kernel 6.5 changes cause UBSAN errors (patch included)

[satmandu]

"On Linux 6.5, due to commit 2d47c6956ab3 ("ubsan: Tighten UBSAN_BOUNDS
on GCC"), flexible trailing arrays declared like `whatever_t foo[1];`
will generate warnings when CONFIG_UBSAN & co. is enabled."

Due to changes in kernel 6.5, we get this error in dmesg:

[ 28.818756] ================================================================================
[ 28.822952] UBSAN: array-index-out-of-bounds in /var/lib/dkms/broadcom-wl/6.30.223.271/build/src/wl/sys/wl_linux.c:1938:4
[ 28.828888] index 2 is out of range for type 'ether_addr [1]'
[ 28.832900] CPU: 1 PID: 1232 Comm: avahi-daemon Tainted: P OE 6.5.0-rc4 #1
[ 28.836452] Hardware name: Apple Inc. MacBookPro11,3/Mac-2BD1B31983FE1663, BIOS 432.60.3.0.0 10/27/2021
[ 28.839806] Call Trace:
[ 28.843091] <TASK>
[ 28.846387] dump_stack_lvl+0x48/0x60
[ 28.849692] dump_stack+0x10/0x20
[ 28.852965] __ubsan_handle_out_of_bounds+0xc6/0x100
[ 28.856251] _wl_set_multicast_list+0x1fd/0x220 [wl]
[ 28.859191] wl_set_multicast_list+0x3a/0x80 [wl]
[ 28.861879] __dev_set_rx_mode+0x6a/0xc0
[ 28.864237] __dev_mc_add+0x82/0x90
[ 28.866587] dev_mc_add+0x10/0x20
[ 28.868920] igmp_group_added+0x198/0x1d0
[ 28.871102] ____ip_mc_inc_group+0x185/0x2b0
[ 28.873231] __ip_mc_join_group+0x108/0x170
[ 28.875170] ip_mc_join_group+0x10/0x20
[ 28.877111] do_ip_setsockopt+0x104d/0x1160
[ 28.878894] ? __sys_setsockopt+0xeb/0x1c0
[ 28.880657] ip_setsockopt+0x30/0xb0
[ 28.882326] udp_setsockopt+0x22/0x40
[ 28.883949] sock_common_setsockopt+0x14/0x20
[ 28.885554] __sys_setsockopt+0xde/0x1c0
[ 28.887063] __x64_sys_setsockopt+0x1f/0x30
[ 28.888564] do_syscall_64+0x55/0x80
[ 28.889952] ? syscall_exit_to_user_mode+0x26/0x40
[ 28.891226] ? __x64_sys_recvmsg+0x1d/0x20
[ 28.892450] ? do_syscall_64+0x61/0x80
[ 28.893651] ? do_syscall_64+0x61/0x80
[ 28.894796] entry_SYSCALL_64_after_hwframe+0x46/0xb0
[ 28.895942] RIP: 0033:0x7f0a97a7ddae
[ 28.897100] Code: 0f 1f 40 00 48 8b 15 69 60 0d 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b7 0f 1f 00 f3 0f 1e fa 49 89 ca b8 36 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 0a c3 66 0f 1f 84 00 00 00 00 00 48 8b 15 31
[ 28.898270] RSP: 002b:00007fffb7b1b3f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000036
[ 28.899449] RAX: ffffffffffffffda RBX: 000000000000000c RCX: 00007f0a97a7ddae
[ 28.900623] RDX: 0000000000000023 RSI: 0000000000000000 RDI: 000000000000000c
[ 28.901784] RBP: 0000000000000001 R08: 000000000000000c R09: 0000000000000004
[ 28.902895] R10: 00007fffb7b1b404 R11: 0000000000000246 R12: 00007fffb7b1b404
[ 28.904011] R13: 0000000000000014 R14: 000055cc506ee078 R15: 000055cc506eaf60
[ 28.905149] </TASK>
[ 28.906228] ================================================================================

A patch is however available for this issue:

https://gist.github.com/joanbm/9cd5fda1dcfab9a67b42cc6195b7b269

ProblemType: Bug
DistroRelease: Ubuntu 23.04
Package: bcmwl-kernel-source (not installed)
Uname: Linux 6.5.0-rc4 x86_64
NonfreeKernelModules: wl zfs
ApportVersion: 2.26.1-0ubuntu2
Architecture: amd64
CasperMD5CheckResult: unknown
Date: Thu Aug 10 10:40:27 2023
ProcEnviron:
 LANG=en_US.UTF-8
 PATH=(custom, no user)
 SHELL=/bin/bash
 TERM=xterm-256color
SourcePackage: broadcom-sta
UpgradeStatus: No upgrade log present (probably fresh install)

[Ubuntu Foundations Team Bug Bot (crichton)]

The attachment "ubsan patch for broadcom-wl driver" seems to be a patch. If it isn't, please remove the "patch" flag from the attachment, remove the "patch" tag, and if you are a member of the ~ubuntu-reviewers, unsubscribe the team.

[This is an automated message performed by a Launchpad user owned by ~brian-murray, for any issues please contact him.]

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[Marietto (marietto2008)]

I've upgraded ubuntu 23.04 to 23.10 and I've got the bug that you said that should have been fixed.

On my Ubuntu 23.10 I'm using kernel 6.5.0-10-generic and I've installed the nvidia driver version 535.129.03. (my nvidia gpu is the RTX 2080 ti ; my cpu is the intel I9)

Not exactly the same bug because the error in the Ubuntu bug report is for a different kernel module. But the underlying cause is probably the same.

Ubuntu is probably at fault here. Possibly the code for the nvidia-uvm module is designed for kernel versions < 6.5, so when Ubuntu upgraded to Linux kernel 6.5, it broke some modules because of changes to UBSAN in Linux 6.5 which causes modules such as nvidia-uvm to need patches to be compatible with Linux 6.5, but either nvidia has not yet provided a version of nvidia-uvm that is compatible with Linux 6.5 or Ubuntu neglected to apply an updated version from nvidia that is compatible with Linux 6.5.

Whois the guilty ? the nvidia or the ubuntu developers ? I didn't see this error on ubuntu 23.04,maybe because it does not use the kernel 6.5 by default,but 23.10 does it.

I see a lot of those errors when I issue the command "dmesg" and any audio-video streamings don't flow.

Log :

[ 15.029102] UBSAN: array-index-out-of-bounds in /var/lib/dkms/nvidia/535.129.03/build/nvidia-uvm/uvm_pmm_gpu.c:829:45

[ 15.031655] index 0 is out of range for type 'uvm_gpu_chunk_t *[*]'
[ 15.034248] CPU: 9 PID: 2571 Comm: ffdetect Tainted: P OE 6.5.0-10-generic #10-Ubuntu
[ 15.034249] Hardware name: Gigabyte Technology Co., Ltd. Z390 AORUS PRO/Z390 AORUS PRO-CF, BIOS F12g GA9 06/08/2020
[ 15.034250] Call Trace:
[ 15.034251] <TASK>
[ 15.034251] dump_stack_lvl+0x48/0x70
[ 15.034255] dump_stack+0x10/0x20
[ 15.034257] __ubsan_handle_out_of_bounds+0xc6/0x110
[ 15.034259] merge_gpu_chunk+0x57/0x1d0 [nvidia_uvm]
[ 15.034293] free_chunk_with_merges+0x13d/0x180 [nvidia_uvm]
[ 15.034325] free_chunk+0xa4/0xd0 [nvidia_uvm]
[ 15.034355] uvm_pmm_gpu_free+0xbf/0xf0 [nvidia_uvm]
[ 15.034386] phys_mem_deallocate+0x33/0xd0 [nvidia_uvm]
[ 15.034422] uvm_page_tree_put_ptes_async+0x4d5/0x580 [nvidia_uvm]
[ 15.034459] uvm_page_table_range_vec_deinit+0x3e/0xd0 [nvidia_uvm]
[ 15.034494] uvm_va_range_destroy+0x14d/0x590 [nvidia_uvm]
[ 15.034527] ? os_release_spinlock+0x1a/0x30 [nvidia]
[ 15.034792] ? uvm_kvfree+0x30/0x70 [nvidia_uvm]
[ 15.034826] destroy_va_ranges.part.0+0x61/0x90 [nvidia_uvm]
[ 15.034857] uvm_user_channel_detach+0x9e/0xe0 [nvidia_uvm]
[ 15.034886] uvm_api_unregister_channel+0xee/0x1a0 [nvidia_uvm]
[ 15.034915] uvm_ioctl+0x1a04/0x1cd0 [nvidia_uvm]
[ 15.034939] ? uvm_api_unregister_channel+0x134/0x1a0 [nvidia_uvm]
[ 15.034968] ? _copy_to_user+0x25/0x70
[ 15.034970] ? uvm_ioctl+0x5cc/0x1cd0 [nvidia_uvm]
[ 15.034994] ? _raw_spin_lock_irqsave+0xe/0x20
[ 15.034996] ? thread_context_non_interrupt_add+0x13a/0x2c0 [nvidia_uvm]
[ 15.035031] uvm_unlocked_ioctl_entry.part.0+0x7b/0xf0 [nvidia_uvm]
[ 15.035055] ? uvm_thread_context_remove+0x39/0x50 [nvidia_uvm]
[ 15.035091] uvm_unlocked_ioctl_entry+0x6b/0x90 [nvidia_uvm]
[ 15.035115] __x64_sys_ioctl+0xa0/0xf0
...

[Tim Ritberg (xpert-reactos)]

I build me own kernel now and removed all UBSAN-stuff. This helped.