Skip to content

Commit ae91aea

Browse files
Junhui Peikees
authored andcommitted
ubsan: Fix incorrect hand-side used in handle
__ubsan_handle_divrem_overflow() incorrectly uses the RHS to report. It always reports the same log: division of -1 by -1. But it should report division of LHS by -1. Signed-off-by: Junhui Pei <paradoxskin233@gmail.com> Fixes: c6d3085 ("UBSAN: run-time undefined behavior sanity checker") Link: https://lore.kernel.org/r/20250602153841.62935-1-paradoxskin233@gmail.com Signed-off-by: Kees Cook <kees@kernel.org>
1 parent c17b750 commit ae91aea

File tree

1 file changed

+3
-3
lines changed

1 file changed

+3
-3
lines changed

lib/ubsan.c

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -333,18 +333,18 @@ EXPORT_SYMBOL(__ubsan_handle_implicit_conversion);
333333
void __ubsan_handle_divrem_overflow(void *_data, void *lhs, void *rhs)
334334
{
335335
struct overflow_data *data = _data;
336-
char rhs_val_str[VALUE_LENGTH];
336+
char lhs_val_str[VALUE_LENGTH];
337337

338338
if (suppress_report(&data->location))
339339
return;
340340

341341
ubsan_prologue(&data->location, "division-overflow");
342342

343-
val_to_string(rhs_val_str, sizeof(rhs_val_str), data->type, rhs);
343+
val_to_string(lhs_val_str, sizeof(lhs_val_str), data->type, lhs);
344344

345345
if (type_is_signed(data->type) && get_signed_val(data->type, rhs) == -1)
346346
pr_err("division of %s by -1 cannot be represented in type %s\n",
347-
rhs_val_str, data->type->type_name);
347+
lhs_val_str, data->type->type_name);
348348
else
349349
pr_err("division by zero\n");
350350

0 commit comments

Comments
 (0)