[LU-17517] shift exponent 65 is too large for 64-bit type in lov_request.c

• Status: Open
• Project: Lustre
• Affects Version/s: Lustre 2.15.4
• Type: Bug
• Priority: Minor
• Reporter: Åke Sandgren
• Assignee: WC Triage
• Resolution: Unresolved
• Severity: 3

Description

One of our clients just gave us this:

[  201.440391] UBSAN: shift-out-of-bounds in /var/lib/dkms/lustre-client-modules/2.15.4-hpc2n0.2/build/lustre/lov/lov_request.c:230:23
[  201.452215] shift exponent 65 is too large for 64-bit type 'long long unsigned int'
[  201.460108] ================================================================================
[  201.468547] ================================================================================
[  201.476985] UBSAN: shift-out-of-bounds in /var/lib/dkms/lustre-client-modules/2.15.4-hpc2n0.2/build/lustre/lov/lov_request.c:231:23
[  201.488810] shift exponent 65 is too large for 64-bit type 'long long unsigned int'
[  201.496944] ================================================================================
[  201.505378] ================================================================================
[  201.513819] UBSAN: shift-out-of-bounds in /var/lib/dkms/lustre-client-modules/2.15.4-hpc2n0.2/build/lustre/lov/lov_request.c:232:23
[  201.525642] shift exponent 65 is too large for 64-bit type 'long long unsigned int'

 

Comments

[Tim Day]

Seems like in `lov_update_statfs()`, the logic

 200                         for (shift = 0; shift <= 64; ++shift) {
 201                                 if (tmp & 1) {
 202                                         if (quit)
 203                                                 break;
 204                                         quit = 1;
 205                                         shift = 0;
  206                                                              }
 207                                 tmp >>= 1;
  208                                              }

is wrong. If we finish the loop without breaking, `shift` will be 65. I think if `shift` is 64, that's also undefined behavior. It'd have to be capped at 63.