UBSAN: array-index-out-of-bounds in /build/linux-HMZHpV/linux-5.15.0/drivers/net/wireless/ath/ath5k/base.c:1695:20

Bug #1972140 reported by js1
22
This bug affects 4 people
Affects Status Importance Assigned to Milestone
linux (Ubuntu)
Confirmed
Undecided
Unassigned

Bug Description

[114914.279420] ================================================================================
[114914.279431] UBSAN: array-index-out-of-bounds in /build/linux-HMZHpV/linux-5.15.0/drivers/net/wireless/ath/ath5k/base.c:1695:20
[114914.279436] index 4 is out of range for type 'ieee80211_tx_rate [4]'
[114914.279440] CPU: 1 PID: 0 Comm: swapper/1 Tainted: P IOE 5.15.0-27-generic #28-Ubuntu
[114914.279445] Hardware name: Dell Inc. Precision WorkStation T7500 /0D881F, BIOS A18 10/15/2018
[114914.279448] Call Trace:
[114914.279451] <IRQ>
[114914.279455] show_stack+0x52/0x58
[114914.279465] dump_stack_lvl+0x4a/0x5f
[114914.279475] dump_stack+0x10/0x12
[114914.279478] ubsan_epilogue+0x9/0x45
[114914.279482] __ubsan_handle_out_of_bounds.cold+0x44/0x49
[114914.279487] ? iommu_dma_unmap_page+0x4a/0x50
[114914.279492] ath5k_tx_frame_completed.constprop.0+0x279/0x2c0 [ath5k]
[114914.279507] ath5k_tx_processq+0xb1/0x1c0 [ath5k]
[114914.279519] ath5k_tasklet_tx+0x7b/0xf0 [ath5k]
[114914.279531] tasklet_action_common.constprop.0+0xc0/0xf0
[114914.279539] tasklet_action+0x22/0x30
[114914.279543] __do_softirq+0xd9/0x2e3
[114914.279550] irq_exit_rcu+0x8c/0xb0
[114914.279554] common_interrupt+0x8a/0xa0
[114914.279560] </IRQ>
[114914.279562] <TASK>
[114914.279563] asm_common_interrupt+0x1e/0x40
[114914.279568] RIP: 0010:cpuidle_enter_state+0xd9/0x620
[114914.279574] Code: 3d 14 5b be 67 e8 d7 ad 6c ff 49 89 c7 0f 1f 44 00 00 31 ff e8 28 ba 6c ff 80 7d d0 00 0f 85 5d 01 00 00 fb 66 0f 1f 44 00 00 <45> 85 f6 0f 88 69 01 00 00 4d 63 ee 49 83 fd 09 0f 87 e3 03 00 00
[114914.279577] RSP: 0018:ffffadc58009be28 EFLAGS: 00000292
[114914.279582] RAX: 0000000000000000 RBX: ffffcdc57ee79f00 RCX: 0000000000000020
[114914.279584] RDX: 0000000002c71492 RSI: 0000000000003d66 RDI: ffffffff99807a40
[114914.279587] RBP: ffffadc58009be78 R08: 0000000000000000 R09: 00000000000c3500
[114914.279589] R10: 0000000000000005 R11: 071c71c71c71c71c R12: ffffffff99ad3580
[114914.279592] R13: 0000000000000004 R14: 0000000000000004 R15: 0000688390cd49d1
[114914.279597] ? cpuidle_enter_state+0x246/0x620
[114914.279601] cpuidle_enter+0x2e/0x40
[114914.279605] cpuidle_idle_call+0x13e/0x1e0
[114914.279610] do_idle+0x83/0xf0
[114914.279614] cpu_startup_entry+0x20/0x30
[114914.279617] start_secondary+0x12a/0x180
[114914.279622] secondary_startup_64_no_verify+0xc2/0xcb
[114914.279630] </TASK>
[114914.279632] ================================================================================

ProblemType: Bug
DistroRelease: Ubuntu 22.04
Package: linux-image-5.15.0-27-generic 5.15.0-27.28
ProcVersionSignature: Ubuntu 5.15.0-27.28-generic 5.15.30
Uname: Linux 5.15.0-27-generic x86_64
NonfreeKernelModules: nvidia_modeset nvidia
ApportVersion: 2.20.11-0ubuntu82
Architecture: amd64
AudioDevicesInUse:
 USER PID ACCESS COMMAND
 /dev/snd/controlC0: js1 17869 F.... pulseaudio
 /dev/snd/controlC1: js1 17869 F.... pulseaudio
CasperMD5CheckResult: unknown
CurrentDesktop: LXQt
Date: Sun May 8 23:36:44 2022
InstallationDate: Installed on 2020-02-02 (826 days ago)
InstallationMedia: Lubuntu 19.10 "Eoan Ermine" - Release amd64 (20191017.1)
MachineType: Dell Inc. Precision WorkStation T7500
ProcFB: 0 VESA VGA
ProcKernelCmdLine: BOOT_IMAGE=/boot/vmlinuz-5.15.0-27-generic root=UUID=93fc02c6-baa4-4282-96d7-ea5ad53b0c78 ro ipv6.disable=1 splash vt.handoff=7
RelatedPackageVersions:
 linux-restricted-modules-5.15.0-27-generic N/A
 linux-backports-modules-5.15.0-27-generic N/A
 linux-firmware 20220329.git681281e4-0ubuntu1
RfKill:
 0: phy0: Wireless LAN
  Soft blocked: no
  Hard blocked: no
SourcePackage: linux
UpgradeStatus: No upgrade log present (probably fresh install)
dmi.bios.date: 10/15/2018
dmi.bios.release: 0.0
dmi.bios.vendor: Dell Inc.
dmi.bios.version: A18
dmi.board.name: 0D881F
dmi.board.vendor: Dell Inc.
dmi.board.version: A05
dmi.chassis.type: 7
dmi.chassis.vendor: Dell Inc.
dmi.modalias: dmi:bvnDellInc.:bvrA18:bd10/15/2018:br0.0:svnDellInc.:pnPrecisionWorkStationT7500:pvr:rvnDellInc.:rn0D881F:rvrA05:cvnDellInc.:ct7:cvr:sku:
dmi.product.name: Precision WorkStation T7500
dmi.sys.vendor: Dell Inc.

Revision history for this message
js1 (sujiannming) wrote :
Revision history for this message
Ubuntu Kernel Bot (ubuntu-kernel-bot) wrote : Status changed to Confirmed

This change was made by a bot.

Changed in linux (Ubuntu):
status: New → Confirmed
Revision history for this message
Kai-Heng Feng (kaihengfeng) wrote :

Please give this patch a try, thanks!

tags: added: patch
Revision history for this message
js1 (sujiannming) wrote :

Thanks for the quick response. Will a patched kernel binary be available from a ppa or testing repo? Or, do I need to download the deb src, patch, and build the kernel myself?

Revision history for this message
Kai-Heng Feng (kaihengfeng) wrote :
Revision history for this message
js1 (sujiannming) wrote :

Thank you very much for building the kernel. However, since this happened on 5.15.0-27, and the latest for 22.04 is 5.15.0-30, can you build against that version train? Sorry to be such a bother.

Revision history for this message
Kai-Heng Feng (kaihengfeng) wrote :

5.15 based kernel can be found here:
https://people.canonical.com/~khfeng/lp1972140-5.15/

Revision history for this message
js1 (sujiannming) wrote :

Awesome! Can you please also upload the linux-header package for this build? The nvidia drivers won't build without it.

Module build for kernel 5.15.0-33-generic was skipped since the
kernel headers for this kernel does not seem to be installed.

Revision history for this message
Kai-Heng Feng (kaihengfeng) wrote :

Hmm, but this bug doesn't need NVIDIA to work to be verified.

Revision history for this message
js1 (sujiannming) wrote :

Bro, X11 will not start on my computer (suffering from this bug) without the nvidia driver. If I cannot use my computer, I cannot reliably report back if your patch works.

Revision history for this message
Kai-Heng Feng (kaihengfeng) wrote :

Please use "nomodeset" to bypass nvidia.

Revision history for this message
js1 (sujiannming) wrote :
Download full text (8.2 KiB)

"nomodeset" did not work. I have taken the official 5.15.0-33-generic update. Now I get this stack traces:

[ 46.083490] ================================================================================
[ 46.138353] UBSAN: invalid-load in /build/linux-MLl0vf/linux-5.15.0/drivers/net/wireless/ath/ath5k/base.c:497:16
[ 46.197259] load of value 255 is not a valid value for type '_Bool'
[ 46.228123] CPU: 0 PID: 705 Comm: NetworkManager Tainted: P IOE 5.15.0-33-generic #34-Ubuntu
[ 46.228127] Hardware name: Dell Inc. Precision WorkStation T7500 /0D881F, BIOS A18 10/15/2018
[ 46.228129] Call Trace:
[ 46.228132] <TASK>
[ 46.228135] show_stack+0x52/0x58
[ 46.228143] dump_stack_lvl+0x4a/0x5f
[ 46.228150] dump_stack+0x10/0x12
[ 46.228153] ubsan_epilogue+0x9/0x45
[ 46.228156] __ubsan_handle_load_invalid_value.cold+0x44/0x49
[ 46.228160] ath5k_vif_iter.cold+0x67/0x70 [ath5k]
[ 46.228173] ath5k_update_bssid_mask_and_opmode+0x63/0x150 [ath5k]
[ 46.228183] ath5k_add_interface+0x1bb/0x260 [ath5k]
[ 46.228193] drv_add_interface+0x4e/0x100 [mac80211]
[ 46.228262] ieee80211_do_open+0x4f9/0x9c0 [mac80211]
[ 46.228316] ? ieee80211_check_concurrent_iface+0x158/0x1c0 [mac80211]
[ 46.228370] ieee80211_open+0x6c/0x90 [mac80211]
[ 46.228423] __dev_open+0xf3/0x1c0
[ 46.228428] __dev_change_flags+0x1a3/0x220
[ 46.228431] dev_change_flags+0x26/0x60
[ 46.228434] do_setlink+0x28a/0xc50
[ 46.228437] ? dev_get_alias+0x35/0x40
[ 46.228440] ? dev_get_alias+0x35/0x40
[ 46.228442] ? nla_put_ifalias+0x38/0xa0
[ 46.228445] ? __nla_validate_parse+0x4c/0x1a0
[ 46.228452] __rtnl_newlink+0x618/0xa20
[ 46.228455] ? __rtnl_newlink+0x14b/0xa20
[ 46.228458] ? __nla_put+0x20/0x30
[ 46.228461] ? __nla_reserve+0x41/0x50
[ 46.228464] ? __nla_reserve+0x41/0x50
[ 46.228467] ? apparmor_inet_conn_request+0x50/0x50
[ 46.228471] ? security_sock_rcv_skb+0x2f/0x50
[ 46.228475] ? skb_queue_tail+0x48/0x50
[ 46.228478] ? sock_def_readable+0x4b/0x80
[ 46.228483] ? __netlink_sendskb+0x62/0x80
[ 46.228488] ? netlink_unicast+0x2f3/0x330
[ 46.228492] ? rtnl_getlink+0x392/0x410
[ 46.228499] ? kmem_cache_alloc_trace+0x19e/0x2e0
[ 46.228505] rtnl_newlink+0x49/0x70
[ 46.228507] rtnetlink_rcv_msg+0x15d/0x400
[ 46.228510] ? rtnl_calcit.isra.0+0x130/0x130
[ 46.228513] netlink_rcv_skb+0x55/0x100
[ 46.228517] rtnetlink_rcv+0x15/0x20
[ 46.228522] netlink_unicast+0x21d/0x330
[ 46.228526] netlink_sendmsg+0x24c/0x4c0
[ 46.228530] sock_sendmsg+0x65/0x70
[ 46.228533] ____sys_sendmsg+0x24e/0x290
[ 46.228536] ? import_iovec+0x31/0x40
[ 46.228540] ? sendmsg_copy_msghdr+0x7b/0xa0
[ 46.228543] ? fput_many+0x4a/0x90
[ 46.228548] ___sys_sendmsg+0x81/0xc0
[ 46.228551] ? do_filp_open+0xb2/0x150
[ 46.228555] ? security_file_free+0x54/0x60
[ 46.228560] ? kmem_cache_free+0x245/0x290
[ 46.228563] ? rseq_get_rseq_cs.isra.0+0x1b/0x220
[ 46.228569] ? __call_rcu+0xa8/0x260
[ 46.228574] ? __fget_files+0x86/0xc0
[ 46.228578] ? __fget_light+0x32/0x80
[ 46.228582] __sys_...

Read more...

Revision history for this message
Kai-Heng Feng (kaihengfeng) wrote :

Alright, please give this one a try:
https://people.canonical.com/~khfeng/lp1972140

Revision history for this message
js1 (sujiannming) wrote :

Same problem with latest official 5.15.0-35-generic. I am willing to test any patched 5.15 kernel build that also includes the linux-headers package. Thanks for your efforts.

Revision history for this message
Felipe Casado (vivamudhoney) wrote :

This keeps happening in kernel 5.19.0-38-generic. I installed the 4 debs from the link above https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1972140/comments/13 then with grub I booted the linux-image-unsigned-5.18.0-4-generic_5.18.0-4.4 kernel. Result: It refuses to load the athk5 module. This is the dmesg output I get in modprobe aswell:

[ 4.314514] ath: disagrees about version of symbol ieee80211_get_channel_khz
[ 4.314516] ath: Unknown symbol ieee80211_get_channel_khz (err -22)
[ 4.314519] ath: disagrees about version of symbol wiphy_apply_custom_regulatory
[ 4.314520] ath: Unknown symbol wiphy_apply_custom_regulatory (err -22)
[ 4.314523] ath: disagrees about version of symbol freq_reg_info
[ 4.314523] ath: Unknown symbol freq_reg_info (err -22)

I will try to compile the kernel myself and check that is looking for the right modules.

Revision history for this message
Felipe Casado (vivamudhoney) wrote :

I am able to compile the kernel with the patch you posted and now I am getting the following errors:

[ 78.330687] UBSAN: invalid-load in drivers/net/wireless/ath/ath5k/base.c:488:16
[ 78.330689] load of value 144 is not a valid value for type '_Bool'
and
[ 78.330842] UBSAN: invalid-load in drivers/net/wireless/ath/ath5k/base.c:497:16
[ 78.330843] load of value 255 is not a valid value for type '_Bool'

I can connect to the network with the card, but it disconnects itself from time to time from the router and loses connection spamming the following messages:

[ 3533.615792] AMD-Vi: Event logged [IO_PAGE_FAULT device=22:00.0 domain=0x000e address=0x0 flags=0x0000]
[ 3533.615802] AMD-Vi: Event logged [IO_PAGE_FAULT device=22:00.0 domain=0x000e address=0x20 flags=0x0000]
[ 3533.615808] AMD-Vi: Event logged [IO_PAGE_FAULT device=22:00.0 domain=0x000e address=0x40 flags=0x0000]
[ 3533.615812] AMD-Vi: Event logged [IO_PAGE_FAULT device=22:00.0 domain=0x000e address=0x60 flags=0x0000]

I found some messages saying that using kernel parameter iommu=soft helps here but this is not the case.

In case you update the patch I am willing to test it. Thanks in advance.

Revision history for this message
Felipe Casado (vivamudhoney) wrote :

Update: The disconnection problems are unrelated to this ticket and can be fixed with the iommu=pt kernel parameter. The device seems to work without problems despite the UBSAN warnings.

To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.