Steps to reproduce: 1. install a ubuntu 23.10 VM on an ESXi Server 2. hot add a logicsas controller and a logicsas disk
Call Trace will be reported in dmesg log
[ 176.181166] ================================================================================ [ 176.181167] UBSAN: array-index-out-of-bounds in /build/linux-IPoq5q/linux-6.5.0/drivers/message/fusion/mptsas.c:2448:22 [ 176.181171] index 1 is out of range for type 'MPI_SAS_IO_UNIT0_PHY_DATA [1]' [ 176.181174] CPU: 0 PID: 2102 Comm: (udev-worker) Not tainted 6.5.0-5-generic #5-Ubuntu [ 176.181177] Hardware name: VMware, Inc. VMware20,1/440BX Desktop Reference Platform, BIOS VMW201.00V.21805430.B64.2305221830 05/22/2023 [ 176.181179] Call Trace: [ 176.181181] <TASK> [ 176.181183] dump_stack_lvl+0x48/0x70 [ 176.181228] dump_stack+0x10/0x20 [ 176.181232] __ubsan_handle_out_of_bounds+0xc6/0x110 [ 176.181236] mptsas_sas_io_unit_pg0+0x3b1/0x3f0 [mptsas] [ 176.181248] mptsas_probe_hba_phys.isra.0+0x55/0x490 [mptsas] [ 176.181257] ? __pfx_scsi_runtime_idle+0x10/0x10 [ 176.181264] ? rpm_idle+0x1dc/0x2b0 [ 176.181269] mptsas_scan_sas_topology+0x32/0x210 [mptsas] [ 176.181277] ? scsi_autopm_put_host+0x1a/0x30 [ 176.181280] mptsas_probe.part.0+0x3cc/0x570 [mptsas] [ 176.181289] mptsas_probe+0x1e/0x30 [mptsas] [ 176.181298] local_pci_probe+0x44/0xb0 [ 176.181302] pci_call_probe+0x55/0x190 [ 176.181307] pci_device_probe+0x84/0x120 [ 176.181312] really_probe+0x1c4/0x410 [ 176.181316] __driver_probe_device+0x8c/0x180 [ 176.181320] driver_probe_device+0x24/0xd0 [ 176.181324] __driver_attach+0x10b/0x210 [ 176.181327] ? __pfx___driver_attach+0x10/0x10 [ 176.181330] bus_for_each_dev+0x8a/0xf0 [ 176.181333] driver_attach+0x1e/0x30 [ 176.181336] bus_add_driver+0x127/0x240 [ 176.181340] driver_register+0x5e/0x130 [ 176.181343] ? __pfx_mptsas_init+0x10/0x10 [mptsas] [ 176.181352] __pci_register_driver+0x62/0x70 [ 176.181356] mptsas_init+0x119/0xff0 [mptsas] [ 176.181365] do_one_initcall+0x5b/0x340 [ 176.181371] do_init_module+0x68/0x260 [ 176.181375] load_module+0xba1/0xcf0 [ 176.181380] ? vfree+0xff/0x2d0 [ 176.181385] init_module_from_file+0x96/0x100 [ 176.181388] ? init_module_from_file+0x96/0x100 [ 176.181394] idempotent_init_module+0x11c/0x2b0 [ 176.181399] __x64_sys_finit_module+0x64/0xd0 [ 176.181402] do_syscall_64+0x59/0x90 [ 176.181409] ? exit_to_user_mode_prepare+0x30/0xb0 [ 176.181413] ? syscall_exit_to_user_mode+0x37/0x60 [ 176.181417] ? do_syscall_64+0x68/0x90 [ 176.181421] ? syscall_exit_to_user_mode+0x37/0x60 [ 176.181424] ? do_syscall_64+0x68/0x90 [ 176.181428] entry_SYSCALL_64_after_hwframe+0x6e/0xd8 [ 176.181432] RIP: 0033:0x7f847a725c5d [ 176.181441] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 8b 71 13 00 f7 d8 64 89 01 48 [ 176.181481] RSP: 002b:00007fff6734e878 EFLAGS: 00000246 ORIG_RAX: 0000000000000139 [ 176.181484] RAX: ffffffffffffffda RBX: 0000563ba212a6b0 RCX: 00007f847a725c5d [ 176.181486] RDX: 0000000000000004 RSI: 00007f847aa0144a RDI: 000000000000000d [ 176.181488] RBP: 00007f847aa0144a R08: 0000000000000040 R09: fffffffffffffde0 [ 176.181490] R10: fffffffffffffe18 R11: 0000000000000246 R12: 0000000000020000 [ 176.181526] R13: 0000563ba2216ae0 R14: 0000000000000000 R15: 0000563ba20dff90 [ 176.181531] </TASK> [ 176.181532] ================================================================================
Steps to reproduce:
1. install a ubuntu 23.10 VM on an ESXi Server
2. hot add a logicsas controller and a logicsas disk
Call Trace will be reported in dmesg log
[ 176.181166] ======= ======= ======= ======= ======= ======= ======= ======= ======= ======= ======= === out-of- bounds in /build/ linux-IPoq5q/ linux-6. 5.0/drivers/ message/ fusion/ mptsas. c:2448: 22 IO_UNIT0_ PHY_DATA [1]' 00V.21805430. B64.2305221830 05/22/2023 lvl+0x48/ 0x70 0x10/0x20 handle_ out_of_ bounds+ 0xc6/0x110 sas_io_ unit_pg0+ 0x3b1/0x3f0 [mptsas] probe_hba_ phys.isra. 0+0x55/ 0x490 [mptsas] runtime_ idle+0x10/ 0x10 0x1dc/0x2b0 scan_sas_ topology+ 0x32/0x210 [mptsas] put_host+ 0x1a/0x30 probe.part. 0+0x3cc/ 0x570 [mptsas] probe+0x1e/ 0x30 [mptsas] probe+0x44/ 0xb0 probe+0x55/ 0x190 probe+0x84/ 0x120 probe+0x1c4/ 0x410 probe_device+ 0x8c/0x180 probe_device+ 0x24/0xd0 attach+ 0x10b/0x210 _driver_ attach+ 0x10/0x10 each_dev+ 0x8a/0xf0 attach+ 0x1e/0x30 driver+ 0x127/0x240 register+ 0x5e/0x130 init+0x10/ 0x10 [mptsas] driver+ 0x62/0x70 init+0x119/ 0xff0 [mptsas] initcall+ 0x5b/0x340 module+ 0x68/0x260 0xba1/0xcf0 from_file+ 0x96/0x100 from_file+ 0x96/0x100 init_module+ 0x11c/0x2b0 finit_module+ 0x64/0xd0 64+0x59/ 0x90 user_mode_ prepare+ 0x30/0xb0 exit_to_ user_mode+ 0x37/0x60 64+0x68/ 0x90 exit_to_ user_mode+ 0x37/0x60 64+0x68/ 0x90 64_after_ hwframe+ 0x6e/0xd8 34e878 EFLAGS: 00000246 ORIG_RAX: 0000000000000139 ======= ======= ======= ======= ======= ======= ======= ======= ======= ======= ===
[ 176.181167] UBSAN: array-index-
[ 176.181171] index 1 is out of range for type 'MPI_SAS_
[ 176.181174] CPU: 0 PID: 2102 Comm: (udev-worker) Not tainted 6.5.0-5-generic #5-Ubuntu
[ 176.181177] Hardware name: VMware, Inc. VMware20,1/440BX Desktop Reference Platform, BIOS VMW201.
[ 176.181179] Call Trace:
[ 176.181181] <TASK>
[ 176.181183] dump_stack_
[ 176.181228] dump_stack+
[ 176.181232] __ubsan_
[ 176.181236] mptsas_
[ 176.181248] mptsas_
[ 176.181257] ? __pfx_scsi_
[ 176.181264] ? rpm_idle+
[ 176.181269] mptsas_
[ 176.181277] ? scsi_autopm_
[ 176.181280] mptsas_
[ 176.181289] mptsas_
[ 176.181298] local_pci_
[ 176.181302] pci_call_
[ 176.181307] pci_device_
[ 176.181312] really_
[ 176.181316] __driver_
[ 176.181320] driver_
[ 176.181324] __driver_
[ 176.181327] ? __pfx__
[ 176.181330] bus_for_
[ 176.181333] driver_
[ 176.181336] bus_add_
[ 176.181340] driver_
[ 176.181343] ? __pfx_mptsas_
[ 176.181352] __pci_register_
[ 176.181356] mptsas_
[ 176.181365] do_one_
[ 176.181371] do_init_
[ 176.181375] load_module+
[ 176.181380] ? vfree+0xff/0x2d0
[ 176.181385] init_module_
[ 176.181388] ? init_module_
[ 176.181394] idempotent_
[ 176.181399] __x64_sys_
[ 176.181402] do_syscall_
[ 176.181409] ? exit_to_
[ 176.181413] ? syscall_
[ 176.181417] ? do_syscall_
[ 176.181421] ? syscall_
[ 176.181424] ? do_syscall_
[ 176.181428] entry_SYSCALL_
[ 176.181432] RIP: 0033:0x7f847a725c5d
[ 176.181441] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 8b 71 13 00 f7 d8 64 89 01 48
[ 176.181481] RSP: 002b:00007fff67
[ 176.181484] RAX: ffffffffffffffda RBX: 0000563ba212a6b0 RCX: 00007f847a725c5d
[ 176.181486] RDX: 0000000000000004 RSI: 00007f847aa0144a RDI: 000000000000000d
[ 176.181488] RBP: 00007f847aa0144a R08: 0000000000000040 R09: fffffffffffffde0
[ 176.181490] R10: fffffffffffffe18 R11: 0000000000000246 R12: 0000000000020000
[ 176.181526] R13: 0000563ba2216ae0 R14: 0000000000000000 R15: 0000563ba20dff90
[ 176.181531] </TASK>
[ 176.181532] =======