UBSAN spat in valid xhci code in Linus's current tree (6.4+)

UBSAN spat in valid xhci code in Linus's current tree (6.4+)

[Greg KH]

Hi Kees.

Boris just reported to me a UBSAN splat in the USB xhci driver in
Linus's tree that wasn't present in 6.4-final, and given that no USB
changes are merged yet there, I was confused.

Turns out, I think you all missed a "variable length" structure in the
xhci driver, which UBSAN is calling out a being an overrun, when really
it isn't (it's just written that way...)

The splat is:

UBSAN: array-index-out-of-bounds in drivers/usb/host/xhci-hub.c:231:31
index 1 is out of range for type '__le32 [1]'
CPU: 0 PID: 1556 Comm: kworker/0:2 Not tainted 6.4.0+ #7


And yes, the code there:
	ssp_cap->bmSublinkSpeedAttr[offset++] = cpu_to_le32(attr);

is accessing the ssp_cap->bmSublinkSpeedAttr field with is declared as:
	_le32 bmSublinkSpeedAttr[1]; /* list of sublink speed attrib entries */

in include/uapi/linux/usb/ch9.h

So perhaps 2d47c6956ab3 ("ubsan: Tighten UBSAN_BOUNDS on GCC") should be
reverted for now?  Or this field fixed up to properly be marked as a
variable length array of at least one entry?

thanks,

greg k-h

Re: UBSAN spat in valid xhci code in Linus's current tree (6.4+)

[Kees Cook]

On Thu, Jun 29, 2023 at 05:36:51PM +0200, Greg KH wrote:
> Boris just reported to me a UBSAN splat in the USB xhci driver in
> Linus's tree that wasn't present in 6.4-final, and given that no USB
> changes are merged yet there, I was confused.
> 
> Turns out, I think you all missed a "variable length" structure in the
> xhci driver, which UBSAN is calling out a being an overrun, when really
> it isn't (it's just written that way...)
> 
> The splat is:
> 
> UBSAN: array-index-out-of-bounds in drivers/usb/host/xhci-hub.c:231:31
> index 1 is out of range for type '__le32 [1]'
> CPU: 0 PID: 1556 Comm: kworker/0:2 Not tainted 6.4.0+ #7

This is fixed here, a couple weeks ago, but maybe it missed your tree:
https://lore.kernel.org/lkml/20230614181307.gonna.256-kees@kernel.org/

Would you prefer I carry it?

> So perhaps 2d47c6956ab3 ("ubsan: Tighten UBSAN_BOUNDS on GCC") should be
> reverted for now?  Or this field fixed up to properly be marked as a
> variable length array of at least one entry?

We've been turning these things on further and further so we can catch
stuff like this (and we did while it lived in -next). FWIW, it shouldn't
cause any problems beyond the splat (i.e. everything should continue
working normally).

-Kees

-- 
Kees Cook

Re: UBSAN spat in valid xhci code in Linus's current tree (6.4+)

[Greg KH]

On Thu, Jun 29, 2023 at 11:58:43AM -0700, Kees Cook wrote:
> On Thu, Jun 29, 2023 at 05:36:51PM +0200, Greg KH wrote:
> > Boris just reported to me a UBSAN splat in the USB xhci driver in
> > Linus's tree that wasn't present in 6.4-final, and given that no USB
> > changes are merged yet there, I was confused.
> > 
> > Turns out, I think you all missed a "variable length" structure in the
> > xhci driver, which UBSAN is calling out a being an overrun, when really
> > it isn't (it's just written that way...)
> > 
> > The splat is:
> > 
> > UBSAN: array-index-out-of-bounds in drivers/usb/host/xhci-hub.c:231:31
> > index 1 is out of range for type '__le32 [1]'
> > CPU: 0 PID: 1556 Comm: kworker/0:2 Not tainted 6.4.0+ #7
> 
> This is fixed here, a couple weeks ago, but maybe it missed your tree:
> https://lore.kernel.org/lkml/20230614181307.gonna.256-kees@kernel.org/
> 
> Would you prefer I carry it?

To confirm, that's already in my tree and will be going to Linus for
6.5-rc1.

thanks,

greg k-h

Re: UBSAN spat in valid xhci code in Linus's current tree (6.4+)

[Kees Cook]

On Thu, Jun 29, 2023 at 05:36:51PM +0200, Greg KH wrote:
> in include/uapi/linux/usb/ch9.h

Oh wait, this is a _different_ one in ch9. I'll send a patch...

-- 
Kees Cook