UBSAN: undefined-behaviour in __block_write_full_page

【标题描述】能够简要描述问题：说明什么场景下，做了什么操作，出现什么问题（尽量使用正向表达方式）
【环境信息】
nbd设备打开
BLK_DEV_NBD
【问题复现步骤】
dd if=/dev/zero of=/root/nbd_disk bs=1M count=100
qemu-nbd -c /dev/nbd0 /root/nbd_disk-f raw

#include <sys/epoll.h>
#include <asm/unistd.h>
#include <sys/time.h>
#include <sys/sendfile.h>
#include <stdarg.h>
#include <assert.h>
#include <linux/aio_abi.h>

char buf[4096];
#define NBD_SET_SIZE    _IO( 0xab, 2 )
#define NBD_DO_IT       _IO( 0xab, 3 )

int main(void)
{
	int fd = open("/dev/nbd0", O_RDWR);
	if (fd < 0) {
		perror("open fail");
		return 0;
	}
	if (write(fd, buf, 4096) < 0)
		perror("write fail");
	if (ioctl(fd, NBD_SET_SIZE, 0x8000000000000000) < 0) {
		perror("ioctl fail");
		return 0;
	}
	fsync(fd);
	return 0;
}
 
【预期结果】
没有出现问题
【实际结果】
ubsan
【附件信息】

```
print_req_error: I/O error, dev nbd0, sector 0
Buffer I/O error on dev nbd0, logical block 0, async page read
 nbd0: unable to read partition table
================================================================================
UBSAN: Undefined behaviour in fs/buffer.c:1709:35
signed integer overflow:
-9223372036854775808 - 1 cannot be represented in type 'long long int'
CPU: 3 PID: 2523 Comm: syz-executor.0 Not tainted 4.19.90 #1
Hardware name: linux,dummy-virt (DT)
Call trace:
 dump_backtrace+0x0/0x3f0 arch/arm64/kernel/time.c:78
 show_stack+0x28/0x38 arch/arm64/kernel/traps.c:158
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x170/0x1dc lib/dump_stack.c:118
 ubsan_epilogue+0x18/0xb4 lib/ubsan.c:161
 handle_overflow+0x188/0x1dc lib/ubsan.c:192
 __ubsan_handle_sub_overflow+0x34/0x44 lib/ubsan.c:206
 __block_write_full_page+0x94c/0xa20 fs/buffer.c:1709
 block_write_full_page+0x1f0/0x280 fs/buffer.c:2934
 blkdev_writepage+0x34/0x40 fs/block_dev.c:607
 __writepage+0x68/0xe8 mm/page-writeback.c:2305
 write_cache_pages+0x44c/0xc70 mm/page-writeback.c:2240
 generic_writepages+0xdc/0x148 mm/page-writeback.c:2329
 blkdev_writepages+0x2c/0x38 fs/block_dev.c:2114
 do_writepages+0xd4/0x250 mm/page-writeback.c:2344
 __filemap_fdatawrite_range+0x248/0x338 mm/filemap.c:510
 __filemap_fdatawrite mm/filemap.c:518 [inline]
 filemap_fdatawrite mm/filemap.c:523 [inline]
 filemap_write_and_wait+0x44/0xb8 mm/filemap.c:704
 __sync_blockdev fs/block_dev.c:489 [inline]
 sync_blockdev.part.2+0x58/0x78 fs/block_dev.c:498
 sync_blockdev fs/block_dev.c:1941 [inline]
 __blkdev_put+0x604/0x770 fs/block_dev.c:1932
 blkdev_put+0x288/0x440 fs/block_dev.c:2011
 blkdev_close+0x88/0xb8 fs/block_dev.c:2018
 __fput+0x20c/0x688 fs/file_table.c:278
 ____fput+0x24/0x30 fs/file_table.c:309
 task_work_run+0x13c/0x2f8 kernel/task_work.c:135
 tracehook_notify_resume include/linux/tracehook.h:193 [inline]
 do_notify_resume+0x380/0x628 arch/arm64/kernel/signal.c:728
 work_pending+0x8/0x10
================================================================================
```

Hi ***zhongjinghua***, welcome to the openEuler Community.
I'm the Bot here serving you. You can find the instructions on how to interact with me at **[Here](https://gitee.com/openeuler/community/blob/master/en/sig-infrastructure/command.md)**.
If you have any questions, please contact the SIG: [Kernel](https://gitee.com/openeuler/community/tree/master/sig/Kernel), and any of the maintainers: @yangyingliang , @gatieme , @jiaoff , @zhengzengkai , @LiuYongQiang0816 , @wangxiongfeng , @kevinzhu1 , @jentlestea , @lujialin2 , @wuxu_buque , @xukuohai , @lengchao , @alvin-ling , @yuzenghui , @juntianlinux , @chenguangli , @gasonchen , @whoisxxx , @koulihong , @kailiu42 , @hanjun-guo , @woqidaideshi , @chiqijun , @wkfxxx , @thundertown , @guohaocs2c , @kylin-mayukun , @oskernel0719 , @liuxinux , @newbeats , @zhujianwei001 , @zhenpengzheng , @SuperSix173 , @colyli , @zhangyi089 , @htforge , @qiuuuuu , @yuehaibing_planb , @haochengxie , @guzitao , @CTC-XiboWang , @Hongchen_Zhang , @chenwei_kernel , @x56Jason , @gouhao2022 , @duanqiangwen , @georgeguo , @mao-hongbo , @allen-shi , @zhangjialin11 , @xiexiuqi

https://lore.kernel.org/lkml/b191b5b0-1dd8-e36a-75b3-d47f0195ca48@huawei.com/t/
应该还在与upstream沟通中。

GVP openEuler/kernel

内容风险标识

评论 (2)

GVPopenEuler/kernel

内容风险标识