* UBSAN: array-index-out-of-bounds in [...]sound/pci/ctxfi/ctamixer.c:347:48
[not found] <176428476762.2962.8176922083972711750.reportbug@main.localdomain>
@ 2025-11-28 6:07 ` Salvatore Bonaccorso
2025-11-28 17:24 ` Takashi Iwai
0 siblings, 1 reply; 9+ messages in thread
From: Salvatore Bonaccorso @ 2025-11-28 6:07 UTC (permalink / raw)
To: Jaroslav Kysela, Takashi Iwai; +Cc: waxhead, linux-kernel, linux-sound, 1121535
Hi Jaroslav, hi Takashi
A user in Debian reported (in https://bugs.debian.org/1121535) an
array-index-out-of-bounds affecting ctxfi/ctamixer.c:
On Fri, Nov 28, 2025 at 12:06:07AM +0100, waxhead wrote:
> ------------[ cut here ]------------
> Nov 27 23:46:53 main kernel: UBSAN: array-index-out-of-bounds in /build/reproducible-path/linux-6.17.8/sound/pci/ctxfi/ctamixer.c:347:48
> Nov 27 23:46:53 main kernel: index 8 is out of range for type 'unsigned char [8]'
> Nov 27 23:46:53 main kernel: CPU: 4 UID: 0 PID: 468 Comm: (udev-worker) Not tainted 6.17.8+deb14-amd64 #1 PREEMPT(lazy) Debian 6.17.8-1
> Nov 27 23:46:53 main kernel: Hardware name: FUJITSU /D3446-S2, BIOS V5.0.0.12 R1.26.0 for D3446-S2x 02/11/2020
> Nov 27 23:46:53 main kernel: Call Trace:
> Nov 27 23:46:53 main kernel: <TASK>
> Nov 27 23:46:53 main kernel: dump_stack_lvl+0x5d/0x80
> Nov 27 23:46:53 main kernel: ? __pfx_amixer_set_x+0x10/0x10 [snd_ctxfi]
> Nov 27 23:46:53 main kernel: ubsan_epilogue+0x5/0x2b
> Nov 27 23:46:53 main kernel: __ubsan_handle_out_of_bounds.cold+0x54/0x59
> Nov 27 23:46:53 main kernel: sum_output_slot+0x44/0x70 [snd_ctxfi]
> Nov 27 23:46:53 main kernel: amixer_set_input+0x4b/0x80 [snd_ctxfi]
> Nov 27 23:46:53 main kernel: amixer_setup+0x1b/0x50 [snd_ctxfi]
> Nov 27 23:46:53 main kernel: ct_mixer_create+0x193/0x570 [snd_ctxfi]
> Nov 27 23:46:53 main kernel: ct_atc_create+0x3cb/0x530 [snd_ctxfi]
> Nov 27 23:46:53 main kernel: ct_card_probe+0x104/0x2c0 [snd_ctxfi]
> Nov 27 23:46:53 main kernel: local_pci_probe+0x3f/0x90
> Nov 27 23:46:53 main kernel: pci_device_probe+0xda/0x2b0
> Nov 27 23:46:53 main kernel: ? sysfs_do_create_link_sd+0x6d/0xd0
> Nov 27 23:46:53 main kernel: really_probe+0xdb/0x340
> Nov 27 23:46:53 main kernel: ? pm_runtime_barrier+0x55/0x90
> Nov 27 23:46:53 main kernel: __driver_probe_device+0x78/0x140
> Nov 27 23:46:53 main kernel: driver_probe_device+0x1f/0xa0
> Nov 27 23:46:53 main kernel: ? __pfx___driver_attach+0x10/0x10
> Nov 27 23:46:53 main kernel: __driver_attach+0xcb/0x1e0
> Nov 27 23:46:53 main kernel: bus_for_each_dev+0x82/0xd0
> Nov 27 23:46:53 main kernel: bus_add_driver+0x10b/0x1f0
> Nov 27 23:46:53 main kernel: ? __pfx_ct_driver_init+0x10/0x10 [snd_ctxfi]
> Nov 27 23:46:53 main kernel: driver_register+0x75/0xe0
> Nov 27 23:46:53 main kernel: do_one_initcall+0x58/0x300
> Nov 27 23:46:53 main kernel: do_init_module+0x62/0x250
> Nov 27 23:46:53 main kernel: ? init_module_from_file+0x8a/0xe0
> Nov 27 23:46:53 main kernel: init_module_from_file+0x8a/0xe0
> Nov 27 23:46:53 main kernel: idempotent_init_module+0x114/0x310
> Nov 27 23:46:53 main kernel: __x64_sys_finit_module+0x6d/0xd0
> Nov 27 23:46:53 main kernel: ? syscall_trace_enter+0x8d/0x1d0
> Nov 27 23:46:53 main kernel: do_syscall_64+0x82/0x320
> Nov 27 23:46:53 main kernel: ? restore_fpregs_from_fpstate+0x46/0xa0
> Nov 27 23:46:53 main kernel: ? switch_fpu_return+0x5b/0xe0
> Nov 27 23:46:53 main kernel: ? do_syscall_64+0x200/0x320
> Nov 27 23:46:53 main kernel: ? exc_page_fault+0x74/0x180
> Nov 27 23:46:53 main kernel: entry_SYSCALL_64_after_hwframe+0x76/0x7e
> Nov 27 23:46:53 main kernel: RIP: 0033:0x7f77238f3779
> Nov 27 23:46:53 main kernel: Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 4f 86 0d 00 f7 d8 64 89 01 48
> Nov 27 23:46:53 main kernel: RSP: 002b:00007ffc398103f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000139
> Nov 27 23:46:53 main kernel: RAX: ffffffffffffffda RBX: 000055e0eb622480 RCX: 00007f77238f3779
> Nov 27 23:46:53 main kernel: RDX: 0000000000000004 RSI: 00007f77239f744d RDI: 000000000000001b
> Nov 27 23:46:53 main kernel: RBP: 0000000000000004 R08: 0000000000000000 R09: 00007f7723ef6280
> Nov 27 23:46:53 main kernel: R10: 0000000000000000 R11: 0000000000000246 R12: 00007f77239f744d
> Nov 27 23:46:53 main kernel: R13: 0000000000020000 R14: 000055e0eb61e630 R15: 0000000000000000
> Nov 27 23:46:53 main kernel: </TASK>
> Nov 27 23:46:53 main kernel: ---[ end trace ]---
This was specifically with 6.17.8 but up to the current stable 6.17.9
there should be no related changes afaics.
Regards,
Salvatore
^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: UBSAN: array-index-out-of-bounds in [...]sound/pci/ctxfi/ctamixer.c:347:48
2025-11-28 6:07 ` UBSAN: array-index-out-of-bounds in [...]sound/pci/ctxfi/ctamixer.c:347:48 Salvatore Bonaccorso
@ 2025-11-28 17:24 ` Takashi Iwai
2025-11-28 19:32 ` Salvatore Bonaccorso
0 siblings, 1 reply; 9+ messages in thread
From: Takashi Iwai @ 2025-11-28 17:24 UTC (permalink / raw)
To: Salvatore Bonaccorso
Cc: Jaroslav Kysela, Takashi Iwai, waxhead, linux-kernel, linux-sound,
1121535
On Fri, 28 Nov 2025 07:07:36 +0100,
Salvatore Bonaccorso wrote:
>
> Hi Jaroslav, hi Takashi
>
> A user in Debian reported (in https://bugs.debian.org/1121535) an
> array-index-out-of-bounds affecting ctxfi/ctamixer.c:
>
> On Fri, Nov 28, 2025 at 12:06:07AM +0100, waxhead wrote:
> > ------------[ cut here ]------------
> > Nov 27 23:46:53 main kernel: UBSAN: array-index-out-of-bounds in /build/reproducible-path/linux-6.17.8/sound/pci/ctxfi/ctamixer.c:347:48
> > Nov 27 23:46:53 main kernel: index 8 is out of range for type 'unsigned char [8]'
> > Nov 27 23:46:53 main kernel: CPU: 4 UID: 0 PID: 468 Comm: (udev-worker) Not tainted 6.17.8+deb14-amd64 #1 PREEMPT(lazy) Debian 6.17.8-1
> > Nov 27 23:46:53 main kernel: Hardware name: FUJITSU /D3446-S2, BIOS V5.0.0.12 R1.26.0 for D3446-S2x 02/11/2020
> > Nov 27 23:46:53 main kernel: Call Trace:
> > Nov 27 23:46:53 main kernel: <TASK>
> > Nov 27 23:46:53 main kernel: dump_stack_lvl+0x5d/0x80
> > Nov 27 23:46:53 main kernel: ? __pfx_amixer_set_x+0x10/0x10 [snd_ctxfi]
> > Nov 27 23:46:53 main kernel: ubsan_epilogue+0x5/0x2b
> > Nov 27 23:46:53 main kernel: __ubsan_handle_out_of_bounds.cold+0x54/0x59
> > Nov 27 23:46:53 main kernel: sum_output_slot+0x44/0x70 [snd_ctxfi]
> > Nov 27 23:46:53 main kernel: amixer_set_input+0x4b/0x80 [snd_ctxfi]
> > Nov 27 23:46:53 main kernel: amixer_setup+0x1b/0x50 [snd_ctxfi]
> > Nov 27 23:46:53 main kernel: ct_mixer_create+0x193/0x570 [snd_ctxfi]
> > Nov 27 23:46:53 main kernel: ct_atc_create+0x3cb/0x530 [snd_ctxfi]
> > Nov 27 23:46:53 main kernel: ct_card_probe+0x104/0x2c0 [snd_ctxfi]
> > Nov 27 23:46:53 main kernel: local_pci_probe+0x3f/0x90
> > Nov 27 23:46:53 main kernel: pci_device_probe+0xda/0x2b0
> > Nov 27 23:46:53 main kernel: ? sysfs_do_create_link_sd+0x6d/0xd0
> > Nov 27 23:46:53 main kernel: really_probe+0xdb/0x340
> > Nov 27 23:46:53 main kernel: ? pm_runtime_barrier+0x55/0x90
> > Nov 27 23:46:53 main kernel: __driver_probe_device+0x78/0x140
> > Nov 27 23:46:53 main kernel: driver_probe_device+0x1f/0xa0
> > Nov 27 23:46:53 main kernel: ? __pfx___driver_attach+0x10/0x10
> > Nov 27 23:46:53 main kernel: __driver_attach+0xcb/0x1e0
> > Nov 27 23:46:53 main kernel: bus_for_each_dev+0x82/0xd0
> > Nov 27 23:46:53 main kernel: bus_add_driver+0x10b/0x1f0
> > Nov 27 23:46:53 main kernel: ? __pfx_ct_driver_init+0x10/0x10 [snd_ctxfi]
> > Nov 27 23:46:53 main kernel: driver_register+0x75/0xe0
> > Nov 27 23:46:53 main kernel: do_one_initcall+0x58/0x300
> > Nov 27 23:46:53 main kernel: do_init_module+0x62/0x250
> > Nov 27 23:46:53 main kernel: ? init_module_from_file+0x8a/0xe0
> > Nov 27 23:46:53 main kernel: init_module_from_file+0x8a/0xe0
> > Nov 27 23:46:53 main kernel: idempotent_init_module+0x114/0x310
> > Nov 27 23:46:53 main kernel: __x64_sys_finit_module+0x6d/0xd0
> > Nov 27 23:46:53 main kernel: ? syscall_trace_enter+0x8d/0x1d0
> > Nov 27 23:46:53 main kernel: do_syscall_64+0x82/0x320
> > Nov 27 23:46:53 main kernel: ? restore_fpregs_from_fpstate+0x46/0xa0
> > Nov 27 23:46:53 main kernel: ? switch_fpu_return+0x5b/0xe0
> > Nov 27 23:46:53 main kernel: ? do_syscall_64+0x200/0x320
> > Nov 27 23:46:53 main kernel: ? exc_page_fault+0x74/0x180
> > Nov 27 23:46:53 main kernel: entry_SYSCALL_64_after_hwframe+0x76/0x7e
> > Nov 27 23:46:53 main kernel: RIP: 0033:0x7f77238f3779
> > Nov 27 23:46:53 main kernel: Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 4f 86 0d 00 f7 d8 64 89 01 48
> > Nov 27 23:46:53 main kernel: RSP: 002b:00007ffc398103f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000139
> > Nov 27 23:46:53 main kernel: RAX: ffffffffffffffda RBX: 000055e0eb622480 RCX: 00007f77238f3779
> > Nov 27 23:46:53 main kernel: RDX: 0000000000000004 RSI: 00007f77239f744d RDI: 000000000000001b
> > Nov 27 23:46:53 main kernel: RBP: 0000000000000004 R08: 0000000000000000 R09: 00007f7723ef6280
> > Nov 27 23:46:53 main kernel: R10: 0000000000000000 R11: 0000000000000246 R12: 00007f77239f744d
> > Nov 27 23:46:53 main kernel: R13: 0000000000020000 R14: 000055e0eb61e630 R15: 0000000000000000
> > Nov 27 23:46:53 main kernel: </TASK>
> > Nov 27 23:46:53 main kernel: ---[ end trace ]---
>
> This was specifically with 6.17.8 but up to the current stable 6.17.9
> there should be no related changes afaics.
Thanks for the report. As a wild guess, a simple fix like below
should suffice for this case?
Takashi
-- 8< --
--- a/sound/pci/ctxfi/ctamixer.h
+++ b/sound/pci/ctxfi/ctamixer.h
@@ -22,7 +22,7 @@
/* Define the descriptor of a summation node resource */
struct sum {
struct rsc rsc; /* Basic resource info */
- unsigned char idx[8];
+ unsigned char idx[8 + 1]; /* msr + master */
};
/* Define sum resource request description info */
^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: UBSAN: array-index-out-of-bounds in [...]sound/pci/ctxfi/ctamixer.c:347:48
2025-11-28 17:24 ` Takashi Iwai
@ 2025-11-28 19:32 ` Salvatore Bonaccorso
2025-11-29 8:06 ` Bug#1121535: " Salvatore Bonaccorso
0 siblings, 1 reply; 9+ messages in thread
From: Salvatore Bonaccorso @ 2025-11-28 19:32 UTC (permalink / raw)
To: Takashi Iwai, waxhead
Cc: Jaroslav Kysela, Takashi Iwai, waxhead, linux-kernel, linux-sound,
1121535
Hi Takeshi,
On Fri, Nov 28, 2025 at 06:24:43PM +0100, Takashi Iwai wrote:
> On Fri, 28 Nov 2025 07:07:36 +0100,
> Salvatore Bonaccorso wrote:
> >
> > Hi Jaroslav, hi Takashi
> >
> > A user in Debian reported (in https://bugs.debian.org/1121535) an
> > array-index-out-of-bounds affecting ctxfi/ctamixer.c:
> >
> > On Fri, Nov 28, 2025 at 12:06:07AM +0100, waxhead wrote:
> > > ------------[ cut here ]------------
> > > Nov 27 23:46:53 main kernel: UBSAN: array-index-out-of-bounds in /build/reproducible-path/linux-6.17.8/sound/pci/ctxfi/ctamixer.c:347:48
> > > Nov 27 23:46:53 main kernel: index 8 is out of range for type 'unsigned char [8]'
> > > Nov 27 23:46:53 main kernel: CPU: 4 UID: 0 PID: 468 Comm: (udev-worker) Not tainted 6.17.8+deb14-amd64 #1 PREEMPT(lazy) Debian 6.17.8-1
> > > Nov 27 23:46:53 main kernel: Hardware name: FUJITSU /D3446-S2, BIOS V5.0.0.12 R1.26.0 for D3446-S2x 02/11/2020
> > > Nov 27 23:46:53 main kernel: Call Trace:
> > > Nov 27 23:46:53 main kernel: <TASK>
> > > Nov 27 23:46:53 main kernel: dump_stack_lvl+0x5d/0x80
> > > Nov 27 23:46:53 main kernel: ? __pfx_amixer_set_x+0x10/0x10 [snd_ctxfi]
> > > Nov 27 23:46:53 main kernel: ubsan_epilogue+0x5/0x2b
> > > Nov 27 23:46:53 main kernel: __ubsan_handle_out_of_bounds.cold+0x54/0x59
> > > Nov 27 23:46:53 main kernel: sum_output_slot+0x44/0x70 [snd_ctxfi]
> > > Nov 27 23:46:53 main kernel: amixer_set_input+0x4b/0x80 [snd_ctxfi]
> > > Nov 27 23:46:53 main kernel: amixer_setup+0x1b/0x50 [snd_ctxfi]
> > > Nov 27 23:46:53 main kernel: ct_mixer_create+0x193/0x570 [snd_ctxfi]
> > > Nov 27 23:46:53 main kernel: ct_atc_create+0x3cb/0x530 [snd_ctxfi]
> > > Nov 27 23:46:53 main kernel: ct_card_probe+0x104/0x2c0 [snd_ctxfi]
> > > Nov 27 23:46:53 main kernel: local_pci_probe+0x3f/0x90
> > > Nov 27 23:46:53 main kernel: pci_device_probe+0xda/0x2b0
> > > Nov 27 23:46:53 main kernel: ? sysfs_do_create_link_sd+0x6d/0xd0
> > > Nov 27 23:46:53 main kernel: really_probe+0xdb/0x340
> > > Nov 27 23:46:53 main kernel: ? pm_runtime_barrier+0x55/0x90
> > > Nov 27 23:46:53 main kernel: __driver_probe_device+0x78/0x140
> > > Nov 27 23:46:53 main kernel: driver_probe_device+0x1f/0xa0
> > > Nov 27 23:46:53 main kernel: ? __pfx___driver_attach+0x10/0x10
> > > Nov 27 23:46:53 main kernel: __driver_attach+0xcb/0x1e0
> > > Nov 27 23:46:53 main kernel: bus_for_each_dev+0x82/0xd0
> > > Nov 27 23:46:53 main kernel: bus_add_driver+0x10b/0x1f0
> > > Nov 27 23:46:53 main kernel: ? __pfx_ct_driver_init+0x10/0x10 [snd_ctxfi]
> > > Nov 27 23:46:53 main kernel: driver_register+0x75/0xe0
> > > Nov 27 23:46:53 main kernel: do_one_initcall+0x58/0x300
> > > Nov 27 23:46:53 main kernel: do_init_module+0x62/0x250
> > > Nov 27 23:46:53 main kernel: ? init_module_from_file+0x8a/0xe0
> > > Nov 27 23:46:53 main kernel: init_module_from_file+0x8a/0xe0
> > > Nov 27 23:46:53 main kernel: idempotent_init_module+0x114/0x310
> > > Nov 27 23:46:53 main kernel: __x64_sys_finit_module+0x6d/0xd0
> > > Nov 27 23:46:53 main kernel: ? syscall_trace_enter+0x8d/0x1d0
> > > Nov 27 23:46:53 main kernel: do_syscall_64+0x82/0x320
> > > Nov 27 23:46:53 main kernel: ? restore_fpregs_from_fpstate+0x46/0xa0
> > > Nov 27 23:46:53 main kernel: ? switch_fpu_return+0x5b/0xe0
> > > Nov 27 23:46:53 main kernel: ? do_syscall_64+0x200/0x320
> > > Nov 27 23:46:53 main kernel: ? exc_page_fault+0x74/0x180
> > > Nov 27 23:46:53 main kernel: entry_SYSCALL_64_after_hwframe+0x76/0x7e
> > > Nov 27 23:46:53 main kernel: RIP: 0033:0x7f77238f3779
> > > Nov 27 23:46:53 main kernel: Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 4f 86 0d 00 f7 d8 64 89 01 48
> > > Nov 27 23:46:53 main kernel: RSP: 002b:00007ffc398103f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000139
> > > Nov 27 23:46:53 main kernel: RAX: ffffffffffffffda RBX: 000055e0eb622480 RCX: 00007f77238f3779
> > > Nov 27 23:46:53 main kernel: RDX: 0000000000000004 RSI: 00007f77239f744d RDI: 000000000000001b
> > > Nov 27 23:46:53 main kernel: RBP: 0000000000000004 R08: 0000000000000000 R09: 00007f7723ef6280
> > > Nov 27 23:46:53 main kernel: R10: 0000000000000000 R11: 0000000000000246 R12: 00007f77239f744d
> > > Nov 27 23:46:53 main kernel: R13: 0000000000020000 R14: 000055e0eb61e630 R15: 0000000000000000
> > > Nov 27 23:46:53 main kernel: </TASK>
> > > Nov 27 23:46:53 main kernel: ---[ end trace ]---
> >
> > This was specifically with 6.17.8 but up to the current stable 6.17.9
> > there should be no related changes afaics.
>
> Thanks for the report. As a wild guess, a simple fix like below
> should suffice for this case?
>
>
> Takashi
>
> -- 8< --
> --- a/sound/pci/ctxfi/ctamixer.h
> +++ b/sound/pci/ctxfi/ctamixer.h
> @@ -22,7 +22,7 @@
> /* Define the descriptor of a summation node resource */
> struct sum {
> struct rsc rsc; /* Basic resource info */
> - unsigned char idx[8];
> + unsigned char idx[8 + 1]; /* msr + master */
> };
>
> /* Define sum resource request description info */
FWIW, I cannot test this myself. "waxhead", can you please test the
proposed patch and report back if it fixes the issue for you?
Regards,
Salvatore
^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: Bug#1121535: UBSAN: array-index-out-of-bounds in [...]sound/pci/ctxfi/ctamixer.c:347:48
2025-11-28 19:32 ` Salvatore Bonaccorso
@ 2025-11-29 8:06 ` Salvatore Bonaccorso
2025-12-26 17:21 ` Karsten Hohmeier
0 siblings, 1 reply; 9+ messages in thread
From: Salvatore Bonaccorso @ 2025-11-29 8:06 UTC (permalink / raw)
To: waxhead, 1121535
Cc: Takashi Iwai, Jaroslav Kysela, Takashi Iwai, linux-kernel,
linux-sound
Hi,
On Fri, Nov 28, 2025 at 08:32:21PM +0100, Salvatore Bonaccorso wrote:
> Hi Takeshi,
>
> On Fri, Nov 28, 2025 at 06:24:43PM +0100, Takashi Iwai wrote:
> > On Fri, 28 Nov 2025 07:07:36 +0100,
> > Salvatore Bonaccorso wrote:
> > >
> > > Hi Jaroslav, hi Takashi
> > >
> > > A user in Debian reported (in https://bugs.debian.org/1121535) an
> > > array-index-out-of-bounds affecting ctxfi/ctamixer.c:
> > >
> > > On Fri, Nov 28, 2025 at 12:06:07AM +0100, waxhead wrote:
> > > > ------------[ cut here ]------------
> > > > Nov 27 23:46:53 main kernel: UBSAN: array-index-out-of-bounds in /build/reproducible-path/linux-6.17.8/sound/pci/ctxfi/ctamixer.c:347:48
> > > > Nov 27 23:46:53 main kernel: index 8 is out of range for type 'unsigned char [8]'
> > > > Nov 27 23:46:53 main kernel: CPU: 4 UID: 0 PID: 468 Comm: (udev-worker) Not tainted 6.17.8+deb14-amd64 #1 PREEMPT(lazy) Debian 6.17.8-1
> > > > Nov 27 23:46:53 main kernel: Hardware name: FUJITSU /D3446-S2, BIOS V5.0.0.12 R1.26.0 for D3446-S2x 02/11/2020
> > > > Nov 27 23:46:53 main kernel: Call Trace:
> > > > Nov 27 23:46:53 main kernel: <TASK>
> > > > Nov 27 23:46:53 main kernel: dump_stack_lvl+0x5d/0x80
> > > > Nov 27 23:46:53 main kernel: ? __pfx_amixer_set_x+0x10/0x10 [snd_ctxfi]
> > > > Nov 27 23:46:53 main kernel: ubsan_epilogue+0x5/0x2b
> > > > Nov 27 23:46:53 main kernel: __ubsan_handle_out_of_bounds.cold+0x54/0x59
> > > > Nov 27 23:46:53 main kernel: sum_output_slot+0x44/0x70 [snd_ctxfi]
> > > > Nov 27 23:46:53 main kernel: amixer_set_input+0x4b/0x80 [snd_ctxfi]
> > > > Nov 27 23:46:53 main kernel: amixer_setup+0x1b/0x50 [snd_ctxfi]
> > > > Nov 27 23:46:53 main kernel: ct_mixer_create+0x193/0x570 [snd_ctxfi]
> > > > Nov 27 23:46:53 main kernel: ct_atc_create+0x3cb/0x530 [snd_ctxfi]
> > > > Nov 27 23:46:53 main kernel: ct_card_probe+0x104/0x2c0 [snd_ctxfi]
> > > > Nov 27 23:46:53 main kernel: local_pci_probe+0x3f/0x90
> > > > Nov 27 23:46:53 main kernel: pci_device_probe+0xda/0x2b0
> > > > Nov 27 23:46:53 main kernel: ? sysfs_do_create_link_sd+0x6d/0xd0
> > > > Nov 27 23:46:53 main kernel: really_probe+0xdb/0x340
> > > > Nov 27 23:46:53 main kernel: ? pm_runtime_barrier+0x55/0x90
> > > > Nov 27 23:46:53 main kernel: __driver_probe_device+0x78/0x140
> > > > Nov 27 23:46:53 main kernel: driver_probe_device+0x1f/0xa0
> > > > Nov 27 23:46:53 main kernel: ? __pfx___driver_attach+0x10/0x10
> > > > Nov 27 23:46:53 main kernel: __driver_attach+0xcb/0x1e0
> > > > Nov 27 23:46:53 main kernel: bus_for_each_dev+0x82/0xd0
> > > > Nov 27 23:46:53 main kernel: bus_add_driver+0x10b/0x1f0
> > > > Nov 27 23:46:53 main kernel: ? __pfx_ct_driver_init+0x10/0x10 [snd_ctxfi]
> > > > Nov 27 23:46:53 main kernel: driver_register+0x75/0xe0
> > > > Nov 27 23:46:53 main kernel: do_one_initcall+0x58/0x300
> > > > Nov 27 23:46:53 main kernel: do_init_module+0x62/0x250
> > > > Nov 27 23:46:53 main kernel: ? init_module_from_file+0x8a/0xe0
> > > > Nov 27 23:46:53 main kernel: init_module_from_file+0x8a/0xe0
> > > > Nov 27 23:46:53 main kernel: idempotent_init_module+0x114/0x310
> > > > Nov 27 23:46:53 main kernel: __x64_sys_finit_module+0x6d/0xd0
> > > > Nov 27 23:46:53 main kernel: ? syscall_trace_enter+0x8d/0x1d0
> > > > Nov 27 23:46:53 main kernel: do_syscall_64+0x82/0x320
> > > > Nov 27 23:46:53 main kernel: ? restore_fpregs_from_fpstate+0x46/0xa0
> > > > Nov 27 23:46:53 main kernel: ? switch_fpu_return+0x5b/0xe0
> > > > Nov 27 23:46:53 main kernel: ? do_syscall_64+0x200/0x320
> > > > Nov 27 23:46:53 main kernel: ? exc_page_fault+0x74/0x180
> > > > Nov 27 23:46:53 main kernel: entry_SYSCALL_64_after_hwframe+0x76/0x7e
> > > > Nov 27 23:46:53 main kernel: RIP: 0033:0x7f77238f3779
> > > > Nov 27 23:46:53 main kernel: Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 4f 86 0d 00 f7 d8 64 89 01 48
> > > > Nov 27 23:46:53 main kernel: RSP: 002b:00007ffc398103f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000139
> > > > Nov 27 23:46:53 main kernel: RAX: ffffffffffffffda RBX: 000055e0eb622480 RCX: 00007f77238f3779
> > > > Nov 27 23:46:53 main kernel: RDX: 0000000000000004 RSI: 00007f77239f744d RDI: 000000000000001b
> > > > Nov 27 23:46:53 main kernel: RBP: 0000000000000004 R08: 0000000000000000 R09: 00007f7723ef6280
> > > > Nov 27 23:46:53 main kernel: R10: 0000000000000000 R11: 0000000000000246 R12: 00007f77239f744d
> > > > Nov 27 23:46:53 main kernel: R13: 0000000000020000 R14: 000055e0eb61e630 R15: 0000000000000000
> > > > Nov 27 23:46:53 main kernel: </TASK>
> > > > Nov 27 23:46:53 main kernel: ---[ end trace ]---
> > >
> > > This was specifically with 6.17.8 but up to the current stable 6.17.9
> > > there should be no related changes afaics.
> >
> > Thanks for the report. As a wild guess, a simple fix like below
> > should suffice for this case?
> >
> >
> > Takashi
> >
> > -- 8< --
> > --- a/sound/pci/ctxfi/ctamixer.h
> > +++ b/sound/pci/ctxfi/ctamixer.h
> > @@ -22,7 +22,7 @@
> > /* Define the descriptor of a summation node resource */
> > struct sum {
> > struct rsc rsc; /* Basic resource info */
> > - unsigned char idx[8];
> > + unsigned char idx[8 + 1]; /* msr + master */
> > };
> >
> > /* Define sum resource request description info */
>
> FWIW, I cannot test this myself. "waxhead", can you please test the
> proposed patch and report back if it fixes the issue for you?
In case you need some support on how to actually do that, we have the
"simple patching and building" instruction here:
https://kernel-team.pages.debian.net/kernel-handbook/ch-common-tasks.html#id-1.6.6.4
Proceed as follow, create the patch file as posted by Takashi, save it
as e.g. ubsan-fix.patch
Fetch the linux source
apt-get source linux
cd linux-*
Make sure the required dependencies are installed see the above
preparation step in 4.5.1, that is
apt-get install build-essential
apt-get build-dep linux
apt-get install devscripts
then within the unpacked linux source run the test-patches script
using the proposed patch:
debian/bin/test-patches ../ubsan-fix.patch
Let me know if you can proceed with that.
Regards,
Salvatore
^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: Bug#1121535: UBSAN: array-index-out-of-bounds in [...]sound/pci/ctxfi/ctamixer.c:347:48
2025-11-29 8:06 ` Bug#1121535: " Salvatore Bonaccorso
@ 2025-12-26 17:21 ` Karsten Hohmeier
2026-01-07 16:29 ` Takashi Iwai
0 siblings, 1 reply; 9+ messages in thread
From: Karsten Hohmeier @ 2025-12-26 17:21 UTC (permalink / raw)
To: carnil; +Cc: 1121535, linux-kernel, linux-sound, perex, tiwai, tiwai, waxhead
Hello. I am another affected user.
I applied the suggested patch by Takeshi on top of 6.18.2 (in case it got already fixed).
But this just gives
> Dez 26 17:24:13: dtest kernel: UBSAN: array-index-out-of-bounds in sound/pci/ctxfi/ctamixer.c:344:48
> Dez 26 17:24:13: dtest kernel: index 10 is out of range for type 'unsigned char [9]'
as the error. Making the struct even larger gives
> Dez 26 17:39:35 dtest kernel: UBSAN: array-index-out-of-bounds in sound/pci/ctxfi/ctamixer.c:344:48
> Dez 26 17:39:35 dtest kernel: index 32 is out of range for type 'unsigned char [32]'
Could you take another look?
Regards
Karsten
^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: Bug#1121535: UBSAN: array-index-out-of-bounds in [...]sound/pci/ctxfi/ctamixer.c:347:48
2025-12-26 17:21 ` Karsten Hohmeier
@ 2026-01-07 16:29 ` Takashi Iwai
2026-01-10 10:39 ` Karsten Hohmeier
2026-01-18 18:48 ` Karsten Hohmeier
0 siblings, 2 replies; 9+ messages in thread
From: Takashi Iwai @ 2026-01-07 16:29 UTC (permalink / raw)
To: Karsten Hohmeier
Cc: carnil, 1121535, linux-kernel, linux-sound, perex, tiwai, tiwai,
waxhead
On Fri, 26 Dec 2025 18:21:03 +0100,
Karsten Hohmeier wrote:
>
> Hello. I am another affected user.
> I applied the suggested patch by Takeshi on top of 6.18.2 (in case it got already fixed).
>
> But this just gives
>
> > Dez 26 17:24:13: dtest kernel: UBSAN: array-index-out-of-bounds in sound/pci/ctxfi/ctamixer.c:344:48
> > Dez 26 17:24:13: dtest kernel: index 10 is out of range for type 'unsigned char [9]'
>
> as the error. Making the struct even larger gives
>
> > Dez 26 17:39:35 dtest kernel: UBSAN: array-index-out-of-bounds in sound/pci/ctxfi/ctamixer.c:344:48
> > Dez 26 17:39:35 dtest kernel: index 32 is out of range for type 'unsigned char [32]'
>
> Could you take another look?
OK, then we seem scratching a wrong surface.
How about the changes below?
Takashi
-- 8< --
--- a/sound/pci/ctxfi/ctamixer.c
+++ b/sound/pci/ctxfi/ctamixer.c
@@ -205,6 +205,7 @@ static int amixer_rsc_init(struct amixer *amixer,
/* Set amixer specific operations */
amixer->rsc.ops = &amixer_basic_rsc_ops;
+ amixer->rsc.conj = 0;
amixer->ops = &amixer_ops;
amixer->input = NULL;
amixer->sum = NULL;
@@ -367,6 +368,7 @@ static int sum_rsc_init(struct sum *sum,
return err;
sum->rsc.ops = &sum_basic_rsc_ops;
+ sum->rsc.conj = 0;
return 0;
}
^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: Bug#1121535: UBSAN: array-index-out-of-bounds in [...]sound/pci/ctxfi/ctamixer.c:347:48
2026-01-07 16:29 ` Takashi Iwai
@ 2026-01-10 10:39 ` Karsten Hohmeier
2026-01-18 18:48 ` Karsten Hohmeier
1 sibling, 0 replies; 9+ messages in thread
From: Karsten Hohmeier @ 2026-01-10 10:39 UTC (permalink / raw)
To: tiwai
Cc: 1121535, carnil, linux-kernel, linux-sound, linux, perex, tiwai,
waxhead
Hello Takashi.
Thank you for the suggested patch.
I should have access to the affected machine next weekend and will test it then.
Regards
Karsten
^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: Bug#1121535: UBSAN: array-index-out-of-bounds in [...]sound/pci/ctxfi/ctamixer.c:347:48
2026-01-07 16:29 ` Takashi Iwai
2026-01-10 10:39 ` Karsten Hohmeier
@ 2026-01-18 18:48 ` Karsten Hohmeier
2026-01-19 13:30 ` Takashi Iwai
1 sibling, 1 reply; 9+ messages in thread
From: Karsten Hohmeier @ 2026-01-18 18:48 UTC (permalink / raw)
To: tiwai
Cc: 1121535, carnil, linux-kernel, linux-sound, linux, perex, tiwai,
waxhead
Hello Takashi,
Your second patch works. Boot messages are gone and the soundcard still works as usual.
Thumbs up from me for upstreaming this.
Karsten
^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: Bug#1121535: UBSAN: array-index-out-of-bounds in [...]sound/pci/ctxfi/ctamixer.c:347:48
2026-01-18 18:48 ` Karsten Hohmeier
@ 2026-01-19 13:30 ` Takashi Iwai
0 siblings, 0 replies; 9+ messages in thread
From: Takashi Iwai @ 2026-01-19 13:30 UTC (permalink / raw)
To: Karsten Hohmeier
Cc: tiwai, 1121535, carnil, linux-kernel, linux-sound, perex, tiwai,
waxhead
On Sun, 18 Jan 2026 19:48:23 +0100,
Karsten Hohmeier wrote:
>
> Hello Takashi,
>
> Your second patch works. Boot messages are gone and the soundcard still works as usual.
> Thumbs up from me for upstreaming this.
Good to hear. I'm going to submit a proper patch for the upstream
inclusion.
thanks,
Takashi
^ permalink raw reply [flat|nested] 9+ messages in thread
end of thread, other threads:[~2026-01-19 13:30 UTC | newest]
Thread overview: 9+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
[not found] <176428476762.2962.8176922083972711750.reportbug@main.localdomain>
2025-11-28 6:07 ` UBSAN: array-index-out-of-bounds in [...]sound/pci/ctxfi/ctamixer.c:347:48 Salvatore Bonaccorso
2025-11-28 17:24 ` Takashi Iwai
2025-11-28 19:32 ` Salvatore Bonaccorso
2025-11-29 8:06 ` Bug#1121535: " Salvatore Bonaccorso
2025-12-26 17:21 ` Karsten Hohmeier
2026-01-07 16:29 ` Takashi Iwai
2026-01-10 10:39 ` Karsten Hohmeier
2026-01-18 18:48 ` Karsten Hohmeier
2026-01-19 13:30 ` Takashi Iwai
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox