From: Sam Sun <samsun1006219@gmail.com>
To: Bart Van Assche <bvanassche@acm.org>
Cc: linux-kernel@vger.kernel.org, linux-scsi@vger.kernel.org,
martin.petersen@oracle.com, jejb@linux.ibm.com,
dgilbert@interlog.com, syzkaller@googlegroups.com,
xrivendell7@gmail.com
Subject: Re: [Bug] UBSAN: shift-out-of-bounds in sg_build_indirect
Date: Sun, 14 Apr 2024 00:36:29 +0800 [thread overview]
Message-ID: <CAEkJfYMCj69qnsU-UmPu1Csu1smvS9arYJP386WsbfXH9WgR_g@mail.gmail.com> (raw)
In-Reply-To: <2ab31b48-5f89-4ada-848d-89b844f6a6f5@acm.org>
On Sat, Apr 13, 2024 at 6:49 AM Bart Van Assche <bvanassche@acm.org> wrote:
>
> On 4/10/24 6:17 PM, Sam Sun wrote:
> > On Wed, Apr 10, 2024 at 12:59 AM Bart Van Assche <bvanassche@acm.org> wrote:
> >>
> >> On 4/9/24 05:51, Sam Sun wrote:
> >>> We further analyzed the root cause of this bug. In function
> >>> sg_build_indirect of drivers/scsi/sg.c, variable order of line 1900 is
> >>> calculated out using get_order(num), and num comes from
> >>> scatter_elem_sz. If scatter_elem_sz is equal or below zero, the order
> >>> returned will be 52, so that PAGE_SHIFT + order is 64, which is larger
> >>> than 32 bits int range, causing shift-out-of bound. This bug is tested
> >>> and still remains in the latest upstream linux (6.9-rc3).
> >>> If you have any questions, please contact us.
> >>
> >> Thank you for having root-caused this issue and also for having shared
> >> your root-cause analysis. Do you perhaps plan to post a patch that fixes
> >> this issue?
> >
> > Sure, I am glad to help! But it is my first time submitting a patch, I
> > need to find some instructions. I would appreciate if you could help
> > me out. Also, I need to double check the patch to avoid introducing a
> > new one. It might take some time.
>
> The process for contributing a patch is as follows:
> 1. Clone the Linux kernel tree for the subsystem you want to contribute
> to. For SCSI, this is the for-next branch in
> git://git.kernel.org/pub/scm/linux/kernel/git/mkp/scsi.git
> 2. Make your changes to the code.
> 3. Commit your changes (git commit -as), chose a patch title and explain
> what has been changed and also why.
> 4. Convert your changes into a patch, e.g. by running this command:
> git format-patch -1
> 5. Check the patch with scripts/checkpatch.pl.
> 6. Send your patch with git send-email to Martin Petersen and Cc the
> linux-scsi mailing list.
>
> More information is available here:
> https://docs.kernel.org/process/submitting-patches.html
>
> Best regards,
>
> Bart.
Thanks for your help! I will follow the instructions and submit the
patch as soon as possible.
Best Regards,
Yue
prev parent reply other threads:[~2024-04-13 16:36 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-03-25 12:57 [Bug] UBSAN: shift-out-of-bounds in sg_build_indirect Sam Sun
2024-04-09 12:51 ` Sam Sun
2024-04-09 16:59 ` Bart Van Assche
2024-04-11 1:17 ` Sam Sun
2024-04-12 22:49 ` Bart Van Assche
2024-04-13 16:36 ` Sam Sun [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=CAEkJfYMCj69qnsU-UmPu1Csu1smvS9arYJP386WsbfXH9WgR_g@mail.gmail.com \
--to=samsun1006219@gmail.com \
--cc=bvanassche@acm.org \
--cc=dgilbert@interlog.com \
--cc=jejb@linux.ibm.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-scsi@vger.kernel.org \
--cc=martin.petersen@oracle.com \
--cc=syzkaller@googlegroups.com \
--cc=xrivendell7@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).