* UBSAN: array-index-out-of-bounds in [...]sound/pci/ctxfi/ctamixer.c:347:48 [not found] <176428476762.2962.8176922083972711750.reportbug@main.localdomain> @ 2025-11-28 6:07 ` Salvatore Bonaccorso 2025-11-28 17:24 ` Takashi Iwai 0 siblings, 1 reply; 9+ messages in thread From: Salvatore Bonaccorso @ 2025-11-28 6:07 UTC (permalink / raw) To: Jaroslav Kysela, Takashi Iwai; +Cc: waxhead, linux-kernel, linux-sound, 1121535 Hi Jaroslav, hi Takashi A user in Debian reported (in https://bugs.debian.org/1121535) an array-index-out-of-bounds affecting ctxfi/ctamixer.c: On Fri, Nov 28, 2025 at 12:06:07AM +0100, waxhead wrote: > ------------[ cut here ]------------ > Nov 27 23:46:53 main kernel: UBSAN: array-index-out-of-bounds in /build/reproducible-path/linux-6.17.8/sound/pci/ctxfi/ctamixer.c:347:48 > Nov 27 23:46:53 main kernel: index 8 is out of range for type 'unsigned char [8]' > Nov 27 23:46:53 main kernel: CPU: 4 UID: 0 PID: 468 Comm: (udev-worker) Not tainted 6.17.8+deb14-amd64 #1 PREEMPT(lazy) Debian 6.17.8-1 > Nov 27 23:46:53 main kernel: Hardware name: FUJITSU /D3446-S2, BIOS V5.0.0.12 R1.26.0 for D3446-S2x 02/11/2020 > Nov 27 23:46:53 main kernel: Call Trace: > Nov 27 23:46:53 main kernel: <TASK> > Nov 27 23:46:53 main kernel: dump_stack_lvl+0x5d/0x80 > Nov 27 23:46:53 main kernel: ? __pfx_amixer_set_x+0x10/0x10 [snd_ctxfi] > Nov 27 23:46:53 main kernel: ubsan_epilogue+0x5/0x2b > Nov 27 23:46:53 main kernel: __ubsan_handle_out_of_bounds.cold+0x54/0x59 > Nov 27 23:46:53 main kernel: sum_output_slot+0x44/0x70 [snd_ctxfi] > Nov 27 23:46:53 main kernel: amixer_set_input+0x4b/0x80 [snd_ctxfi] > Nov 27 23:46:53 main kernel: amixer_setup+0x1b/0x50 [snd_ctxfi] > Nov 27 23:46:53 main kernel: ct_mixer_create+0x193/0x570 [snd_ctxfi] > Nov 27 23:46:53 main kernel: ct_atc_create+0x3cb/0x530 [snd_ctxfi] > Nov 27 23:46:53 main kernel: ct_card_probe+0x104/0x2c0 [snd_ctxfi] > Nov 27 23:46:53 main kernel: local_pci_probe+0x3f/0x90 > Nov 27 23:46:53 main kernel: pci_device_probe+0xda/0x2b0 > Nov 27 23:46:53 main kernel: ? sysfs_do_create_link_sd+0x6d/0xd0 > Nov 27 23:46:53 main kernel: really_probe+0xdb/0x340 > Nov 27 23:46:53 main kernel: ? pm_runtime_barrier+0x55/0x90 > Nov 27 23:46:53 main kernel: __driver_probe_device+0x78/0x140 > Nov 27 23:46:53 main kernel: driver_probe_device+0x1f/0xa0 > Nov 27 23:46:53 main kernel: ? __pfx___driver_attach+0x10/0x10 > Nov 27 23:46:53 main kernel: __driver_attach+0xcb/0x1e0 > Nov 27 23:46:53 main kernel: bus_for_each_dev+0x82/0xd0 > Nov 27 23:46:53 main kernel: bus_add_driver+0x10b/0x1f0 > Nov 27 23:46:53 main kernel: ? __pfx_ct_driver_init+0x10/0x10 [snd_ctxfi] > Nov 27 23:46:53 main kernel: driver_register+0x75/0xe0 > Nov 27 23:46:53 main kernel: do_one_initcall+0x58/0x300 > Nov 27 23:46:53 main kernel: do_init_module+0x62/0x250 > Nov 27 23:46:53 main kernel: ? init_module_from_file+0x8a/0xe0 > Nov 27 23:46:53 main kernel: init_module_from_file+0x8a/0xe0 > Nov 27 23:46:53 main kernel: idempotent_init_module+0x114/0x310 > Nov 27 23:46:53 main kernel: __x64_sys_finit_module+0x6d/0xd0 > Nov 27 23:46:53 main kernel: ? syscall_trace_enter+0x8d/0x1d0 > Nov 27 23:46:53 main kernel: do_syscall_64+0x82/0x320 > Nov 27 23:46:53 main kernel: ? restore_fpregs_from_fpstate+0x46/0xa0 > Nov 27 23:46:53 main kernel: ? switch_fpu_return+0x5b/0xe0 > Nov 27 23:46:53 main kernel: ? do_syscall_64+0x200/0x320 > Nov 27 23:46:53 main kernel: ? exc_page_fault+0x74/0x180 > Nov 27 23:46:53 main kernel: entry_SYSCALL_64_after_hwframe+0x76/0x7e > Nov 27 23:46:53 main kernel: RIP: 0033:0x7f77238f3779 > Nov 27 23:46:53 main kernel: Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 4f 86 0d 00 f7 d8 64 89 01 48 > Nov 27 23:46:53 main kernel: RSP: 002b:00007ffc398103f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000139 > Nov 27 23:46:53 main kernel: RAX: ffffffffffffffda RBX: 000055e0eb622480 RCX: 00007f77238f3779 > Nov 27 23:46:53 main kernel: RDX: 0000000000000004 RSI: 00007f77239f744d RDI: 000000000000001b > Nov 27 23:46:53 main kernel: RBP: 0000000000000004 R08: 0000000000000000 R09: 00007f7723ef6280 > Nov 27 23:46:53 main kernel: R10: 0000000000000000 R11: 0000000000000246 R12: 00007f77239f744d > Nov 27 23:46:53 main kernel: R13: 0000000000020000 R14: 000055e0eb61e630 R15: 0000000000000000 > Nov 27 23:46:53 main kernel: </TASK> > Nov 27 23:46:53 main kernel: ---[ end trace ]--- This was specifically with 6.17.8 but up to the current stable 6.17.9 there should be no related changes afaics. Regards, Salvatore ^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: UBSAN: array-index-out-of-bounds in [...]sound/pci/ctxfi/ctamixer.c:347:48 2025-11-28 6:07 ` UBSAN: array-index-out-of-bounds in [...]sound/pci/ctxfi/ctamixer.c:347:48 Salvatore Bonaccorso @ 2025-11-28 17:24 ` Takashi Iwai 2025-11-28 19:32 ` Salvatore Bonaccorso 0 siblings, 1 reply; 9+ messages in thread From: Takashi Iwai @ 2025-11-28 17:24 UTC (permalink / raw) To: Salvatore Bonaccorso Cc: Jaroslav Kysela, Takashi Iwai, waxhead, linux-kernel, linux-sound, 1121535 On Fri, 28 Nov 2025 07:07:36 +0100, Salvatore Bonaccorso wrote: > > Hi Jaroslav, hi Takashi > > A user in Debian reported (in https://bugs.debian.org/1121535) an > array-index-out-of-bounds affecting ctxfi/ctamixer.c: > > On Fri, Nov 28, 2025 at 12:06:07AM +0100, waxhead wrote: > > ------------[ cut here ]------------ > > Nov 27 23:46:53 main kernel: UBSAN: array-index-out-of-bounds in /build/reproducible-path/linux-6.17.8/sound/pci/ctxfi/ctamixer.c:347:48 > > Nov 27 23:46:53 main kernel: index 8 is out of range for type 'unsigned char [8]' > > Nov 27 23:46:53 main kernel: CPU: 4 UID: 0 PID: 468 Comm: (udev-worker) Not tainted 6.17.8+deb14-amd64 #1 PREEMPT(lazy) Debian 6.17.8-1 > > Nov 27 23:46:53 main kernel: Hardware name: FUJITSU /D3446-S2, BIOS V5.0.0.12 R1.26.0 for D3446-S2x 02/11/2020 > > Nov 27 23:46:53 main kernel: Call Trace: > > Nov 27 23:46:53 main kernel: <TASK> > > Nov 27 23:46:53 main kernel: dump_stack_lvl+0x5d/0x80 > > Nov 27 23:46:53 main kernel: ? __pfx_amixer_set_x+0x10/0x10 [snd_ctxfi] > > Nov 27 23:46:53 main kernel: ubsan_epilogue+0x5/0x2b > > Nov 27 23:46:53 main kernel: __ubsan_handle_out_of_bounds.cold+0x54/0x59 > > Nov 27 23:46:53 main kernel: sum_output_slot+0x44/0x70 [snd_ctxfi] > > Nov 27 23:46:53 main kernel: amixer_set_input+0x4b/0x80 [snd_ctxfi] > > Nov 27 23:46:53 main kernel: amixer_setup+0x1b/0x50 [snd_ctxfi] > > Nov 27 23:46:53 main kernel: ct_mixer_create+0x193/0x570 [snd_ctxfi] > > Nov 27 23:46:53 main kernel: ct_atc_create+0x3cb/0x530 [snd_ctxfi] > > Nov 27 23:46:53 main kernel: ct_card_probe+0x104/0x2c0 [snd_ctxfi] > > Nov 27 23:46:53 main kernel: local_pci_probe+0x3f/0x90 > > Nov 27 23:46:53 main kernel: pci_device_probe+0xda/0x2b0 > > Nov 27 23:46:53 main kernel: ? sysfs_do_create_link_sd+0x6d/0xd0 > > Nov 27 23:46:53 main kernel: really_probe+0xdb/0x340 > > Nov 27 23:46:53 main kernel: ? pm_runtime_barrier+0x55/0x90 > > Nov 27 23:46:53 main kernel: __driver_probe_device+0x78/0x140 > > Nov 27 23:46:53 main kernel: driver_probe_device+0x1f/0xa0 > > Nov 27 23:46:53 main kernel: ? __pfx___driver_attach+0x10/0x10 > > Nov 27 23:46:53 main kernel: __driver_attach+0xcb/0x1e0 > > Nov 27 23:46:53 main kernel: bus_for_each_dev+0x82/0xd0 > > Nov 27 23:46:53 main kernel: bus_add_driver+0x10b/0x1f0 > > Nov 27 23:46:53 main kernel: ? __pfx_ct_driver_init+0x10/0x10 [snd_ctxfi] > > Nov 27 23:46:53 main kernel: driver_register+0x75/0xe0 > > Nov 27 23:46:53 main kernel: do_one_initcall+0x58/0x300 > > Nov 27 23:46:53 main kernel: do_init_module+0x62/0x250 > > Nov 27 23:46:53 main kernel: ? init_module_from_file+0x8a/0xe0 > > Nov 27 23:46:53 main kernel: init_module_from_file+0x8a/0xe0 > > Nov 27 23:46:53 main kernel: idempotent_init_module+0x114/0x310 > > Nov 27 23:46:53 main kernel: __x64_sys_finit_module+0x6d/0xd0 > > Nov 27 23:46:53 main kernel: ? syscall_trace_enter+0x8d/0x1d0 > > Nov 27 23:46:53 main kernel: do_syscall_64+0x82/0x320 > > Nov 27 23:46:53 main kernel: ? restore_fpregs_from_fpstate+0x46/0xa0 > > Nov 27 23:46:53 main kernel: ? switch_fpu_return+0x5b/0xe0 > > Nov 27 23:46:53 main kernel: ? do_syscall_64+0x200/0x320 > > Nov 27 23:46:53 main kernel: ? exc_page_fault+0x74/0x180 > > Nov 27 23:46:53 main kernel: entry_SYSCALL_64_after_hwframe+0x76/0x7e > > Nov 27 23:46:53 main kernel: RIP: 0033:0x7f77238f3779 > > Nov 27 23:46:53 main kernel: Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 4f 86 0d 00 f7 d8 64 89 01 48 > > Nov 27 23:46:53 main kernel: RSP: 002b:00007ffc398103f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000139 > > Nov 27 23:46:53 main kernel: RAX: ffffffffffffffda RBX: 000055e0eb622480 RCX: 00007f77238f3779 > > Nov 27 23:46:53 main kernel: RDX: 0000000000000004 RSI: 00007f77239f744d RDI: 000000000000001b > > Nov 27 23:46:53 main kernel: RBP: 0000000000000004 R08: 0000000000000000 R09: 00007f7723ef6280 > > Nov 27 23:46:53 main kernel: R10: 0000000000000000 R11: 0000000000000246 R12: 00007f77239f744d > > Nov 27 23:46:53 main kernel: R13: 0000000000020000 R14: 000055e0eb61e630 R15: 0000000000000000 > > Nov 27 23:46:53 main kernel: </TASK> > > Nov 27 23:46:53 main kernel: ---[ end trace ]--- > > This was specifically with 6.17.8 but up to the current stable 6.17.9 > there should be no related changes afaics. Thanks for the report. As a wild guess, a simple fix like below should suffice for this case? Takashi -- 8< -- --- a/sound/pci/ctxfi/ctamixer.h +++ b/sound/pci/ctxfi/ctamixer.h @@ -22,7 +22,7 @@ /* Define the descriptor of a summation node resource */ struct sum { struct rsc rsc; /* Basic resource info */ - unsigned char idx[8]; + unsigned char idx[8 + 1]; /* msr + master */ }; /* Define sum resource request description info */ ^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: UBSAN: array-index-out-of-bounds in [...]sound/pci/ctxfi/ctamixer.c:347:48 2025-11-28 17:24 ` Takashi Iwai @ 2025-11-28 19:32 ` Salvatore Bonaccorso 2025-11-29 8:06 ` Bug#1121535: " Salvatore Bonaccorso 0 siblings, 1 reply; 9+ messages in thread From: Salvatore Bonaccorso @ 2025-11-28 19:32 UTC (permalink / raw) To: Takashi Iwai, waxhead Cc: Jaroslav Kysela, Takashi Iwai, waxhead, linux-kernel, linux-sound, 1121535 Hi Takeshi, On Fri, Nov 28, 2025 at 06:24:43PM +0100, Takashi Iwai wrote: > On Fri, 28 Nov 2025 07:07:36 +0100, > Salvatore Bonaccorso wrote: > > > > Hi Jaroslav, hi Takashi > > > > A user in Debian reported (in https://bugs.debian.org/1121535) an > > array-index-out-of-bounds affecting ctxfi/ctamixer.c: > > > > On Fri, Nov 28, 2025 at 12:06:07AM +0100, waxhead wrote: > > > ------------[ cut here ]------------ > > > Nov 27 23:46:53 main kernel: UBSAN: array-index-out-of-bounds in /build/reproducible-path/linux-6.17.8/sound/pci/ctxfi/ctamixer.c:347:48 > > > Nov 27 23:46:53 main kernel: index 8 is out of range for type 'unsigned char [8]' > > > Nov 27 23:46:53 main kernel: CPU: 4 UID: 0 PID: 468 Comm: (udev-worker) Not tainted 6.17.8+deb14-amd64 #1 PREEMPT(lazy) Debian 6.17.8-1 > > > Nov 27 23:46:53 main kernel: Hardware name: FUJITSU /D3446-S2, BIOS V5.0.0.12 R1.26.0 for D3446-S2x 02/11/2020 > > > Nov 27 23:46:53 main kernel: Call Trace: > > > Nov 27 23:46:53 main kernel: <TASK> > > > Nov 27 23:46:53 main kernel: dump_stack_lvl+0x5d/0x80 > > > Nov 27 23:46:53 main kernel: ? __pfx_amixer_set_x+0x10/0x10 [snd_ctxfi] > > > Nov 27 23:46:53 main kernel: ubsan_epilogue+0x5/0x2b > > > Nov 27 23:46:53 main kernel: __ubsan_handle_out_of_bounds.cold+0x54/0x59 > > > Nov 27 23:46:53 main kernel: sum_output_slot+0x44/0x70 [snd_ctxfi] > > > Nov 27 23:46:53 main kernel: amixer_set_input+0x4b/0x80 [snd_ctxfi] > > > Nov 27 23:46:53 main kernel: amixer_setup+0x1b/0x50 [snd_ctxfi] > > > Nov 27 23:46:53 main kernel: ct_mixer_create+0x193/0x570 [snd_ctxfi] > > > Nov 27 23:46:53 main kernel: ct_atc_create+0x3cb/0x530 [snd_ctxfi] > > > Nov 27 23:46:53 main kernel: ct_card_probe+0x104/0x2c0 [snd_ctxfi] > > > Nov 27 23:46:53 main kernel: local_pci_probe+0x3f/0x90 > > > Nov 27 23:46:53 main kernel: pci_device_probe+0xda/0x2b0 > > > Nov 27 23:46:53 main kernel: ? sysfs_do_create_link_sd+0x6d/0xd0 > > > Nov 27 23:46:53 main kernel: really_probe+0xdb/0x340 > > > Nov 27 23:46:53 main kernel: ? pm_runtime_barrier+0x55/0x90 > > > Nov 27 23:46:53 main kernel: __driver_probe_device+0x78/0x140 > > > Nov 27 23:46:53 main kernel: driver_probe_device+0x1f/0xa0 > > > Nov 27 23:46:53 main kernel: ? __pfx___driver_attach+0x10/0x10 > > > Nov 27 23:46:53 main kernel: __driver_attach+0xcb/0x1e0 > > > Nov 27 23:46:53 main kernel: bus_for_each_dev+0x82/0xd0 > > > Nov 27 23:46:53 main kernel: bus_add_driver+0x10b/0x1f0 > > > Nov 27 23:46:53 main kernel: ? __pfx_ct_driver_init+0x10/0x10 [snd_ctxfi] > > > Nov 27 23:46:53 main kernel: driver_register+0x75/0xe0 > > > Nov 27 23:46:53 main kernel: do_one_initcall+0x58/0x300 > > > Nov 27 23:46:53 main kernel: do_init_module+0x62/0x250 > > > Nov 27 23:46:53 main kernel: ? init_module_from_file+0x8a/0xe0 > > > Nov 27 23:46:53 main kernel: init_module_from_file+0x8a/0xe0 > > > Nov 27 23:46:53 main kernel: idempotent_init_module+0x114/0x310 > > > Nov 27 23:46:53 main kernel: __x64_sys_finit_module+0x6d/0xd0 > > > Nov 27 23:46:53 main kernel: ? syscall_trace_enter+0x8d/0x1d0 > > > Nov 27 23:46:53 main kernel: do_syscall_64+0x82/0x320 > > > Nov 27 23:46:53 main kernel: ? restore_fpregs_from_fpstate+0x46/0xa0 > > > Nov 27 23:46:53 main kernel: ? switch_fpu_return+0x5b/0xe0 > > > Nov 27 23:46:53 main kernel: ? do_syscall_64+0x200/0x320 > > > Nov 27 23:46:53 main kernel: ? exc_page_fault+0x74/0x180 > > > Nov 27 23:46:53 main kernel: entry_SYSCALL_64_after_hwframe+0x76/0x7e > > > Nov 27 23:46:53 main kernel: RIP: 0033:0x7f77238f3779 > > > Nov 27 23:46:53 main kernel: Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 4f 86 0d 00 f7 d8 64 89 01 48 > > > Nov 27 23:46:53 main kernel: RSP: 002b:00007ffc398103f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000139 > > > Nov 27 23:46:53 main kernel: RAX: ffffffffffffffda RBX: 000055e0eb622480 RCX: 00007f77238f3779 > > > Nov 27 23:46:53 main kernel: RDX: 0000000000000004 RSI: 00007f77239f744d RDI: 000000000000001b > > > Nov 27 23:46:53 main kernel: RBP: 0000000000000004 R08: 0000000000000000 R09: 00007f7723ef6280 > > > Nov 27 23:46:53 main kernel: R10: 0000000000000000 R11: 0000000000000246 R12: 00007f77239f744d > > > Nov 27 23:46:53 main kernel: R13: 0000000000020000 R14: 000055e0eb61e630 R15: 0000000000000000 > > > Nov 27 23:46:53 main kernel: </TASK> > > > Nov 27 23:46:53 main kernel: ---[ end trace ]--- > > > > This was specifically with 6.17.8 but up to the current stable 6.17.9 > > there should be no related changes afaics. > > Thanks for the report. As a wild guess, a simple fix like below > should suffice for this case? > > > Takashi > > -- 8< -- > --- a/sound/pci/ctxfi/ctamixer.h > +++ b/sound/pci/ctxfi/ctamixer.h > @@ -22,7 +22,7 @@ > /* Define the descriptor of a summation node resource */ > struct sum { > struct rsc rsc; /* Basic resource info */ > - unsigned char idx[8]; > + unsigned char idx[8 + 1]; /* msr + master */ > }; > > /* Define sum resource request description info */ FWIW, I cannot test this myself. "waxhead", can you please test the proposed patch and report back if it fixes the issue for you? Regards, Salvatore ^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: Bug#1121535: UBSAN: array-index-out-of-bounds in [...]sound/pci/ctxfi/ctamixer.c:347:48 2025-11-28 19:32 ` Salvatore Bonaccorso @ 2025-11-29 8:06 ` Salvatore Bonaccorso 2025-12-26 17:21 ` Karsten Hohmeier 0 siblings, 1 reply; 9+ messages in thread From: Salvatore Bonaccorso @ 2025-11-29 8:06 UTC (permalink / raw) To: waxhead, 1121535 Cc: Takashi Iwai, Jaroslav Kysela, Takashi Iwai, linux-kernel, linux-sound Hi, On Fri, Nov 28, 2025 at 08:32:21PM +0100, Salvatore Bonaccorso wrote: > Hi Takeshi, > > On Fri, Nov 28, 2025 at 06:24:43PM +0100, Takashi Iwai wrote: > > On Fri, 28 Nov 2025 07:07:36 +0100, > > Salvatore Bonaccorso wrote: > > > > > > Hi Jaroslav, hi Takashi > > > > > > A user in Debian reported (in https://bugs.debian.org/1121535) an > > > array-index-out-of-bounds affecting ctxfi/ctamixer.c: > > > > > > On Fri, Nov 28, 2025 at 12:06:07AM +0100, waxhead wrote: > > > > ------------[ cut here ]------------ > > > > Nov 27 23:46:53 main kernel: UBSAN: array-index-out-of-bounds in /build/reproducible-path/linux-6.17.8/sound/pci/ctxfi/ctamixer.c:347:48 > > > > Nov 27 23:46:53 main kernel: index 8 is out of range for type 'unsigned char [8]' > > > > Nov 27 23:46:53 main kernel: CPU: 4 UID: 0 PID: 468 Comm: (udev-worker) Not tainted 6.17.8+deb14-amd64 #1 PREEMPT(lazy) Debian 6.17.8-1 > > > > Nov 27 23:46:53 main kernel: Hardware name: FUJITSU /D3446-S2, BIOS V5.0.0.12 R1.26.0 for D3446-S2x 02/11/2020 > > > > Nov 27 23:46:53 main kernel: Call Trace: > > > > Nov 27 23:46:53 main kernel: <TASK> > > > > Nov 27 23:46:53 main kernel: dump_stack_lvl+0x5d/0x80 > > > > Nov 27 23:46:53 main kernel: ? __pfx_amixer_set_x+0x10/0x10 [snd_ctxfi] > > > > Nov 27 23:46:53 main kernel: ubsan_epilogue+0x5/0x2b > > > > Nov 27 23:46:53 main kernel: __ubsan_handle_out_of_bounds.cold+0x54/0x59 > > > > Nov 27 23:46:53 main kernel: sum_output_slot+0x44/0x70 [snd_ctxfi] > > > > Nov 27 23:46:53 main kernel: amixer_set_input+0x4b/0x80 [snd_ctxfi] > > > > Nov 27 23:46:53 main kernel: amixer_setup+0x1b/0x50 [snd_ctxfi] > > > > Nov 27 23:46:53 main kernel: ct_mixer_create+0x193/0x570 [snd_ctxfi] > > > > Nov 27 23:46:53 main kernel: ct_atc_create+0x3cb/0x530 [snd_ctxfi] > > > > Nov 27 23:46:53 main kernel: ct_card_probe+0x104/0x2c0 [snd_ctxfi] > > > > Nov 27 23:46:53 main kernel: local_pci_probe+0x3f/0x90 > > > > Nov 27 23:46:53 main kernel: pci_device_probe+0xda/0x2b0 > > > > Nov 27 23:46:53 main kernel: ? sysfs_do_create_link_sd+0x6d/0xd0 > > > > Nov 27 23:46:53 main kernel: really_probe+0xdb/0x340 > > > > Nov 27 23:46:53 main kernel: ? pm_runtime_barrier+0x55/0x90 > > > > Nov 27 23:46:53 main kernel: __driver_probe_device+0x78/0x140 > > > > Nov 27 23:46:53 main kernel: driver_probe_device+0x1f/0xa0 > > > > Nov 27 23:46:53 main kernel: ? __pfx___driver_attach+0x10/0x10 > > > > Nov 27 23:46:53 main kernel: __driver_attach+0xcb/0x1e0 > > > > Nov 27 23:46:53 main kernel: bus_for_each_dev+0x82/0xd0 > > > > Nov 27 23:46:53 main kernel: bus_add_driver+0x10b/0x1f0 > > > > Nov 27 23:46:53 main kernel: ? __pfx_ct_driver_init+0x10/0x10 [snd_ctxfi] > > > > Nov 27 23:46:53 main kernel: driver_register+0x75/0xe0 > > > > Nov 27 23:46:53 main kernel: do_one_initcall+0x58/0x300 > > > > Nov 27 23:46:53 main kernel: do_init_module+0x62/0x250 > > > > Nov 27 23:46:53 main kernel: ? init_module_from_file+0x8a/0xe0 > > > > Nov 27 23:46:53 main kernel: init_module_from_file+0x8a/0xe0 > > > > Nov 27 23:46:53 main kernel: idempotent_init_module+0x114/0x310 > > > > Nov 27 23:46:53 main kernel: __x64_sys_finit_module+0x6d/0xd0 > > > > Nov 27 23:46:53 main kernel: ? syscall_trace_enter+0x8d/0x1d0 > > > > Nov 27 23:46:53 main kernel: do_syscall_64+0x82/0x320 > > > > Nov 27 23:46:53 main kernel: ? restore_fpregs_from_fpstate+0x46/0xa0 > > > > Nov 27 23:46:53 main kernel: ? switch_fpu_return+0x5b/0xe0 > > > > Nov 27 23:46:53 main kernel: ? do_syscall_64+0x200/0x320 > > > > Nov 27 23:46:53 main kernel: ? exc_page_fault+0x74/0x180 > > > > Nov 27 23:46:53 main kernel: entry_SYSCALL_64_after_hwframe+0x76/0x7e > > > > Nov 27 23:46:53 main kernel: RIP: 0033:0x7f77238f3779 > > > > Nov 27 23:46:53 main kernel: Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 4f 86 0d 00 f7 d8 64 89 01 48 > > > > Nov 27 23:46:53 main kernel: RSP: 002b:00007ffc398103f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000139 > > > > Nov 27 23:46:53 main kernel: RAX: ffffffffffffffda RBX: 000055e0eb622480 RCX: 00007f77238f3779 > > > > Nov 27 23:46:53 main kernel: RDX: 0000000000000004 RSI: 00007f77239f744d RDI: 000000000000001b > > > > Nov 27 23:46:53 main kernel: RBP: 0000000000000004 R08: 0000000000000000 R09: 00007f7723ef6280 > > > > Nov 27 23:46:53 main kernel: R10: 0000000000000000 R11: 0000000000000246 R12: 00007f77239f744d > > > > Nov 27 23:46:53 main kernel: R13: 0000000000020000 R14: 000055e0eb61e630 R15: 0000000000000000 > > > > Nov 27 23:46:53 main kernel: </TASK> > > > > Nov 27 23:46:53 main kernel: ---[ end trace ]--- > > > > > > This was specifically with 6.17.8 but up to the current stable 6.17.9 > > > there should be no related changes afaics. > > > > Thanks for the report. As a wild guess, a simple fix like below > > should suffice for this case? > > > > > > Takashi > > > > -- 8< -- > > --- a/sound/pci/ctxfi/ctamixer.h > > +++ b/sound/pci/ctxfi/ctamixer.h > > @@ -22,7 +22,7 @@ > > /* Define the descriptor of a summation node resource */ > > struct sum { > > struct rsc rsc; /* Basic resource info */ > > - unsigned char idx[8]; > > + unsigned char idx[8 + 1]; /* msr + master */ > > }; > > > > /* Define sum resource request description info */ > > FWIW, I cannot test this myself. "waxhead", can you please test the > proposed patch and report back if it fixes the issue for you? In case you need some support on how to actually do that, we have the "simple patching and building" instruction here: https://kernel-team.pages.debian.net/kernel-handbook/ch-common-tasks.html#id-1.6.6.4 Proceed as follow, create the patch file as posted by Takashi, save it as e.g. ubsan-fix.patch Fetch the linux source apt-get source linux cd linux-* Make sure the required dependencies are installed see the above preparation step in 4.5.1, that is apt-get install build-essential apt-get build-dep linux apt-get install devscripts then within the unpacked linux source run the test-patches script using the proposed patch: debian/bin/test-patches ../ubsan-fix.patch Let me know if you can proceed with that. Regards, Salvatore ^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: Bug#1121535: UBSAN: array-index-out-of-bounds in [...]sound/pci/ctxfi/ctamixer.c:347:48 2025-11-29 8:06 ` Bug#1121535: " Salvatore Bonaccorso @ 2025-12-26 17:21 ` Karsten Hohmeier 2026-01-07 16:29 ` Takashi Iwai 0 siblings, 1 reply; 9+ messages in thread From: Karsten Hohmeier @ 2025-12-26 17:21 UTC (permalink / raw) To: carnil; +Cc: 1121535, linux-kernel, linux-sound, perex, tiwai, tiwai, waxhead Hello. I am another affected user. I applied the suggested patch by Takeshi on top of 6.18.2 (in case it got already fixed). But this just gives > Dez 26 17:24:13: dtest kernel: UBSAN: array-index-out-of-bounds in sound/pci/ctxfi/ctamixer.c:344:48 > Dez 26 17:24:13: dtest kernel: index 10 is out of range for type 'unsigned char [9]' as the error. Making the struct even larger gives > Dez 26 17:39:35 dtest kernel: UBSAN: array-index-out-of-bounds in sound/pci/ctxfi/ctamixer.c:344:48 > Dez 26 17:39:35 dtest kernel: index 32 is out of range for type 'unsigned char [32]' Could you take another look? Regards Karsten ^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: Bug#1121535: UBSAN: array-index-out-of-bounds in [...]sound/pci/ctxfi/ctamixer.c:347:48 2025-12-26 17:21 ` Karsten Hohmeier @ 2026-01-07 16:29 ` Takashi Iwai 2026-01-10 10:39 ` Karsten Hohmeier 2026-01-18 18:48 ` Karsten Hohmeier 0 siblings, 2 replies; 9+ messages in thread From: Takashi Iwai @ 2026-01-07 16:29 UTC (permalink / raw) To: Karsten Hohmeier Cc: carnil, 1121535, linux-kernel, linux-sound, perex, tiwai, tiwai, waxhead On Fri, 26 Dec 2025 18:21:03 +0100, Karsten Hohmeier wrote: > > Hello. I am another affected user. > I applied the suggested patch by Takeshi on top of 6.18.2 (in case it got already fixed). > > But this just gives > > > Dez 26 17:24:13: dtest kernel: UBSAN: array-index-out-of-bounds in sound/pci/ctxfi/ctamixer.c:344:48 > > Dez 26 17:24:13: dtest kernel: index 10 is out of range for type 'unsigned char [9]' > > as the error. Making the struct even larger gives > > > Dez 26 17:39:35 dtest kernel: UBSAN: array-index-out-of-bounds in sound/pci/ctxfi/ctamixer.c:344:48 > > Dez 26 17:39:35 dtest kernel: index 32 is out of range for type 'unsigned char [32]' > > Could you take another look? OK, then we seem scratching a wrong surface. How about the changes below? Takashi -- 8< -- --- a/sound/pci/ctxfi/ctamixer.c +++ b/sound/pci/ctxfi/ctamixer.c @@ -205,6 +205,7 @@ static int amixer_rsc_init(struct amixer *amixer, /* Set amixer specific operations */ amixer->rsc.ops = &amixer_basic_rsc_ops; + amixer->rsc.conj = 0; amixer->ops = &amixer_ops; amixer->input = NULL; amixer->sum = NULL; @@ -367,6 +368,7 @@ static int sum_rsc_init(struct sum *sum, return err; sum->rsc.ops = &sum_basic_rsc_ops; + sum->rsc.conj = 0; return 0; } ^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: Bug#1121535: UBSAN: array-index-out-of-bounds in [...]sound/pci/ctxfi/ctamixer.c:347:48 2026-01-07 16:29 ` Takashi Iwai @ 2026-01-10 10:39 ` Karsten Hohmeier 2026-01-18 18:48 ` Karsten Hohmeier 1 sibling, 0 replies; 9+ messages in thread From: Karsten Hohmeier @ 2026-01-10 10:39 UTC (permalink / raw) To: tiwai Cc: 1121535, carnil, linux-kernel, linux-sound, linux, perex, tiwai, waxhead Hello Takashi. Thank you for the suggested patch. I should have access to the affected machine next weekend and will test it then. Regards Karsten ^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: Bug#1121535: UBSAN: array-index-out-of-bounds in [...]sound/pci/ctxfi/ctamixer.c:347:48 2026-01-07 16:29 ` Takashi Iwai 2026-01-10 10:39 ` Karsten Hohmeier @ 2026-01-18 18:48 ` Karsten Hohmeier 2026-01-19 13:30 ` Takashi Iwai 1 sibling, 1 reply; 9+ messages in thread From: Karsten Hohmeier @ 2026-01-18 18:48 UTC (permalink / raw) To: tiwai Cc: 1121535, carnil, linux-kernel, linux-sound, linux, perex, tiwai, waxhead Hello Takashi, Your second patch works. Boot messages are gone and the soundcard still works as usual. Thumbs up from me for upstreaming this. Karsten ^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: Bug#1121535: UBSAN: array-index-out-of-bounds in [...]sound/pci/ctxfi/ctamixer.c:347:48 2026-01-18 18:48 ` Karsten Hohmeier @ 2026-01-19 13:30 ` Takashi Iwai 0 siblings, 0 replies; 9+ messages in thread From: Takashi Iwai @ 2026-01-19 13:30 UTC (permalink / raw) To: Karsten Hohmeier Cc: tiwai, 1121535, carnil, linux-kernel, linux-sound, perex, tiwai, waxhead On Sun, 18 Jan 2026 19:48:23 +0100, Karsten Hohmeier wrote: > > Hello Takashi, > > Your second patch works. Boot messages are gone and the soundcard still works as usual. > Thumbs up from me for upstreaming this. Good to hear. I'm going to submit a proper patch for the upstream inclusion. thanks, Takashi ^ permalink raw reply [flat|nested] 9+ messages in thread
end of thread, other threads:[~2026-01-19 13:30 UTC | newest]
Thread overview: 9+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
[not found] <176428476762.2962.8176922083972711750.reportbug@main.localdomain>
2025-11-28 6:07 ` UBSAN: array-index-out-of-bounds in [...]sound/pci/ctxfi/ctamixer.c:347:48 Salvatore Bonaccorso
2025-11-28 17:24 ` Takashi Iwai
2025-11-28 19:32 ` Salvatore Bonaccorso
2025-11-29 8:06 ` Bug#1121535: " Salvatore Bonaccorso
2025-12-26 17:21 ` Karsten Hohmeier
2026-01-07 16:29 ` Takashi Iwai
2026-01-10 10:39 ` Karsten Hohmeier
2026-01-18 18:48 ` Karsten Hohmeier
2026-01-19 13:30 ` Takashi Iwai
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox