UBSAN: undefined-behaviour in __block_write_full_page

【标题描述】能够简要描述问题：说明什么场景下，做了什么操作，出现什么问题（尽量使用正向表达方式）
【环境信息】
nbd设备打开
BLK_DEV_NBD
【问题复现步骤】
dd if=/dev/zero of=/root/nbd_disk bs=1M count=100
qemu-nbd -c /dev/nbd0 /root/nbd_disk-f raw

#include <sys/epoll.h>
#include <asm/unistd.h>
#include <sys/time.h>
#include <sys/sendfile.h>
#include <stdarg.h>
#include <assert.h>
#include <linux/aio_abi.h>

char buf[4096];
#define NBD_SET_SIZE    _IO( 0xab, 2 )
#define NBD_DO_IT       _IO( 0xab, 3 )

int main(void)
{
	int fd = open("/dev/nbd0", O_RDWR);
	if (fd < 0) {
		perror("open fail");
		return 0;
	}
	if (write(fd, buf, 4096) < 0)
		perror("write fail");
	if (ioctl(fd, NBD_SET_SIZE, 0x8000000000000000) < 0) {
		perror("ioctl fail");
		return 0;
	}
	fsync(fd);
	return 0;
}
 
【预期结果】
没有出现问题
【实际结果】
ubsan
【附件信息】

```
print_req_error: I/O error, dev nbd0, sector 0
Buffer I/O error on dev nbd0, logical block 0, async page read
 nbd0: unable to read partition table
================================================================================
UBSAN: Undefined behaviour in fs/buffer.c:1709:35
signed integer overflow:
-9223372036854775808 - 1 cannot be represented in type 'long long int'
CPU: 3 PID: 2523 Comm: syz-executor.0 Not tainted 4.19.90 #1
Hardware name: linux,dummy-virt (DT)
Call trace:
 dump_backtrace+0x0/0x3f0 arch/arm64/kernel/time.c:78
 show_stack+0x28/0x38 arch/arm64/kernel/traps.c:158
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x170/0x1dc lib/dump_stack.c:118
 ubsan_epilogue+0x18/0xb4 lib/ubsan.c:161
 handle_overflow+0x188/0x1dc lib/ubsan.c:192
 __ubsan_handle_sub_overflow+0x34/0x44 lib/ubsan.c:206
 __block_write_full_page+0x94c/0xa20 fs/buffer.c:1709
 block_write_full_page+0x1f0/0x280 fs/buffer.c:2934
 blkdev_writepage+0x34/0x40 fs/block_dev.c:607
 __writepage+0x68/0xe8 mm/page-writeback.c:2305
 write_cache_pages+0x44c/0xc70 mm/page-writeback.c:2240
 generic_writepages+0xdc/0x148 mm/page-writeback.c:2329
 blkdev_writepages+0x2c/0x38 fs/block_dev.c:2114
 do_writepages+0xd4/0x250 mm/page-writeback.c:2344
 __filemap_fdatawrite_range+0x248/0x338 mm/filemap.c:510
 __filemap_fdatawrite mm/filemap.c:518 [inline]
 filemap_fdatawrite mm/filemap.c:523 [inline]
 filemap_write_and_wait+0x44/0xb8 mm/filemap.c:704
 __sync_blockdev fs/block_dev.c:489 [inline]
 sync_blockdev.part.2+0x58/0x78 fs/block_dev.c:498
 sync_blockdev fs/block_dev.c:1941 [inline]
 __blkdev_put+0x604/0x770 fs/block_dev.c:1932
 blkdev_put+0x288/0x440 fs/block_dev.c:2011
 blkdev_close+0x88/0xb8 fs/block_dev.c:2018
 __fput+0x20c/0x688 fs/file_table.c:278
 ____fput+0x24/0x30 fs/file_table.c:309
 task_work_run+0x13c/0x2f8 kernel/task_work.c:135
 tracehook_notify_resume include/linux/tracehook.h:193 [inline]
 do_notify_resume+0x380/0x628 arch/arm64/kernel/signal.c:728
 work_pending+0x8/0x10
================================================================================
```

GVP openEuler/kernel
Closed

Content Risk Flag

Comments (2)

GVPopenEuler/kernelClosed

Content Risk Flag