From: Jakub Kicinski <kuba@kernel.org>
To: Jacob Keller <jacob.e.keller@intel.com>
Cc: <davem@davemloft.net>, <netdev@vger.kernel.org>,
<edumazet@google.com>, <pabeni@redhat.com>,
<andrew+netdev@lunn.ch>, <horms@kernel.org>,
Alexander Duyck <alexanderduyck@fb.com>, <lee@trager.us>
Subject: Re: [PATCH net-next] eth: fbnic: fix ubsan complaints about OOB accesses
Date: Wed, 9 Jul 2025 17:11:38 -0700 [thread overview]
Message-ID: <20250709171138.5da9df21@kernel.org> (raw)
In-Reply-To: <bfb5122f-e603-457c-8115-4c4acfe7360b@intel.com>
On Wed, 9 Jul 2025 14:23:11 -0700 Jacob Keller wrote:
> > head = list_first_entry(&log->entries, typeof(*head), list);
> > - entry = (struct fbnic_fw_log_entry *)&head->msg[head->len + 1];
>
> I am guessing that UBSAN gets info about the hint for the length of the
> msg, via the counted_by annotation in the structure? Then it realizes
> that this is too large. Strictly taking address of a value doesn't
> actually directly access the memory... However, you then later access
> the value via the entry variable.. Perhaps UBSAN is complaining about that?
Could be.. The splat includes the line info for the line whether entry
is computed, but maybe that's just a nicety and the detection is done
at access time..
next prev parent reply other threads:[~2025-07-10 0:11 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-07-09 20:59 [PATCH net-next] eth: fbnic: fix ubsan complaints about OOB accesses Jakub Kicinski
2025-07-09 21:23 ` Jacob Keller
2025-07-10 0:11 ` Jakub Kicinski [this message]
2025-07-10 15:49 ` Jacob Keller
2025-07-11 23:10 ` patchwork-bot+netdevbpf
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20250709171138.5da9df21@kernel.org \
--to=kuba@kernel.org \
--cc=alexanderduyck@fb.com \
--cc=andrew+netdev@lunn.ch \
--cc=davem@davemloft.net \
--cc=edumazet@google.com \
--cc=horms@kernel.org \
--cc=jacob.e.keller@intel.com \
--cc=lee@trager.us \
--cc=netdev@vger.kernel.org \
--cc=pabeni@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).