linux-hardening - Re: UBSAN: array-index-out-of-bounds

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <202512221526.451D1BE1B@keescook>
Date: Mon, 22 Dec 2025 15:28:40 -0800
From: Kees Cook <kees@...nel.org>
To: Randy Dunlap <rdunlap@...radead.org>
Cc: kasan-dev@...glegroups.com, linux-hardening@...r.kernel.org
Subject: Re: UBSAN: array-index-out-of-bounds

On Fri, Dec 19, 2025 at 08:20:13PM -0800, Randy Dunlap wrote:
> 
> from kernel bugzilla:
> https://bugzilla.kernel.org/show_bug.cgi?id=220823
> 
> 
> Dec 15 22:01:52 orpheus kernel: UBSAN: array-index-out-of-bounds in /var/tmp/portage/sys-kernel/gentoo-kernel-6.18.1/work/linux-6.18/drivers/mtd/devices/mtd_intel_dg.c:750:15
> 
> 
> (from drivers/mtd/devices/mtd_intel_dg.c:)
> 
> 	nvm = kzalloc(struct_size(nvm, regions, nregions), GFP_KERNEL);

Yes, this needs to be immediately followed with:

	nvm->nregions = nregions;

> ...
> 
> 	for (n = 0, i = 0; i < INTEL_DG_NVM_REGIONS; i++) {
> 		if (!invm->regions[i].name)
> 			continue;
> 
> 		char *name = kasprintf(GFP_KERNEL, "%s.%s",
> 				       dev_name(&aux_dev->dev), invm->regions[i].name);
> 		if (!name)
> 			continue;
> 750:		nvm->regions[n].name = name;
> 		nvm->regions[n].id = i;
> 		n++;
> 	}
> 	nvm->nregions = n;
> 
> 
> regions is a flexible array in struct intel_dg_nvm *nvm; [see below]
> regions is counted_by nvm->nregions.

Now, will nregions change again after this point? There is a question of
whether nvm->nregions represents the _allocation_ size or the _valid_
size. It seems like a max is allocated but then only populated up to a
certain point?

> Question: does UBSAN use the value of the counted_by variable for array bounds
> checking?

Yes.

> If so, that means nvm->nregions must be updated before the array entry
> is used. Is that correct?

Yes.

-- 
Kees Cook