Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

UBSAN: shift-out-of-bounds in module/zfs/zio_inject.c:151:56 #13146

Closed
szubersk opened this issue Feb 23, 2022 · 0 comments
Closed

UBSAN: shift-out-of-bounds in module/zfs/zio_inject.c:151:56 #13146

szubersk opened this issue Feb 23, 2022 · 0 comments
Labels
Type: Defect Incorrect behavior (e.g. crash, hang)

Comments

@szubersk
Copy link
Contributor

System information

Type Version/Name
Distribution Name Debian
Distribution Version bookworm
Kernel Version 5.15.24-ubsan
Architecture amd64
OpenZFS Version zfs-2.1.99-854_ga5b3fab34 zfs-kmod-2.1.99-854_ga5b3fab34

Describe the problem you're observing

[  145.237718] UBSAN: shift-out-of-bounds in /tmp/zfs-build-debian-eSXcoSWU/BUILD/zfs-kmod-2.1.99/_kmod_build_5.15.24-ubsan/../zfs-2.1.99/module/zfs/zio_inject.c:151:56
[  145.258609] shift exponent -1 is negative
[  145.265517] CPU: 3 PID: 4976 Comm: z_rd_int_1 Tainted: P           OE     5.15.24-ubsan #2
[  145.265522] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
[  145.265659] Call Trace:
[  145.265904]  <TASK>
[  145.266192]  dump_stack_lvl+0x46/0x5a
[  145.266477]  ubsan_epilogue+0x5/0x40
[  145.266480]  __ubsan_handle_shift_out_of_bounds.cold+0x61/0xe9
[  145.266496]  ? vdev_config_generate_stats+0x381/0x4a0 [zfs]
[  145.269484]  zio_match_handler.cold+0x1d/0x31 [zfs]
[  145.269484]  zio_handle_fault_injection+0xb1/0x140 [zfs]
[  145.269484]  zio_vdev_io_assess+0xd3/0x350 [zfs]
[  145.269484]  zio_execute+0xea/0x220 [zfs]
[  145.269484]  taskq_thread+0x218/0x470 [spl]
[  145.269484]  ? wake_up_q+0x90/0x90
[  145.269484]  ? zio_execute_stack_check.constprop.0+0x10/0x10 [zfs]
[  145.269484]  ? taskq_thread_spawn+0x50/0x50 [spl]
[  145.269484]  kthread+0x127/0x150
[  145.269484]  ? set_kthread_struct+0x40/0x40
[  145.269484]  ret_from_fork+0x22/0x30
[  145.269484]  </TASK>

Describe how to reproduce the problem

/usr/share/zfs/zfs-tests.sh -v -T zpool_scrub
@szubersk szubersk added the Type: Defect Incorrect behavior (e.g. crash, hang) label Feb 23, 2022
nabijaczleweli added a commit to nabijaczleweli/zfs that referenced this issue Mar 10, 2022
@nabijaczleweli
module: zfs: zio_inject: zio_match_handler: don't shift << -1
c4058ac 
Caught by UBSAN: ZI_NO_DVA is passed explicitly in
zio_handle_decrypt_injection() and can be an ENOENT from zio_match_dva()

Closes openzfs#13146
Reported-by: Damian Szuberski <szuberskidamian@gmail.com>
Signed-off-by: Ahelenia Ziemiańska <nabijaczleweli@nabijaczleweli.xyz>
@nabijaczleweli nabijaczleweli mentioned this issue Mar 10, 2022
Merged
13 tasks
nabijaczleweli added a commit to nabijaczleweli/zfs that referenced this issue Mar 10, 2022
@nabijaczleweli
module: zfs: zio_inject: zio_match_handler: don't << -1
2b87bd6 
Caught by UBSAN: ZI_NO_DVA is passed explicitly in
zio_handle_decrypt_injection() and can be an ENOENT from zio_match_dva()

Closes openzfs#13146
Reported-by: Damian Szuberski <szuberskidamian@gmail.com>
Signed-off-by: Ahelenia Ziemiańska <nabijaczleweli@nabijaczleweli.xyz>
nicman23 pushed a commit to nicman23/zfs that referenced this issue Aug 22, 2022
@nabijaczleweli @nicman23
module: zfs: zio_inject: zio_match_handler: don't << -1
29276b2 
Caught by UBSAN: ZI_NO_DVA is passed explicitly in
zio_handle_decrypt_injection() and can be an ENOENT from zio_match_dva()

Reviewed-by: Brian Behlendorf <behlendorf1@llnl.gov>
Reviewed-by: Damian Szuberski <szuberskidamian@gmail.com>
Signed-off-by: Ahelenia Ziemiańska <nabijaczleweli@nabijaczleweli.xyz>
Closes openzfs#13146
Closes openzfs#13190
nicman23 pushed a commit to nicman23/zfs that referenced this issue Aug 22, 2022
@nabijaczleweli @nicman23
module: zfs: zio_inject: zio_match_handler: don't << -1
980900e 
Caught by UBSAN: ZI_NO_DVA is passed explicitly in
zio_handle_decrypt_injection() and can be an ENOENT from zio_match_dva()

Reviewed-by: Brian Behlendorf <behlendorf1@llnl.gov>
Reviewed-by: Damian Szuberski <szuberskidamian@gmail.com>
Signed-off-by: Ahelenia Ziemiańska <nabijaczleweli@nabijaczleweli.xyz>
Closes openzfs#13146
Closes openzfs#13190
andrewc12 pushed a commit to andrewc12/openzfs that referenced this issue Aug 30, 2022
@nabijaczleweli @andrewc12
module: zfs: zio_inject: zio_match_handler: don't << -1
934d13d 
Caught by UBSAN: ZI_NO_DVA is passed explicitly in
zio_handle_decrypt_injection() and can be an ENOENT from zio_match_dva()

Reviewed-by: Brian Behlendorf <behlendorf1@llnl.gov>
Reviewed-by: Damian Szuberski <szuberskidamian@gmail.com>
Signed-off-by: Ahelenia Ziemiańska <nabijaczleweli@nabijaczleweli.xyz>
Closes openzfs#13146
Closes openzfs#13190
lundman pushed a commit to openzfsonwindows/openzfs that referenced this issue Sep 2, 2022
@nabijaczleweli @lundman
module: zfs: zio_inject: zio_match_handler: don't << -1
ff0a8fc 
Caught by UBSAN: ZI_NO_DVA is passed explicitly in
zio_handle_decrypt_injection() and can be an ENOENT from zio_match_dva()

Reviewed-by: Brian Behlendorf <behlendorf1@llnl.gov>
Reviewed-by: Damian Szuberski <szuberskidamian@gmail.com>
Signed-off-by: Ahelenia Ziemiańska <nabijaczleweli@nabijaczleweli.xyz>
Closes openzfs#13146
Closes openzfs#13190
andrewc12 pushed a commit to andrewc12/openzfs that referenced this issue Sep 23, 2022
@nabijaczleweli @andrewc12
module: zfs: zio_inject: zio_match_handler: don't << -1
1b842e4 
Caught by UBSAN: ZI_NO_DVA is passed explicitly in
zio_handle_decrypt_injection() and can be an ENOENT from zio_match_dva()

Reviewed-by: Brian Behlendorf <behlendorf1@llnl.gov>
Reviewed-by: Damian Szuberski <szuberskidamian@gmail.com>
Signed-off-by: Ahelenia Ziemiańska <nabijaczleweli@nabijaczleweli.xyz>
Closes openzfs#13146
Closes openzfs#13190
andrewc12 pushed a commit to andrewc12/openzfs that referenced this issue Sep 23, 2022
@nabijaczleweli @andrewc12
module: zfs: zio_inject: zio_match_handler: don't << -1
71f90a8 
Caught by UBSAN: ZI_NO_DVA is passed explicitly in
zio_handle_decrypt_injection() and can be an ENOENT from zio_match_dva()

Reviewed-by: Brian Behlendorf <behlendorf1@llnl.gov>
Reviewed-by: Damian Szuberski <szuberskidamian@gmail.com>
Signed-off-by: Ahelenia Ziemiańska <nabijaczleweli@nabijaczleweli.xyz>
Closes openzfs#13146
Closes openzfs#13190
andrewc12 pushed a commit to andrewc12/openzfs that referenced this issue Sep 23, 2022
@nabijaczleweli @andrewc12
module: zfs: zio_inject: zio_match_handler: don't << -1
c1455f8 
Caught by UBSAN: ZI_NO_DVA is passed explicitly in
zio_handle_decrypt_injection() and can be an ENOENT from zio_match_dva()

Reviewed-by: Brian Behlendorf <behlendorf1@llnl.gov>
Reviewed-by: Damian Szuberski <szuberskidamian@gmail.com>
Signed-off-by: Ahelenia Ziemiańska <nabijaczleweli@nabijaczleweli.xyz>
Closes openzfs#13146
Closes openzfs#13190
andrewc12 pushed a commit to andrewc12/openzfs that referenced this issue Sep 23, 2022
@nabijaczleweli @andrewc12
module: zfs: zio_inject: zio_match_handler: don't << -1
274a1f7 
Caught by UBSAN: ZI_NO_DVA is passed explicitly in
zio_handle_decrypt_injection() and can be an ENOENT from zio_match_dva()

Reviewed-by: Brian Behlendorf <behlendorf1@llnl.gov>
Reviewed-by: Damian Szuberski <szuberskidamian@gmail.com>
Signed-off-by: Ahelenia Ziemiańska <nabijaczleweli@nabijaczleweli.xyz>
Closes openzfs#13146
Closes openzfs#13190
andrewc12 pushed a commit to andrewc12/openzfs that referenced this issue Sep 23, 2022
@nabijaczleweli @andrewc12
module: zfs: zio_inject: zio_match_handler: don't << -1
6394973 
Caught by UBSAN: ZI_NO_DVA is passed explicitly in
zio_handle_decrypt_injection() and can be an ENOENT from zio_match_dva()

Reviewed-by: Brian Behlendorf <behlendorf1@llnl.gov>
Reviewed-by: Damian Szuberski <szuberskidamian@gmail.com>
Signed-off-by: Ahelenia Ziemiańska <nabijaczleweli@nabijaczleweli.xyz>
Closes openzfs#13146
Closes openzfs#13190
andrewc12 pushed a commit to andrewc12/openzfs that referenced this issue Sep 23, 2022
@nabijaczleweli @andrewc12
module: zfs: zio_inject: zio_match_handler: don't << -1
38864b9 
Caught by UBSAN: ZI_NO_DVA is passed explicitly in
zio_handle_decrypt_injection() and can be an ENOENT from zio_match_dva()

Reviewed-by: Brian Behlendorf <behlendorf1@llnl.gov>
Reviewed-by: Damian Szuberski <szuberskidamian@gmail.com>
Signed-off-by: Ahelenia Ziemiańska <nabijaczleweli@nabijaczleweli.xyz>
Closes openzfs#13146
Closes openzfs#13190
andrewc12 pushed a commit to andrewc12/openzfs that referenced this issue Sep 23, 2022
@nabijaczleweli @andrewc12
module: zfs: zio_inject: zio_match_handler: don't << -1
9073b54 
Caught by UBSAN: ZI_NO_DVA is passed explicitly in
zio_handle_decrypt_injection() and can be an ENOENT from zio_match_dva()

Reviewed-by: Brian Behlendorf <behlendorf1@llnl.gov>
Reviewed-by: Damian Szuberski <szuberskidamian@gmail.com>
Signed-off-by: Ahelenia Ziemiańska <nabijaczleweli@nabijaczleweli.xyz>
Closes openzfs#13146
Closes openzfs#13190
andrewc12 pushed a commit to andrewc12/openzfs that referenced this issue Sep 23, 2022
@nabijaczleweli @andrewc12
module: zfs: zio_inject: zio_match_handler: don't << -1
079b440 
Caught by UBSAN: ZI_NO_DVA is passed explicitly in
zio_handle_decrypt_injection() and can be an ENOENT from zio_match_dva()

Reviewed-by: Brian Behlendorf <behlendorf1@llnl.gov>
Reviewed-by: Damian Szuberski <szuberskidamian@gmail.com>
Signed-off-by: Ahelenia Ziemiańska <nabijaczleweli@nabijaczleweli.xyz>
Closes openzfs#13146
Closes openzfs#13190
andrewc12 pushed a commit to andrewc12/openzfs that referenced this issue Sep 23, 2022
@nabijaczleweli @andrewc12
module: zfs: zio_inject: zio_match_handler: don't << -1
3d3e3d2 
Caught by UBSAN: ZI_NO_DVA is passed explicitly in
zio_handle_decrypt_injection() and can be an ENOENT from zio_match_dva()

Reviewed-by: Brian Behlendorf <behlendorf1@llnl.gov>
Reviewed-by: Damian Szuberski <szuberskidamian@gmail.com>
Signed-off-by: Ahelenia Ziemiańska <nabijaczleweli@nabijaczleweli.xyz>
Closes openzfs#13146
Closes openzfs#13190
andrewc12 pushed a commit to andrewc12/openzfs that referenced this issue Sep 23, 2022
@nabijaczleweli @andrewc12
module: zfs: zio_inject: zio_match_handler: don't << -1
54fa6c3 
Caught by UBSAN: ZI_NO_DVA is passed explicitly in
zio_handle_decrypt_injection() and can be an ENOENT from zio_match_dva()

Reviewed-by: Brian Behlendorf <behlendorf1@llnl.gov>
Reviewed-by: Damian Szuberski <szuberskidamian@gmail.com>
Signed-off-by: Ahelenia Ziemiańska <nabijaczleweli@nabijaczleweli.xyz>
Closes openzfs#13146
Closes openzfs#13190
andrewc12 pushed a commit to andrewc12/openzfs that referenced this issue Sep 23, 2022
@nabijaczleweli @andrewc12
module: zfs: zio_inject: zio_match_handler: don't << -1
85064f8 
Caught by UBSAN: ZI_NO_DVA is passed explicitly in
zio_handle_decrypt_injection() and can be an ENOENT from zio_match_dva()

Reviewed-by: Brian Behlendorf <behlendorf1@llnl.gov>
Reviewed-by: Damian Szuberski <szuberskidamian@gmail.com>
Signed-off-by: Ahelenia Ziemiańska <nabijaczleweli@nabijaczleweli.xyz>
Closes openzfs#13146
Closes openzfs#13190
andrewc12 pushed a commit to andrewc12/openzfs that referenced this issue Sep 23, 2022
@nabijaczleweli @andrewc12
module: zfs: zio_inject: zio_match_handler: don't << -1
0aa5c63 
Caught by UBSAN: ZI_NO_DVA is passed explicitly in
zio_handle_decrypt_injection() and can be an ENOENT from zio_match_dva()

Reviewed-by: Brian Behlendorf <behlendorf1@llnl.gov>
Reviewed-by: Damian Szuberski <szuberskidamian@gmail.com>
Signed-off-by: Ahelenia Ziemiańska <nabijaczleweli@nabijaczleweli.xyz>
Closes openzfs#13146
Closes openzfs#13190
@devZer0 devZer0 mentioned this issue Jan 16, 2024
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
Type: Defect Incorrect behavior (e.g. crash, hang)
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
1 participant
@szubersk