ACK: [SRU][N][PATCH 0/6] UBSAN array-index-out-of-bounds reported with N-6.8 on P9 node baltar (LP: #2078038)

[ivanhu]

Acked-by: Ivan Hu <ivan.hu at canonical.com>


On 10/2/24 17:44, Juerg Haefliger wrote:
> BugLink: https://bugs.launchpad.net/bugs/2078038
> 
> [Impact]
> 
> Issue found with Noble 6.8.0-41-generic on P9 node baltar.
> 
> [    1.628868] i40e 0002:01:00.0: enabling device (0140 -> 0142)
> [    1.631444] ------------[ cut here ]------------
> [    1.631460] UBSAN: array-index-out-of-bounds in /build/linux-k1IV9m/linux-6.8.0/drivers/scsi/aacraid/comminit.c:130:16
> [    1.631497] index 1 is out of range for type '_rrq [1]'
> [    1.631526] CPU: 0 PID: 974 Comm: kworker/0:2 Not tainted 6.8.0-41-generic #41-Ubuntu
> [    1.631551] Hardware name: 9006-12C POWER9 0x4e1202 opal:skiboot-v6.0.19 PowerNV
> [    1.631587] Workqueue: events work_for_cpu_fn
> [    1.631621] Call Trace:
> [    1.631628] [c00000000df938c0] [c0000000016bfec8] dump_stack_lvl+0x80/0x10c (unreliable)
> [    1.631663] [c00000000df938f0] [c000000000c83458] __ubsan_handle_out_of_bounds+0xc4/0x12c
> [    1.631699] [c00000000df939a0] [c00800000c460a28] aac_alloc_comm.constprop.0+0x580/0x620 [aacraid]
> [    1.631742] [c00000000df93a80] [c00800000c460b18] aac_comm_init+0x50/0x4f0 [aacraid]
> [    1.631776] [c00000000df93b10] [c00800000c4616ec] aac_init_adapter+0x234/0x660 [aacraid]
> [    1.631808] [c00000000df93c10] [c00800000c46ee0c] aac_srcv_init+0x28c/0x7b4 [aacraid]
> [    1.631844] [c00000000df93ce0] [c00800000c45395c] aac_probe_one+0x334/0x924 [aacraid]
> [    1.631882] [c00000000df93da0] [c000000000cef564] local_pci_probe+0x68/0x124
> [    1.631919] [c00000000df93e20] [c0000000001c224c] work_for_cpu_fn+0x38/0x60
> [    1.631957] [c00000000df93e50] [c0000000001c8ab8] process_one_work+0x1d4/0x4dc
> [    1.631993] [c00000000df93ef0] [c0000000001ca60c] worker_thread+0x470/0x648
> [    1.632031] [c00000000df93f90] [c0000000001d90bc] kthread+0x138/0x140
> [    1.632068] [c00000000df93fe0] [c00000000000ded8] start_kernel_thread+0x14/0x18
> [    1.632109] ---[ end trace ]---
> <snip>
> [    1.676253] aacraid: Comm Interface type3 enabled
> 
> [Test Case]
> 
> Boot kernel on affected machine and check dmesg.
> 
> [Where Problems Could Occur]
> 
> Modifications are limited to the aacraid driver, so only machines that use that driver are affected. Potential side-effects include kernel crashes, disk access failures, ...
> 
> 
> Alexander Lobakin (1):
>    compiler_types: add Endianness-dependent __counted_by_{le,be}
> 
> Kees Cook (4):
>    scsi: aacraid: union aac_init: Replace 1-element array with flexible
>      array
>    scsi: aacraid: struct aac_ciss_phys_luns_resp: Replace 1-element array
>      with flexible array
>    scsi: aacraid: Rearrange order of struct aac_srb_unit
>    scsi: aacraid: struct {user,}sgmap{,64,raw}: Replace 1-element arrays
>      with flexible arrays
> 
> Vegard Nossum (1):
>    scripts/kernel-doc: reindent
> 
>   Documentation/conf.py           |    2 +
>   drivers/scsi/aacraid/aachba.c   |   28 +-
>   drivers/scsi/aacraid/aacraid.h  |   21 +-
>   drivers/scsi/aacraid/commctrl.c |    4 +-
>   drivers/scsi/aacraid/comminit.c |    3 +-
>   drivers/scsi/aacraid/commsup.c  |    5 +-
>   drivers/scsi/aacraid/src.c      |    2 +-
>   include/linux/compiler_types.h  |   11 +
>   scripts/kernel-doc              | 2505 +++++++++++++++----------------
>   9 files changed, 1291 insertions(+), 1290 deletions(-)
>