[mingo-tip:WIP.x86/e820] [x86/boot/e820] 00188fb170: UBSAN:array-index-out-of-bounds_in_arch/x86/kernel.c

[kernel test robot <oliver.sang@intel.com>]

Hello,

kernel test robot noticed "UBSAN:array-index-out-of-bounds_in_arch/x86/kernel.c" on:

commit: 00188fb1706a5b13228b766cb47dcda740319a86 ("x86/boot/e820: Standardize e820 table index variable types under 'u32'")
https://git.kernel.org/cgit/linux/kernel/git/mingo/tip.git WIP.x86/e820

in testcase: boot

config: x86_64-randconfig-161-20250420
compiler: clang-20
test machine: qemu-system-x86_64 -enable-kvm -cpu SandyBridge -smp 2 -m 16G

(please refer to attached dmesg/kmsg for entire log/backtrace)


+------------------------------------------------------+------------+------------+
|                                                      | 3c259dcaaa | 00188fb170 |
+------------------------------------------------------+------------+------------+
| boot_successes                                       | 12         | 0          |
| boot_failures                                        | 0          | 13         |
| UBSAN:array-index-out-of-bounds_in_arch/x86/kernel.c | 0          | 13         |
| PANIC:early_exception                                | 0          | 13         |
| RIP:e820_search_gap                                  | 0          | 13         |
+------------------------------------------------------+------------+------------+


If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <oliver.sang@intel.com>
| Closes: https://lore.kernel.org/oe-lkp/202504211337.244daae8-lkp@intel.com


[    1.139903][    T0] ------------[ cut here ]------------
[    1.140456][    T0] UBSAN: array-index-out-of-bounds in arch/x86/kernel/e820.c:690:15
[    1.141430][    T0] index 4294967295 is out of range for type 'struct e820_entry[3200]'
[    1.142255][    T0] CPU: 0 UID: 0 PID: 0 Comm: swapper Not tainted 6.15.0-rc2-00508-g00188fb1706a #2 PREEMPT(undef)  def69d6756324ca31b8b85090857bf93def5fcd7
[    1.142264][    T0] Call Trace:
[    1.142266][    T0]  <TASK>
[ 1.142271][ T0] ? dump_stack_lvl (kbuild/obj/smatch/x86_64-randconfig-161-20250420/lib/dump_stack.c:123 (discriminator 1)) 
[ 1.142284][ T0] ? ubsan_epilogue (kbuild/obj/smatch/x86_64-randconfig-161-20250420/lib/ubsan.c:232 (discriminator 2)) 
[ 1.142289][ T0] ? __ubsan_handle_out_of_bounds (kbuild/obj/smatch/x86_64-randconfig-161-20250420/lib/ubsan.c:?) 
[ 1.142300][ T0] ? e820_search_gap (kbuild/obj/smatch/x86_64-randconfig-161-20250420/arch/x86/kernel/e820.c:?) 
[ 1.142311][ T0] ? e820__setup_pci_gap (kbuild/obj/smatch/x86_64-randconfig-161-20250420/arch/x86/kernel/e820.c:726) 
[ 1.142316][ T0] ? setup_arch (kbuild/obj/smatch/x86_64-randconfig-161-20250420/arch/x86/kernel/setup.c:?) 
[ 1.142320][ T0] ? start_kernel (kbuild/obj/smatch/x86_64-randconfig-161-20250420/include/linux/jump_label.h:267 kbuild/obj/smatch/x86_64-randconfig-161-20250420/init/main.c:920) 
[ 1.142326][ T0] ? x86_64_start_reservations (??:?) 
[ 1.142330][ T0] ? x86_64_start_kernel (kbuild/obj/smatch/x86_64-randconfig-161-20250420/arch/x86/kernel/head64.c:443 (discriminator 2)) 
[ 1.142336][ T0] ? common_startup_64 (kbuild/obj/smatch/x86_64-randconfig-161-20250420/arch/x86/kernel/head_64.S:419) 
[    1.142351][    T0]  </TASK>
[    1.142352][    T0] ---[ end trace ]---
PANIC: early exception 0x0d IP 10:ffffffff9f1a4b6c error 0 cr2 0xffff88843ffff000
[    1.150936][    T0] CPU: 0 UID: 0 PID: 0 Comm: swapper Not tainted 6.15.0-rc2-00508-g00188fb1706a #2 PREEMPT(undef)  def69d6756324ca31b8b85090857bf93def5fcd7
[ 1.152405][ T0] RIP: 0010:e820_search_gap (kbuild/obj/smatch/x86_64-randconfig-161-20250420/arch/x86/kernel/e820.c:690 (discriminator 1794)) 
[ 1.152969][ T0] Code: f8 e9 d9 fe ff ff 48 c7 c7 20 49 c4 9d 4c 89 fe e8 89 fb df fb 48 ba 00 00 00 00 00 fc ff df 4e 8d 24 b3 4c 89 e0 48 c1 e8 03 <8a> 04 10 84 c0 0f 85 f7 00 00 00 4a 8d 3c b3 48 83 c7 07 48 89 f8
All code
========
   0:	f8                   	clc
   1:	e9 d9 fe ff ff       	jmp    0xfffffffffffffedf
   6:	48 c7 c7 20 49 c4 9d 	mov    $0xffffffff9dc44920,%rdi
   d:	4c 89 fe             	mov    %r15,%rsi
  10:	e8 89 fb df fb       	call   0xfffffffffbdffb9e
  15:	48 ba 00 00 00 00 00 	movabs $0xdffffc0000000000,%rdx
  1c:	fc ff df 
  1f:	4e 8d 24 b3          	lea    (%rbx,%r14,4),%r12
  23:	4c 89 e0             	mov    %r12,%rax
  26:	48 c1 e8 03          	shr    $0x3,%rax
  2a:*	8a 04 10             	mov    (%rax,%rdx,1),%al		<-- trapping instruction
  2d:	84 c0                	test   %al,%al
  2f:	0f 85 f7 00 00 00    	jne    0x12c
  35:	4a 8d 3c b3          	lea    (%rbx,%r14,4),%rdi
  39:	48 83 c7 07          	add    $0x7,%rdi
  3d:	48 89 f8             	mov    %rdi,%rax

Code starting with the faulting instruction
===========================================
   0:	8a 04 10             	mov    (%rax,%rdx,1),%al
   3:	84 c0                	test   %al,%al
   5:	0f 85 f7 00 00 00    	jne    0x102
   b:	4a 8d 3c b3          	lea    (%rbx,%r14,4),%rdi
   f:	48 83 c7 07          	add    $0x7,%rdi
  13:	48 89 f8             	mov    %rdi,%rax


The kernel config and materials to reproduce are available at:
https://download.01.org/0day-ci/archive/20250421/202504211337.244daae8-lkp@intel.com



-- 
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki