[Bug 215943] UBSAN: array-index-out-of-bounds in drivers/scsi/megaraid/megaraid_sas_fp.c:103:32

[bugzilla-daemon@kernel.org]

https://bugzilla.kernel.org/show_bug.cgi?id=215943

charlotte@extrahop.com changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |charlotte@extrahop.com

--- Comment #2 from charlotte@extrahop.com ---
Created attachment 301055
  --> https://bugzilla.kernel.org/attachment.cgi?id=301055&action=edit
dmesg with UBSAN traces

we're seeing a similar thing on ubuntu 22.04's 5.15-based kernel (attached
kernel log).

MR_DRV_RAID_MAP ends with a single "struct MR_LD_SPAN_MAP ldSpanMap[1]", but in
MR_DRV_RAID_MAP_ALL, it is always followed by the field "struct MR_LD_SPAN_MAP
ldSpanMap[MAX_LOGICAL_DRIVES_DYN - 1]". Even though the access looks like it's
going off the end, the attached backtraces are accessing MR_DRV_RAID_MAP_ALL's
ldSpanMap.

So the attached traces are arguably false positives, but drivers/scsi/megaraid
is using an unusual idiom.

i assume if it did "struct MR_LD_SPAN_MAP ldSpanMap[0]", it would not trigger
the warning? but also it seems like in most (all?) of these cases it has access
to the MR_DRV_RAID_MAP_ALL anyways. (MR_FW_RAID_MAP and MR_FW_RAID_MAP_ALL seem
to be in a similar situation, but I didn't look at it as closely).

-- 
You may reply to this email to add a comment.

You are receiving this mail because:
You are the assignee for the bug.