megaraid_sas crash in ubuntu 22.04

[Nilson Lopes]

crash message for dmesg

UBSAN: array-index-out-of-bounds in /build/linux-JjvoxS/linux-5.15.0/drivers/scsi/megaraid/megaraid_sas_fp.c:151:32
index 2 is out of range for type 'MR_LD_SPAN_MAP [1]'
================================================================================
================================================================================
CPU: 16 PID: 330 Comm: kworker/16:1H Not tainted 5.15.0-53-generic #59-Ubuntu
Hardware name: GIGABYTE R282-Z91-00/MZ92-FS0-00, BIOS M10 11/23/2021
Workqueue: kblockd blk_mq_run_work_fn
Call Trace:
 <TASK>
 show_stack+0x52/0x5c
 dump_stack_lvl+0x4a/0x63
 dump_stack+0x10/0x16
 ubsan_epilogue+0x9/0x49
 __ubsan_handle_out_of_bounds.cold+0x44/0x49
 MR_GetPhyParams+0x487/0x700 [megaraid_sas]
 MR_BuildRaidContext+0x71e/0xb50 [megaraid_sas]
 ? cpumask_next_and+0x24/0x30
 ? update_sg_lb_stats+0x78/0x580
 megasas_build_ldio_fusion+0x5b9/0x9a0 [megaraid_sas]
 megasas_build_io_fusion+0x412/0x450 [megaraid_sas]
 megasas_build_and_issue_cmd_fusion+0xa5/0x380 [megaraid_sas]
 megasas_queue_command+0x1c1/0x200 [megaraid_sas]
 ? ktime_get+0x46/0xc0
 scsi_dispatch_cmd+0x96/0x200
 scsi_queue_rq+0x2d5/0x690
 blk_mq_dispatch_rq_list+0x13f/0x680
 ? sbitmap_get+0x71/0xe0
 __blk_mq_do_dispatch_sched+0xba/0x2e0
 blk_mq_do_dispatch_sched+0x40/0x70
 __blk_mq_sched_dispatch_requests+0x105/0x150
 blk_mq_sched_dispatch_requests+0x35/0x70
 __blk_mq_run_hw_queue+0x34/0xc0
 blk_mq_run_work_fn+0x1f/0x30
 process_one_work+0x22b/0x3d0
 worker_thread+0x53/0x420
 ? process_one_work+0x3d0/0x3d0
 kthread+0x12a/0x150
 ? set_kthread_struct+0x50/0x50
 ret_from_fork+0x22/0x30
 </TASK>

[Seth Arnold (seth-arnold)]

Hello Nilson, how was this crash produced? Can it be triggered by an unprivileged user?

Thanks

[Nilson Lopes (noslin005)]

Hello Seth,

The crash happens during the boot, and it's visible to any user.
A similar bug reported was posted here.
https://bugzilla.kernel.org/show_bug.cgi?id=215943

To replicate the issue, install Ubuntu 22.04 on any system that has a MegaRAID card (I'm using 9500 series).

Thanks

[Seth Arnold (seth-arnold)]

Thanks Nilson, excellent find on the bugzilla report.

The linked linux-hardening thread makes me think this is 'just' an undefined-but-safe operation: the sort of thing that's good to fix, in case a future compiler makes an unsafe optimization, but not likely to be a cause for concern today.

Thanks