UBSAN: shift-out-of-bounds in adjust_reg_min_max_vals

Status: auto-obsoleted due to no activity on 2024/04/09 17:10
Subsystems: bpf
[Documentation on labels]
Reported-by: syzbot+46700eea57ecc7f84776@syzkaller.appspotmail.com
First crash: 986d, last: 972d
Cause bisection: introduced by (bisect log) :
commit f63181b6ae79fd3b034cde641db774268c2c3acf
Author: Andrii Nakryiko <andrii@kernel.org>
Date: Fri Nov 4 16:36:47 2022 +0000

  bpf: stop setting precise in current state

Crash: UBSAN: shift-out-of-bounds in adjust_reg_min_max_vals (log)
Repro: C syz .config
  
Fix bisection: fixed by (bisect log) :
commit 96381879a370425a30b810906946f64c0726450e
Author: Andrii Nakryiko <andrii@kernel.org>
Date: Sun Nov 12 01:05:58 2023 +0000

  bpf: generalize is_scalar_branch_taken() logic

  
▶ ▼ Discussions (2)
Title Replies (including bot) Last reply
[syzbot] [bpf?] UBSAN: shift-out-of-bounds in adjust_reg_min_max_vals 0 (2) 2024/02/08 08:42
[syzbot] Monthly bpf report (Jan 2024) 1 (2) 2024/01/10 00:28
▶ ▼ Last patch testing requests (3)
Created Duration User Patch Repo Result
2024/03/10 17:12 2h00m retest repro bpf no crash log
2024/01/14 21:22 22m retest repro net no crash log
2023/12/31 16:51 17m retest repro bpf report log

Sample crash report:
================================================================================
UBSAN: shift-out-of-bounds in kernel/bpf/verifier.c:13571:63
shift exponent 1073741824 is too large for 32-bit type 'int'
CPU: 0 PID: 5070 Comm: syz-executor380 Not tainted 6.7.0-rc4-syzkaller-00156-g117211aa739a #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x125/0x1b0 lib/dump_stack.c:106
 ubsan_epilogue lib/ubsan.c:217 [inline]
 __ubsan_handle_shift_out_of_bounds+0x2a6/0x480 lib/ubsan.c:387
 scalar32_min_max_arsh kernel/bpf/verifier.c:13571 [inline]
 adjust_scalar_min_max_vals kernel/bpf/verifier.c:13759 [inline]
 adjust_reg_min_max_vals.cold+0x162/0x221 kernel/bpf/verifier.c:13860
 check_alu_op+0x498/0x3a60 kernel/bpf/verifier.c:14092
 do_check kernel/bpf/verifier.c:17517 [inline]
 do_check_common+0x1b30/0xd690 kernel/bpf/verifier.c:20177
 do_check_main kernel/bpf/verifier.c:20240 [inline]
 bpf_check+0x77d9/0xa5e0 kernel/bpf/verifier.c:20877
 bpf_prog_load+0x1531/0x2200 kernel/bpf/syscall.c:2716
 __sys_bpf+0xbf7/0x4920 kernel/bpf/syscall.c:5383
 __do_sys_bpf kernel/bpf/syscall.c:5487 [inline]
 __se_sys_bpf kernel/bpf/syscall.c:5485 [inline]
 __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5485
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0x40/0x110 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x63/0x6b
RIP: 0033:0x7fd3d5716af9
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 c1 17 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffe74d76228 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fd3d5716af9
RDX: 0000000000000048 RSI: 00000000200054c0 RDI: 0000000000000005
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000006
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000003a28
R13: 431bde82d7b634db R14: 0000000000000001 R15: 0000000000000001
 </TASK>
================================================================================

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2023/12/17 16:43 bpf 117211aa739a 3222d10c .config strace log report syz C [disk image] [vmlinux] [kernel image] ci-upstream-bpf-kasan-gce UBSAN: shift-out-of-bounds in adjust_reg_min_max_vals
2023/12/17 16:38 net b1dfc0f76231 3222d10c .config strace log report syz C [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce UBSAN: shift-out-of-bounds in adjust_reg_min_max_vals
* Struck through repros no longer work on HEAD.