System freezes with UBSAN: array-index-out-of-bounds in iwlwifi code

[Ryan Fugger]

System consistently freezes requiring hard reset every few hours. Syslog gives this message at the time of the crash:

UBSAN: array-index-out-of-bounds in /build/linux-hwe-6.2-d7iZ5S/linux-hwe-6.2-6.2.0/drivers/net/wireless/intel/iwlwifi/queue/tx.c:1556:39

ProblemType: Bug
DistroRelease: Ubuntu 22.04
Package: linux-image-6.2.0-34-generic 6.2.0-34.34~22.04.1
ProcVersionSignature: Ubuntu 6.2.0-34.34~22.04.1-generic 6.2.16
Uname: Linux 6.2.0-34-generic x86_64
ApportVersion: 2.20.11-0ubuntu82.5
Architecture: amd64
CasperMD5CheckResult: unknown
CurrentDesktop: ubuntu:GNOME
Date: Sun Oct 15 21:38:57 2023
InstallationDate: Installed on 2021-05-15 (883 days ago)
InstallationMedia: Ubuntu 20.04.2.0 LTS "Focal Fossa" - Release amd64 (20210209.1)
SourcePackage: linux-signed-hwe-6.2
UpgradeStatus: Upgraded to jammy on 2022-11-28 (322 days ago)

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[Mandeep Sandhu (mandeepsandhu)]

I have a similar crash with Ubuntu 22.04, running `vmlinuz-6.1.0-1024-oem` (from pkg `linux-oem-22.04d`).

Oct 25 14:11:46 mandeep-pf3xfcj3 kernel: UBSAN: array-index-out-of-bounds in /build/linux-oem-6.1-CvRDkF/linux-oem-6.1-6.1.0/drivers/net/wireless/intel/iwlwifi/queue/tx.c:1556:39
Oct 25 14:11:46 mandeep-pf3xfcj3 kernel: index 512 is out of range for type 'iwl_txq *[512]'
...
<stack trace>
...
Oct 25 14:12:10 mandeep-pf3xfcj3 kernel: rcu: INFO: rcu_preempt detected expedited stalls on CPUs/tasks: { 7-.... } 5346 jiffies s: 781 root: 0x80/.
Oct 25 14:12:10 mandeep-pf3xfcj3 kernel: rcu: blocking rcu_node structures (internal RCU debug):
...

[Ryan Fugger (rfugger)]

A few days after reporting, I noticed that VLC media player was terminating its process whenever I would seek ahead in a video. I found a workaround by disabling hardware video acceleration (VA API). I had been watching a lot of videos in Chrome when the system freezes in this bug were happening. I tried disabling hardware video acceleration in Chrome, and haven't had any system freezes since (4 days or so).

I believe therefore that this bug is related to the Intel hardware video acceleration system somehow.

[Ryan Fugger (rfugger)]

After over a week crash-free after disabling hardware video decoding, I started getting the same crashes again today, despite not using any hardware video decoding anywhere that I can tell. So now I'm stumped.

[Ryan Fugger (rfugger)]

I have been using the [Intel iwlwifi] network more intensely than I have in a couple weeks today, so that's probably the cause.

[Darya Komsa (d-honeybadger)]

Seeing an index-out-of-bounds exception in the same file on the same line on Ubuntu 20.04 (5.15.0-89-generic):
UBSAN: array-index-out-of-bounds in /build/linux-hwe-5.15-QQdkfv/linux-hwe-5.15-5.15.0/debian/build/build-generic/__________________dkms/build/backport-iwlwifi/9858/build/drivers/net/wireless/intel/iwlwifi/queue/tx.c:1556:39

Followed by a lockup:
watchdog: BUG: soft lockup - CPU#1 stuck for 26s! [irq/167-iwlwifi:1465]