From: Breno Leitao <leitao@debian.org>
To: Tejun Heo <tj@kernel.org>, Josef Bacik <josef@toxicpanda.com>,
Jens Axboe <axboe@kernel.dk>
Cc: leit@meta.com,
cgroups@vger.kernel.org (open list:CONTROL GROUP - BLOCK IO
CONTROLLER (BLKIO)),
linux-block@vger.kernel.org (open list:CONTROL GROUP - BLOCK IO
CONTROLLER (BLKIO)), linux-kernel@vger.kernel.org (open list)
Subject: [PATCH] blk-iocost: Fix shift-out-of-bounds in iocg_kick_delay()
Date: Wed, 10 Apr 2024 12:36:41 -0700 [thread overview]
Message-ID: <20240410193642.1303741-1-leitao@debian.org> (raw)
When running iocg_kick_delay(), iocg->delay_at could be way behind "now",
which causes a huge tdelta difference.
The tdelta value is used to shift some bits around, raising the
following UBSAN splat:
UBSAN: shift-out-of-bounds in block/blk-iocost.c:1366:23
Debugging this, these are some values I got in my machine with 6.9-rc3.
now = 3626064295
iocg->delay_at = 3275794093
Fix this by validating that the shift if valid, otherwise bail out,
similarly to commit 2a427b49d029 ("blk-iocost: Fix an UBSAN
shift-out-of-bounds warning")
Signed-off-by: Breno Leitao <leitao@debian.org>
---
block/blk-iocost.c | 9 +++++++--
1 file changed, 7 insertions(+), 2 deletions(-)
diff --git a/block/blk-iocost.c b/block/blk-iocost.c
index 9a85bfbbc45a..398fe19db4ca 100644
--- a/block/blk-iocost.c
+++ b/block/blk-iocost.c
@@ -1347,7 +1347,7 @@ static bool iocg_kick_delay(struct ioc_gq *iocg, struct ioc_now *now)
{
struct ioc *ioc = iocg->ioc;
struct blkcg_gq *blkg = iocg_to_blkg(iocg);
- u64 tdelta, delay, new_delay;
+ u64 tdelta, delay, new_delay, shift;
s64 vover, vover_pct;
u32 hwa;
@@ -1362,8 +1362,13 @@ static bool iocg_kick_delay(struct ioc_gq *iocg, struct ioc_now *now)
/* calculate the current delay in effect - 1/2 every second */
tdelta = now->now - iocg->delay_at;
+
+ shift = div64_u64(tdelta, USEC_PER_SEC);
+ if (shift >= BITS_PER_LONG)
+ return false;
+
if (iocg->delay)
- delay = iocg->delay >> div64_u64(tdelta, USEC_PER_SEC);
+ delay = iocg->delay >> shift;
else
delay = 0;
--
2.43.0
next reply other threads:[~2024-04-10 19:36 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-04-10 19:36 Breno Leitao [this message]
2024-04-10 19:53 ` [PATCH] blk-iocost: Fix shift-out-of-bounds in iocg_kick_delay() Tejun Heo
2024-04-11 13:33 ` Breno Leitao
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20240410193642.1303741-1-leitao@debian.org \
--to=leitao@debian.org \
--cc=axboe@kernel.dk \
--cc=cgroups@vger.kernel.org \
--cc=josef@toxicpanda.com \
--cc=leit@meta.com \
--cc=linux-block@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=tj@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).