| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <aSqpiDfrvIyUt813@eldamar.lan>
Date: Sat, 29 Nov 2025 09:06:32 +0100
From: Salvatore Bonaccorso <carnil@...ian.org>
To: waxhead <waxhead@...tcellar.net>, 1121535@...s.debian.org
Cc: Takashi Iwai <tiwai@...e.de>, Jaroslav Kysela <perex@...ex.cz>,
Takashi Iwai <tiwai@...e.com>, linux-kernel@...r.kernel.org,
linux-sound@...r.kernel.org
Subject: Re: Bug#1121535: UBSAN: array-index-out-of-bounds in
[...]sound/pci/ctxfi/ctamixer.c:347:48
Hi,
On Fri, Nov 28, 2025 at 08:32:21PM +0100, Salvatore Bonaccorso wrote:
> Hi Takeshi,
>
> On Fri, Nov 28, 2025 at 06:24:43PM +0100, Takashi Iwai wrote:
> > On Fri, 28 Nov 2025 07:07:36 +0100,
> > Salvatore Bonaccorso wrote:
> > >
> > > Hi Jaroslav, hi Takashi
> > >
> > > A user in Debian reported (in https://bugs.debian.org/1121535) an
> > > array-index-out-of-bounds affecting ctxfi/ctamixer.c:
> > >
> > > On Fri, Nov 28, 2025 at 12:06:07AM +0100, waxhead wrote:
> > > > ------------[ cut here ]------------
> > > > Nov 27 23:46:53 main kernel: UBSAN: array-index-out-of-bounds in /build/reproducible-path/linux-6.17.8/sound/pci/ctxfi/ctamixer.c:347:48
> > > > Nov 27 23:46:53 main kernel: index 8 is out of range for type 'unsigned char [8]'
> > > > Nov 27 23:46:53 main kernel: CPU: 4 UID: 0 PID: 468 Comm: (udev-worker) Not tainted 6.17.8+deb14-amd64 #1 PREEMPT(lazy) Debian 6.17.8-1
> > > > Nov 27 23:46:53 main kernel: Hardware name: FUJITSU /D3446-S2, BIOS V5.0.0.12 R1.26.0 for D3446-S2x 02/11/2020
> > > > Nov 27 23:46:53 main kernel: Call Trace:
> > > > Nov 27 23:46:53 main kernel: <TASK>
> > > > Nov 27 23:46:53 main kernel: dump_stack_lvl+0x5d/0x80
> > > > Nov 27 23:46:53 main kernel: ? __pfx_amixer_set_x+0x10/0x10 [snd_ctxfi]
> > > > Nov 27 23:46:53 main kernel: ubsan_epilogue+0x5/0x2b
> > > > Nov 27 23:46:53 main kernel: __ubsan_handle_out_of_bounds.cold+0x54/0x59
> > > > Nov 27 23:46:53 main kernel: sum_output_slot+0x44/0x70 [snd_ctxfi]
> > > > Nov 27 23:46:53 main kernel: amixer_set_input+0x4b/0x80 [snd_ctxfi]
> > > > Nov 27 23:46:53 main kernel: amixer_setup+0x1b/0x50 [snd_ctxfi]
> > > > Nov 27 23:46:53 main kernel: ct_mixer_create+0x193/0x570 [snd_ctxfi]
> > > > Nov 27 23:46:53 main kernel: ct_atc_create+0x3cb/0x530 [snd_ctxfi]
> > > > Nov 27 23:46:53 main kernel: ct_card_probe+0x104/0x2c0 [snd_ctxfi]
> > > > Nov 27 23:46:53 main kernel: local_pci_probe+0x3f/0x90
> > > > Nov 27 23:46:53 main kernel: pci_device_probe+0xda/0x2b0
> > > > Nov 27 23:46:53 main kernel: ? sysfs_do_create_link_sd+0x6d/0xd0
> > > > Nov 27 23:46:53 main kernel: really_probe+0xdb/0x340
> > > > Nov 27 23:46:53 main kernel: ? pm_runtime_barrier+0x55/0x90
> > > > Nov 27 23:46:53 main kernel: __driver_probe_device+0x78/0x140
> > > > Nov 27 23:46:53 main kernel: driver_probe_device+0x1f/0xa0
> > > > Nov 27 23:46:53 main kernel: ? __pfx___driver_attach+0x10/0x10
> > > > Nov 27 23:46:53 main kernel: __driver_attach+0xcb/0x1e0
> > > > Nov 27 23:46:53 main kernel: bus_for_each_dev+0x82/0xd0
> > > > Nov 27 23:46:53 main kernel: bus_add_driver+0x10b/0x1f0
> > > > Nov 27 23:46:53 main kernel: ? __pfx_ct_driver_init+0x10/0x10 [snd_ctxfi]
> > > > Nov 27 23:46:53 main kernel: driver_register+0x75/0xe0
> > > > Nov 27 23:46:53 main kernel: do_one_initcall+0x58/0x300
> > > > Nov 27 23:46:53 main kernel: do_init_module+0x62/0x250
> > > > Nov 27 23:46:53 main kernel: ? init_module_from_file+0x8a/0xe0
> > > > Nov 27 23:46:53 main kernel: init_module_from_file+0x8a/0xe0
> > > > Nov 27 23:46:53 main kernel: idempotent_init_module+0x114/0x310
> > > > Nov 27 23:46:53 main kernel: __x64_sys_finit_module+0x6d/0xd0
> > > > Nov 27 23:46:53 main kernel: ? syscall_trace_enter+0x8d/0x1d0
> > > > Nov 27 23:46:53 main kernel: do_syscall_64+0x82/0x320
> > > > Nov 27 23:46:53 main kernel: ? restore_fpregs_from_fpstate+0x46/0xa0
> > > > Nov 27 23:46:53 main kernel: ? switch_fpu_return+0x5b/0xe0
> > > > Nov 27 23:46:53 main kernel: ? do_syscall_64+0x200/0x320
> > > > Nov 27 23:46:53 main kernel: ? exc_page_fault+0x74/0x180
> > > > Nov 27 23:46:53 main kernel: entry_SYSCALL_64_after_hwframe+0x76/0x7e
> > > > Nov 27 23:46:53 main kernel: RIP: 0033:0x7f77238f3779
> > > > Nov 27 23:46:53 main kernel: Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 4f 86 0d 00 f7 d8 64 89 01 48
> > > > Nov 27 23:46:53 main kernel: RSP: 002b:00007ffc398103f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000139
> > > > Nov 27 23:46:53 main kernel: RAX: ffffffffffffffda RBX: 000055e0eb622480 RCX: 00007f77238f3779
> > > > Nov 27 23:46:53 main kernel: RDX: 0000000000000004 RSI: 00007f77239f744d RDI: 000000000000001b
> > > > Nov 27 23:46:53 main kernel: RBP: 0000000000000004 R08: 0000000000000000 R09: 00007f7723ef6280
> > > > Nov 27 23:46:53 main kernel: R10: 0000000000000000 R11: 0000000000000246 R12: 00007f77239f744d
> > > > Nov 27 23:46:53 main kernel: R13: 0000000000020000 R14: 000055e0eb61e630 R15: 0000000000000000
> > > > Nov 27 23:46:53 main kernel: </TASK>
> > > > Nov 27 23:46:53 main kernel: ---[ end trace ]---
> > >
> > > This was specifically with 6.17.8 but up to the current stable 6.17.9
> > > there should be no related changes afaics.
> >
> > Thanks for the report. As a wild guess, a simple fix like below
> > should suffice for this case?
> >
> >
> > Takashi
> >
> > -- 8< --
> > --- a/sound/pci/ctxfi/ctamixer.h
> > +++ b/sound/pci/ctxfi/ctamixer.h
> > @@ -22,7 +22,7 @@
> > /* Define the descriptor of a summation node resource */
> > struct sum {
> > struct rsc rsc; /* Basic resource info */
> > - unsigned char idx[8];
> > + unsigned char idx[8 + 1]; /* msr + master */
> > };
> >
> > /* Define sum resource request description info */
>
> FWIW, I cannot test this myself. "waxhead", can you please test the
> proposed patch and report back if it fixes the issue for you?
In case you need some support on how to actually do that, we have the
"simple patching and building" instruction here:
https://kernel-team.pages.debian.net/kernel-handbook/ch-common-tasks.html#id-1.6.6.4
Proceed as follow, create the patch file as posted by Takashi, save it
as e.g. ubsan-fix.patch
Fetch the linux source
apt-get source linux
cd linux-*
Make sure the required dependencies are installed see the above
preparation step in 4.5.1, that is
apt-get install build-essential
apt-get build-dep linux
apt-get install devscripts
then within the unpacked linux source run the test-patches script
using the proposed patch:
debian/bin/test-patches ../ubsan-fix.patch
Let me know if you can proceed with that.
Regards,
Salvatore
Powered by blists - more mailing lists