Please enable CONFIG_UBSAN_BOUNDS

Bug #1914685 reported by Kees Cook
10
This bug affects 2 people
Affects Status Importance Assigned to Milestone
linux (Ubuntu)
Fix Released
Undecided
Unassigned
Groovy
Won't Fix
Undecided
Unassigned
Hirsute
Confirmed
Undecided
Unassigned
Impish
Fix Released
Undecided
Unassigned
linux-oracle (Ubuntu)
Fix Released
Undecided
Unassigned
Groovy
Won't Fix
Undecided
Unassigned
Hirsute
Won't Fix
Undecided
Unassigned
Impish
Fix Released
Undecided
Unassigned

Bug Description

Enabling CONFIG_UBSAN_BOUNDS is fast and provides good coverage for out-of-bounds array indexing (i.e. it catchings the things that CONFIG_FORTIFY doesn't).

Revision history for this message
Ubuntu Kernel Bot (ubuntu-kernel-bot) wrote : Missing required logs.

This bug is missing log files that will aid in diagnosing the problem. While running an Ubuntu kernel (not a mainline or third-party kernel) please enter the following command in a terminal window:

apport-collect 1914685

and then change the status of the bug to 'Confirmed'.

If, due to the nature of the issue you have encountered, you are unable to run this command, please add a comment stating that fact and change the bug status to 'Confirmed'.

This change has been made by an automated script, maintained by the Ubuntu Kernel Team.

Changed in linux (Ubuntu):
status: New → Incomplete
Revision history for this message
Kees Cook (kees) wrote :

This is a CONFIG request, do no apport collection required. :)

Changed in linux (Ubuntu):
status: Incomplete → Confirmed
Changed in linux (Ubuntu Groovy):
status: New → Confirmed
Revision history for this message
Brian Murray (brian-murray) wrote :

The Groovy Gorilla has reached end of life, so this bug will not be fixed for that release

Changed in linux (Ubuntu Groovy):
status: Confirmed → Won't Fix
Changed in linux-oracle (Ubuntu Impish):
status: New → Fix Committed
Changed in linux-oracle (Ubuntu Hirsute):
status: New → Invalid
status: Invalid → Confirmed
Changed in linux-oracle (Ubuntu Groovy):
status: New → Invalid
status: Invalid → Won't Fix
Revision history for this message
Ubuntu Kernel Bot (ubuntu-kernel-bot) wrote :

This bug is awaiting verification that the kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-focal' to 'verification-done-focal'. If the problem still exists, change the tag 'verification-needed-focal' to 'verification-failed-focal'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

tags: added: verification-needed-focal
Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package linux - 5.13.0-16.16

---------------
linux (5.13.0-16.16) impish; urgency=medium

  * impish/linux: 5.13.0-16.16 -proposed tracker (LP: #1942611)

  * Miscellaneous Ubuntu changes
    - [Config] update toolchain in configs

  * Miscellaneous upstream changes
    - Revert "UBUNTU: [Config] Enable CONFIG_UBSAN_BOUNDS"

 -- Andrea Righi <email address hidden> Fri, 03 Sep 2021 16:21:14 +0200

Changed in linux (Ubuntu Impish):
status: Confirmed → Fix Released
Revision history for this message
Rashad Tatum (rmtatum) wrote :

CONFIG_UBSAN_TRAP is preventing some AMD systems from booting.
See: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1942684

Revision history for this message
Cristiano Rodrigues (microcris) wrote :

It is preventing AMD and Intel systems from booting.
I'm also affected by this and my system is an Intel system.

Revision history for this message
Cristiano Rodrigues (microcris) wrote :

I'm uploading the kernel log from linux 5.15, but it is the same for linux 5.14.X

Revision history for this message
Rashad Tatum (rmtatum) wrote (last edit ):

So, 5.14.7 and NVIDIA 470.74 fixes the boot issue. However, isn't it potentially harmful to leave CONFIG_UBSAN_TRAP enabled in production builds? The documentation for the flag seems to indicate that warnings would be turned into the errors.

https://github.com/torvalds/linux/blob/master/lib/Kconfig.ubsan#L20

As I understand, CONFIG_UBSAN_TRAP is needed to enable CONFIG_UBSAN_LOCAL_BOUNDS, but the issue mentions CONFIG_UBSAN_BOUNDS.

Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package linux-oracle - 5.13.0-1008.10

---------------
linux-oracle (5.13.0-1008.10) impish; urgency=medium

  * impish/linux-oracle: 5.13.0-1008.10 -proposed tracker (LP: #1946331)

  * Miscellaneous Ubuntu changes
    - [Config] update toolchain version in configs after rebase

  [ Ubuntu: 5.13.0-19.19 ]

  * impish/linux: 5.13.0-19.19 -proposed tracker (LP: #1946337)
  * impish:linux-aws 5.13 panic during systemd autotest (LP: #1946001)
    - [Config] disable KFENCE

  [ Ubuntu: 5.13.0-18.18 ]

  * impish/linux: 5.13.0-18.18 -proposed tracker (LP: #1945995)
  * [21.10 FEAT] KVM: Use interpretation of specification exceptions
    (LP: #1932157)
    - KVM: s390: Enable specification exception interpretation

 -- Andrea Righi <email address hidden> Fri, 08 Oct 2021 17:26:41 +0200

Changed in linux-oracle (Ubuntu Impish):
status: Fix Committed → Fix Released
Revision history for this message
Brian Murray (brian-murray) wrote :

The Hirsute Hippo has reached End of Life, so this bug will not be fixed for that release.

Changed in linux-oracle (Ubuntu Hirsute):
status: Confirmed → Won't Fix
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.