Ubuntu
linux package

megaraid_sas crash in ubuntu 22.04

  1. Kinetic (22.10)
  2. Bug #1996915
Bug #1996915 reported by Nilson Lopes
262
This bug affects 2 people
Affects Status Importance Assigned to Milestone
linux (Ubuntu)
Confirmed
Undecided
Unassigned
Jammy
New
Undecided
Unassigned
Kinetic
New
Undecided
Unassigned

Bug Description

crash message for dmesg

UBSAN: array-index-out-of-bounds in /build/linux-JjvoxS/linux-5.15.0/drivers/scsi/megaraid/megaraid_sas_fp.c:151:32
index 2 is out of range for type 'MR_LD_SPAN_MAP [1]'
================================================================================
================================================================================
CPU: 16 PID: 330 Comm: kworker/16:1H Not tainted 5.15.0-53-generic #59-Ubuntu
Hardware name: GIGABYTE R282-Z91-00/MZ92-FS0-00, BIOS M10 11/23/2021
Workqueue: kblockd blk_mq_run_work_fn
Call Trace:
 <TASK>
 show_stack+0x52/0x5c
 dump_stack_lvl+0x4a/0x63
 dump_stack+0x10/0x16
 ubsan_epilogue+0x9/0x49
 __ubsan_handle_out_of_bounds.cold+0x44/0x49
 MR_GetPhyParams+0x487/0x700 [megaraid_sas]
 MR_BuildRaidContext+0x71e/0xb50 [megaraid_sas]
 ? cpumask_next_and+0x24/0x30
 ? update_sg_lb_stats+0x78/0x580
 megasas_build_ldio_fusion+0x5b9/0x9a0 [megaraid_sas]
 megasas_build_io_fusion+0x412/0x450 [megaraid_sas]
 megasas_build_and_issue_cmd_fusion+0xa5/0x380 [megaraid_sas]
 megasas_queue_command+0x1c1/0x200 [megaraid_sas]
 ? ktime_get+0x46/0xc0
 scsi_dispatch_cmd+0x96/0x200
 scsi_queue_rq+0x2d5/0x690
 blk_mq_dispatch_rq_list+0x13f/0x680
 ? sbitmap_get+0x71/0xe0
 __blk_mq_do_dispatch_sched+0xba/0x2e0
 blk_mq_do_dispatch_sched+0x40/0x70
 __blk_mq_sched_dispatch_requests+0x105/0x150
 blk_mq_sched_dispatch_requests+0x35/0x70
 __blk_mq_run_hw_queue+0x34/0xc0
 blk_mq_run_work_fn+0x1f/0x30
 process_one_work+0x22b/0x3d0
 worker_thread+0x53/0x420
 ? process_one_work+0x3d0/0x3d0
 kthread+0x12a/0x150
 ? set_kthread_struct+0x50/0x50
 ret_from_fork+0x22/0x30
 </TASK>

See original description
Revision history for this message
Nilson Lopes (noslin005) wrote :
information type: Public → Private Security
description: updated
Nilson Lopes (noslin005)
description: updated
Revision history for this message
Nilson Lopes (noslin005) wrote :
Revision history for this message
Seth Arnold (seth-arnold) wrote :

Hello Nilson, how was this crash produced? Can it be triggered by an unprivileged user?

Thanks

Changed in linux (Ubuntu):
status: New → Incomplete
Revision history for this message
Nilson Lopes (noslin005) wrote :

Hello Seth,

The crash happens during the boot, and it's visible to any user.
A similar bug reported was posted here.
https://bugzilla.kernel.org/show_bug.cgi?id=215943

To replicate the issue, install Ubuntu 22.04 on any system that has a MegaRAID card (I'm using 9500 series).

Thanks

Revision history for this message
Seth Arnold (seth-arnold) wrote :

Thanks Nilson, excellent find on the bugzilla report.

The linked linux-hardening thread makes me think this is 'just' an undefined-but-safe operation: the sort of thing that's good to fix, in case a future compiler makes an unsafe optimization, but not likely to be a cause for concern today.

Thanks

Changed in linux (Ubuntu):
status: Incomplete → Confirmed
information type: Private Security → Public Security
To post a comment you must log in.
This report contains Public Security information  
Everyone can see this security related information.
Subscribing...

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.