Re: generic/013 failure to Samba

[ChenXiaoSong <chenxiaosong.chenxiaosong@linux.dev>]

Hi Henrique,

The following is the modifications I suggest. If you have a better 
solution, please let me know.

If you agree with my modifications, could you send the v2 patch?

Give special thanks once again to Youling Tang <tangyouling@kylinos.cn> 
for his guidance on UBSAN and Clang.

If you build the kernel code with the latest version Clang (I am using 
version 21.1.7), and `CONFIG_UBSAN_BOUNDS` has been enabled, you will be 
able to see this UBSAN error every time.

It seems that we need to add two Fixes tags:
Fixes: 68d2e2ca1cba ("smb: client: batch SRV_COPYCHUNK entries to cut 
round trips")
Fixes: cc26f593dc19 ("smb: move copychunk definitions to common/smb2pdu.h")

The key modifications are as follows:
```
smb2_copychunk_range()
{
	// remove `chunk_count`, and use only `cc_req->ChunkCount`
	...
	cc_req->ChunkCount = 0;
	while (copy_bytes_left > 0 && cc_req->ChunkCount < chunk_count) {
		cc_req->ChunkCount++;
		chunk = &cc_req->Chunks[cc_req->ChunkCount - 1];
		...
	}
	...
}
```

Thanks,
ChenXiaoSong <chenxiaosong@kylinos.cn>

On 12/26/25 12:36, ChenXiaoSong wrote:
> Hi Henrique,
> 
> I can reproduce this UBSAN error. You need to compile the kernel code 
> using the latest version of Clang.
> 
> I would like to give special thanks to Tang Youling 
> <tangyouling@kylinos.cn> for his guidance on UBSAN and Clang.
> 
> Thanks,
> ChenXiaoSong <chenxiaosong@kylinos.cn>
> 
> On 12/24/25 23:02, Henrique Carvalho wrote:
>> This UBSAN report is consistent with struct copychunk_ioctl_req::Chunks[]
>> being annotated with __counted_by_le(ChunkCount) while ChunkCount is not
>> set to the allocated capacity before we start populating the array. 
>> This is
>> the same class of issue described in [1].
>>
>> A fix would be to set ChunkCount to chunk_count (capacity) at the start
>> of each iteration before accessing Chunks[]. Proposed patch is attached.
>>
>> However, if my interpretation is correct, I would expect the first
>> population to trip as well since ChunkCount starts at 0, which does not
>> happen.
>>
>> @Gustavo do you have any insight into why the first access might not
>> trigger?
>>
>> [1] https://people.kernel.org/gustavoars/how-to-use-the-new- 
>> counted_by-attribute-in-c-and-linux
>>
>