| Message ID | 20241002094457.1777904-1-juerg.haefliger@canonical.com |
|---|---|
| Headers | show |
| Series | UBSAN array-index-out-of-bounds reported with N-6.8 on P9 node baltar (LP: #2078038) | expand |
Acked-by: Ivan Hu <ivan.hu@canonical.com> On 10/2/24 17:44, Juerg Haefliger wrote: > BugLink: https://bugs.launchpad.net/bugs/2078038 > > [Impact] > > Issue found with Noble 6.8.0-41-generic on P9 node baltar. > > [ 1.628868] i40e 0002:01:00.0: enabling device (0140 -> 0142) > [ 1.631444] ------------[ cut here ]------------ > [ 1.631460] UBSAN: array-index-out-of-bounds in /build/linux-k1IV9m/linux-6.8.0/drivers/scsi/aacraid/comminit.c:130:16 > [ 1.631497] index 1 is out of range for type '_rrq [1]' > [ 1.631526] CPU: 0 PID: 974 Comm: kworker/0:2 Not tainted 6.8.0-41-generic #41-Ubuntu > [ 1.631551] Hardware name: 9006-12C POWER9 0x4e1202 opal:skiboot-v6.0.19 PowerNV > [ 1.631587] Workqueue: events work_for_cpu_fn > [ 1.631621] Call Trace: > [ 1.631628] [c00000000df938c0] [c0000000016bfec8] dump_stack_lvl+0x80/0x10c (unreliable) > [ 1.631663] [c00000000df938f0] [c000000000c83458] __ubsan_handle_out_of_bounds+0xc4/0x12c > [ 1.631699] [c00000000df939a0] [c00800000c460a28] aac_alloc_comm.constprop.0+0x580/0x620 [aacraid] > [ 1.631742] [c00000000df93a80] [c00800000c460b18] aac_comm_init+0x50/0x4f0 [aacraid] > [ 1.631776] [c00000000df93b10] [c00800000c4616ec] aac_init_adapter+0x234/0x660 [aacraid] > [ 1.631808] [c00000000df93c10] [c00800000c46ee0c] aac_srcv_init+0x28c/0x7b4 [aacraid] > [ 1.631844] [c00000000df93ce0] [c00800000c45395c] aac_probe_one+0x334/0x924 [aacraid] > [ 1.631882] [c00000000df93da0] [c000000000cef564] local_pci_probe+0x68/0x124 > [ 1.631919] [c00000000df93e20] [c0000000001c224c] work_for_cpu_fn+0x38/0x60 > [ 1.631957] [c00000000df93e50] [c0000000001c8ab8] process_one_work+0x1d4/0x4dc > [ 1.631993] [c00000000df93ef0] [c0000000001ca60c] worker_thread+0x470/0x648 > [ 1.632031] [c00000000df93f90] [c0000000001d90bc] kthread+0x138/0x140 > [ 1.632068] [c00000000df93fe0] [c00000000000ded8] start_kernel_thread+0x14/0x18 > [ 1.632109] ---[ end trace ]--- > <snip> > [ 1.676253] aacraid: Comm Interface type3 enabled > > [Test Case] > > Boot kernel on affected machine and check dmesg. > > [Where Problems Could Occur] > > Modifications are limited to the aacraid driver, so only machines that use that driver are affected. Potential side-effects include kernel crashes, disk access failures, ... > > > Alexander Lobakin (1): > compiler_types: add Endianness-dependent __counted_by_{le,be} > > Kees Cook (4): > scsi: aacraid: union aac_init: Replace 1-element array with flexible > array > scsi: aacraid: struct aac_ciss_phys_luns_resp: Replace 1-element array > with flexible array > scsi: aacraid: Rearrange order of struct aac_srb_unit > scsi: aacraid: struct {user,}sgmap{,64,raw}: Replace 1-element arrays > with flexible arrays > > Vegard Nossum (1): > scripts/kernel-doc: reindent > > Documentation/conf.py | 2 + > drivers/scsi/aacraid/aachba.c | 28 +- > drivers/scsi/aacraid/aacraid.h | 21 +- > drivers/scsi/aacraid/commctrl.c | 4 +- > drivers/scsi/aacraid/comminit.c | 3 +- > drivers/scsi/aacraid/commsup.c | 5 +- > drivers/scsi/aacraid/src.c | 2 +- > include/linux/compiler_types.h | 11 + > scripts/kernel-doc | 2505 +++++++++++++++---------------- > 9 files changed, 1291 insertions(+), 1290 deletions(-) >
BugLink: https://bugs.launchpad.net/bugs/2078038 [Impact] Issue found with Noble 6.8.0-41-generic on P9 node baltar. [ 1.628868] i40e 0002:01:00.0: enabling device (0140 -> 0142) [ 1.631444] ------------[ cut here ]------------ [ 1.631460] UBSAN: array-index-out-of-bounds in /build/linux-k1IV9m/linux-6.8.0/drivers/scsi/aacraid/comminit.c:130:16 [ 1.631497] index 1 is out of range for type '_rrq [1]' [ 1.631526] CPU: 0 PID: 974 Comm: kworker/0:2 Not tainted 6.8.0-41-generic #41-Ubuntu [ 1.631551] Hardware name: 9006-12C POWER9 0x4e1202 opal:skiboot-v6.0.19 PowerNV [ 1.631587] Workqueue: events work_for_cpu_fn [ 1.631621] Call Trace: [ 1.631628] [c00000000df938c0] [c0000000016bfec8] dump_stack_lvl+0x80/0x10c (unreliable) [ 1.631663] [c00000000df938f0] [c000000000c83458] __ubsan_handle_out_of_bounds+0xc4/0x12c [ 1.631699] [c00000000df939a0] [c00800000c460a28] aac_alloc_comm.constprop.0+0x580/0x620 [aacraid] [ 1.631742] [c00000000df93a80] [c00800000c460b18] aac_comm_init+0x50/0x4f0 [aacraid] [ 1.631776] [c00000000df93b10] [c00800000c4616ec] aac_init_adapter+0x234/0x660 [aacraid] [ 1.631808] [c00000000df93c10] [c00800000c46ee0c] aac_srcv_init+0x28c/0x7b4 [aacraid] [ 1.631844] [c00000000df93ce0] [c00800000c45395c] aac_probe_one+0x334/0x924 [aacraid] [ 1.631882] [c00000000df93da0] [c000000000cef564] local_pci_probe+0x68/0x124 [ 1.631919] [c00000000df93e20] [c0000000001c224c] work_for_cpu_fn+0x38/0x60 [ 1.631957] [c00000000df93e50] [c0000000001c8ab8] process_one_work+0x1d4/0x4dc [ 1.631993] [c00000000df93ef0] [c0000000001ca60c] worker_thread+0x470/0x648 [ 1.632031] [c00000000df93f90] [c0000000001d90bc] kthread+0x138/0x140 [ 1.632068] [c00000000df93fe0] [c00000000000ded8] start_kernel_thread+0x14/0x18 [ 1.632109] ---[ end trace ]--- <snip> [ 1.676253] aacraid: Comm Interface type3 enabled [Test Case] Boot kernel on affected machine and check dmesg. [Where Problems Could Occur] Modifications are limited to the aacraid driver, so only machines that use that driver are affected. Potential side-effects include kernel crashes, disk access failures, ... Alexander Lobakin (1): compiler_types: add Endianness-dependent __counted_by_{le,be} Kees Cook (4): scsi: aacraid: union aac_init: Replace 1-element array with flexible array scsi: aacraid: struct aac_ciss_phys_luns_resp: Replace 1-element array with flexible array scsi: aacraid: Rearrange order of struct aac_srb_unit scsi: aacraid: struct {user,}sgmap{,64,raw}: Replace 1-element arrays with flexible arrays Vegard Nossum (1): scripts/kernel-doc: reindent Documentation/conf.py | 2 + drivers/scsi/aacraid/aachba.c | 28 +- drivers/scsi/aacraid/aacraid.h | 21 +- drivers/scsi/aacraid/commctrl.c | 4 +- drivers/scsi/aacraid/comminit.c | 3 +- drivers/scsi/aacraid/commsup.c | 5 +- drivers/scsi/aacraid/src.c | 2 +- include/linux/compiler_types.h | 11 + scripts/kernel-doc | 2505 +++++++++++++++---------------- 9 files changed, 1291 insertions(+), 1290 deletions(-)