+0x10/0x10
[   50.861950][  T987]  ? up_write+0x1a5/0x4a0
[   50.862387][  T987]  ? kernfs_put+0x77b/0x7e0
[   50.862841][  T987]  ? acpi_has_method+0x20/0xe0
[   50.863325][  T987]  ? dev_pm_domain_attach+0xbd/0xf0
[   50.863841][  T987]  ? __pfx_dln2_spi_probe+0x10/0x10
[   50.864370][  T987]  platform_probe+0xf9/0x190
[   50.864838][  T987]  ? __pfx_platform_probe+0x10/0x10
[   50.865355][  T987]  really_probe+0x267/0xaf0
[   50.865868][  T987]  __driver_probe_device+0x1e2/0x350
[   50.866498][  T987]  driver_probe_device+0x4f/0x240
[   50.867121][  T987]  __device_attach_driver+0x270/0x410
[   50.867757][  T987]  bus_for_each_drv+0x258/0x2f0
[   50.868376][  T987]  ? __pfx___device_attach_driver+0x10/0x10
[   50.868990][  T987]  ? __pfx_bus_for_each_drv+0x10/0x10
[   50.869559][  T987]  ? _raw_spin_unlock_irqrestore+0x4c/0x80
[   50.870253][  T987]  __device_attach+0x2c5/0x450
[   50.870822][  T987]  ? __pfx___device_attach+0x10/0x10
[   50.871465][  T987]  ? _raw_spin_unlock+0x28/0x50
[   50.872043][  T987]  device_initial_probe+0xa1/0xd0
[   50.872619][  T987]  bus_probe_device+0x12a/0x220
[   50.873137][  T987]  device_add+0x7ec/0xb90
[   50.873595][  T987]  platform_device_add+0x46a/0x800
[   50.874110][  T987]  ? __asan_memcpy+0x40/0x70
[   50.874573][  T987]  mfd_add_devices+0x125c/0x17c0
[   50.875072][  T987]  ? __dev_printk+0x131/0x190
[   50.875546][  T987]  ? __pfx_mfd_add_devices+0x10/0x10
[   50.876076][  T987]  ? dln2_hw_init+0x25c/0x270
[   50.876543][  T987]  ? __pfx_dln2_hw_init+0x10/0x10
[   50.877172][  T987]  dln2_probe+0xef9/0xfd0
[   50.877622][  T987]  ? __pfx_do_raw_spin_lock+0x10/0x10
[   50.878200][  T987]  ? __pfx_dln2_probe+0x10/0x10
[   50.878718][  T987]  ? _raw_spin_unlock_irqrestore+0x4c/0x80
[   50.879294][  T987]  ? __pm_runtime_set_status+0x9d4/0xcd0
[   50.879850][  T987]  usb_probe_interface+0x71f/0xe00
[   50.880399][  T987]  ? __pfx_usb_probe_interface+0x10/0x10
[   50.880986][  T987]  ? driver_sysfs_add+0x1fe/0x210
[   50.881526][  T987]  ? __pfx_usb_probe_interface+0x10/0x10
[   50.882095][  T987]  really_probe+0x267/0xaf0
[   50.882548][  T987]  __driver_probe_device+0x1e2/0x350
[   50.883073][  T987]  driver_probe_device+0x4f/0x240
[   50.883573][  T987]  __device_attach_driver+0x270/0x410
[   50.884141][  T987]  bus_for_each_drv+0x258/0x2f0
[   50.884656][  T987]  ? __pfx___device_attach_driver+0x10/0x10
[   50.885280][  T987]  ? __pfx_bus_for_each_drv+0x10/0x10
[   50.885833][  T987]  ? _raw_spin_unlock_irqrestore+0x4c/0x80
[   50.886446][  T987]  __device_attach+0x2c5/0x450
[   50.886950][  T987]  ? __pfx___device_attach+0x10/0x10
[   50.887564][  T987]  ? _raw_spin_unlock+0x28/0x50
[   50.888047][  T987]  device_initial_probe+0xa1/0xd0
[   50.888568][  T987]  bus_probe_device+0x12a/0x220
[   50.889062][  T987]  device_add+0x7ec/0xb90
[   50.889499][  T987]  usb_set_configuration+0x1a87/0x2110
[   50.890070][  T987]  usb_generic_driver_probe+0x8d/0x150
[   50.890610][  T987]  usb_probe_device+0x1c4/0x3b0
[   50.891161][  T987]  ? __pfx_usb_probe_device+0x10/0x10
[   50.891711][  T987]  really_probe+0x267/0xaf0
[   50.892200][  T987]  __driver_probe_device+0x1e2/0x350
[   50.892750][  T987]  driver_probe_device+0x4f/0x240
[   50.893307][  T987]  __device_attach_driver+0x270/0x410
[   50.893839][  T987]  bus_for_each_drv+0x258/0x2f0
[   50.894328][  T987]  ? __pfx___device_attach_driver+0x10/0x10
[   50.894910][  T987]  ? __pfx_bus_for_each_drv+0x10/0x10
[   50.895450][  T987]  ? _raw_spin_unlock_irqrestore+0x4c/0x80
[   50.896027][  T987]  __device_attach+0x2c5/0x450
[   50.896514][  T987]  ? __pfx___device_attach+0x10/0x10
[   50.897117][  T987]  ? _raw_spin_unlock+0x28/0x50
[   50.897603][  T987]  device_initial_probe+0xa1/0xd0
[   50.898107][  T987]  bus_probe_device+0x12a/0x220
[   50.898591][  T987]  device_add+0x7ec/0xb90
[   50.899061][  T987]  usb_new_device+0xa14/0x1720
[   50.899569][  T987]  ? __pfx_usb_new_device+0x10/0x10
[   50.900123][  T987]  ? _raw_spin_unlock_irq+0x23/0x50
[   50.900638][  T987]  hub_event+0x2a1c/0x4f30
[   50.901089][  T987]  ? do_raw_spin_unlock+0xf5/0x200
[   50.901613][  T987]  ? __pfx_hub_event+0x10/0x10
[   50.902109][  T987]  ? process_scheduled_works+0x94e/0x1900
[   50.902674][  T987]  ? process_scheduled_works+0x94e/0x1900
[   50.903247][  T987]  ? process_scheduled_works+0x94e/0x1900
[   50.903810][  T987]  process_scheduled_works+0xc99/0x1900
[   50.904376][  T987]  ? __pfx_process_scheduled_works+0x10/0x10
[   50.904968][  T987]  ? assign_work+0x3d5/0x5e0
[   50.905442][  T987]  worker_thread+0xa53/0xfc0
[   50.905917][  T987]  kthread+0x38b/0x480
[   50.906331][  T987]  ? __pfx_worker_thread+0x10/0x10
[   50.906838][  T987]  ? __pfx_kthread+0x10/0x10
[   50.907416][  T987]  ret_from_fork+0x514/0xb70
[   50.907877][  T987]  ? __pfx_ret_from_fork+0x10/0x10
[   50.908401][  T987]  ? __switch_to+0xc79/0x1410
[   50.908858][  T987]  ? __pfx_kthread+0x10/0x10
[   50.909334][  T987]  ret_from_fork_asm+0x1a/0x30
[   50.909818][  T987]  </TASK>
[   50.910402][  T987] Kernel Offset: disabled
[   50.910950][  T987] Rebooting in 86400 seconds..

Regards,
SEFCOM Lab @ ASU

Attachment: 213.patch
Description: Binary data

Attachment: reproducer.c
Description: Binary data