[Bug 215943] UBSAN: array-index-out-of-bounds in drivers/scsi/megaraid/megaraid_sas_fp.c:103:32

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



https://bugzilla.kernel.org/show_bug.cgi?id=215943

charlotte@xxxxxxxxxxxx changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |charlotte@xxxxxxxxxxxx

--- Comment #2 from charlotte@xxxxxxxxxxxx ---
Created attachment 301055
  --> https://bugzilla.kernel.org/attachment.cgi?id=301055&action=edit
dmesg with UBSAN traces

we're seeing a similar thing on ubuntu 22.04's 5.15-based kernel (attached
kernel log).

MR_DRV_RAID_MAP ends with a single "struct MR_LD_SPAN_MAP ldSpanMap[1]", but in
MR_DRV_RAID_MAP_ALL, it is always followed by the field "struct MR_LD_SPAN_MAP
ldSpanMap[MAX_LOGICAL_DRIVES_DYN - 1]". Even though the access looks like it's
going off the end, the attached backtraces are accessing MR_DRV_RAID_MAP_ALL's
ldSpanMap.

So the attached traces are arguably false positives, but drivers/scsi/megaraid
is using an unusual idiom.

i assume if it did "struct MR_LD_SPAN_MAP ldSpanMap[0]", it would not trigger
the warning? but also it seems like in most (all?) of these cases it has access
to the MR_DRV_RAID_MAP_ALL anyways. (MR_FW_RAID_MAP and MR_FW_RAID_MAP_ALL seem
to be in a similar situation, but I didn't look at it as closely).

-- 
You may reply to this email to add a comment.

You are receiving this mail because:
You are the assignee for the bug.



[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Index of Archives]     [SCSI Target Devel]     [Linux SCSI Target Infrastructure]     [Kernel Newbies]     [IDE]     [Security]     [Git]     [Netfilter]     [Bugtraq]     [Yosemite News]     [MIPS Linux]     [ARM Linux]     [Linux Security]     [Linux RAID]     [Linux ATA RAID]     [Linux IIO]     [Samba]     [Device Mapper]

  Powered by Linux