segfault with extra big value for `--mask-internal-target=`

Playing with options after #5084, I tried values like 255 * 255 * 255 * x for --mask-internal-target=. Overly big x causes message like the following:

0: OpenCL CL_INVALID_BUFFER_SIZE (-61) error in opencl_DES_bs_plug.c:933 - Create buffer_int_des_keys failed.

But smaller values cause crashes (at least under ASan) because lws/gws become 0. Crash is not immediate, it takes a few minutes.

x is 32:

$ cat t.pw
AAQg8DP4VZOHs

$ ./john/run/john t.pw --format=descrypt-opencl --mask='[\x01-\xff][\x01-\xff][\x01-\xff][\x01-\x21]?a?a?a' --lws=1 --gws=1 --mask-internal-target=530604000
Device 1: Hawaii [AMD Radeon (TM) R9 390 Series]
Using default input encoding: UTF-8
Loaded 1 password hash (descrypt-opencl, traditional crypt(3) [DES OpenCL])
Build log: /tmp/OCL7555T2.cl:208:23: warning: unknown attribute 'max_constant_size' ignored
                                   __attribute__((max_constant_size((ACTIVE_PLACEHOLDER * 32 * ITER_COUNT))))
                                                  ^
1 warning generated.

LWS=0 GWS=0 x547185375
Press 'q' or Ctrl-C to abort, 'h' for help, almost any other key for status

Message from syslogd@h at Apr 21 21:05:33 ...
 kernel:[  963.742006] EXT4-fs (sda1): failed to convert unwritten extents to written extents -- potential data loss!  (inode 3544455, error -30)
AddressSanitizer:DEADLYSIGNAL
=================================================================
==7555==ERROR: AddressSanitizer: SEGV on unknown address (pc 0x564305b5dd49 bp 0x7ffee17b1390 sp 0x7ffee17b1370 T0)
==7555==The signal is caused by a READ memory access.
==7555==Hint: this fault was caused by a dereference of a high value address (see register values below).  Dissassemble the provided pc to learn which register was used.
    #0 0x564305b5dd49 in get_key_mm /home/user/john/src/opencl_DES_bs_plug.c:1127
    #1 0x564305a5939e in crk_get_key2 /home/user/john/src/cracker.c:1331
    #2 0x564305abc381 in status_print_cracking /home/user/john/src/status.c:284
    #3 0x564305abd6fd in status_print /home/user/john/src/status.c:473
    #4 0x564305a535e1 in crk_process_event /home/user/john/src/cracker.c:809
    #5 0x564305a55a23 in crk_password_loop /home/user/john/src/cracker.c:852
    #6 0x564305a57f08 in crk_salt_loop /home/user/john/src/cracker.c:1080
    #7 0x564305a586da in process_key /home/user/john/src/cracker.c:1187
    #8 0x564305a942d7 in generate_keys /home/user/john/src/mask.c:1670
    #9 0x564305a9912b in do_mask_crack /home/user/john/src/mask.c:2704
    #10 0x564305a7660c in john_run /home/user/john/src/john.c:1835
    #11 0x564305a7660c in main /home/user/john/src/john.c:2082
    #12 0x7ff7869ebd09 in __libc_start_main ../csu/libc-start.c:308
    #13 0x564305573469 in _start (/home/user/john/run/john+0x2db469)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /home/user/john/src/opencl_DES_bs_plug.c:1127 in get_key_mm
==7555==ABORTING

There is a message from syslogd about file system. I am not sure if it is related to the problem or just a result of previous multiple reboots using reset button due to hang ups.

It happens under opencl from AMDGPU-PRO. My gpu is AMD R9 390 with 8gb of memory.

x = 31 works for me. It hangs for 7 minutes: ^C cannot exit john immediately and parallel clinfo waits end of batch too, but things work then.

x = 40 causes LWS=0 too. So there is some room before CL_INVALID_BUFFER_SIZE.

Start with src/opencl_DES_bs_plug.c at get_key_mm (line 1127) and the buffer creation failure around line 933. Reproduce the reported descrypt-opencl command with --mask-internal-target values near 530604000, then trace how lws and gws become zero. Done means oversized values fail safely without a segfault or invalid zero-sized work configuration.