UBSAN: array-index-out-of-bounds in precalculate_color

Status: fixed on 2020/11/16 12:12
Subsystems: media
[Documentation on labels]
Fix commit: e3158a5e7e66 media: vivid: Fix global-out-of-bounds read in precalculate_color()
First crash: 2143d, last: 2118d

Sample crash report:
================================================================================
UBSAN: array-index-out-of-bounds in drivers/media/common/v4l2-tpg/v4l2-tpg-core.c:942:56
index 29375 is out of range for type 's8 [257]'
CPU: 0 PID: 6888 Comm: vivid-000-vid-c Not tainted 5.9.0-rc8-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x198/0x1fd lib/dump_stack.c:118
 ubsan_epilogue+0xb/0x5a lib/ubsan.c:148
 __ubsan_handle_out_of_bounds.cold+0x62/0x6c lib/ubsan.c:356
 precalculate_color+0x2621/0x2900 drivers/media/common/v4l2-tpg/v4l2-tpg-core.c:942
 tpg_precalculate_colors drivers/media/common/v4l2-tpg/v4l2-tpg-core.c:1093 [inline]
 tpg_recalc+0x5c8/0x2910 drivers/media/common/v4l2-tpg/v4l2-tpg-core.c:2144
 tpg_calc_text_basep+0xbe/0x2b0 drivers/media/common/v4l2-tpg/v4l2-tpg-core.c:2162
 vivid_fillbuff+0x188d/0x3c50 drivers/media/test-drivers/vivid/vivid-kthread-cap.c:466
 vivid_thread_vid_cap_tick+0x88b/0x2350 drivers/media/test-drivers/vivid/vivid-kthread-cap.c:727
 vivid_thread_vid_cap+0x5d1/0xa50 drivers/media/test-drivers/vivid/vivid-kthread-cap.c:866
 kthread+0x3b5/0x4a0 kernel/kthread.c:292
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:294
================================================================================
Kernel panic - not syncing: panic_on_warn set ...
CPU: 0 PID: 6888 Comm: vivid-000-vid-c Not tainted 5.9.0-rc8-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x198/0x1fd lib/dump_stack.c:118
 panic+0x382/0x7fb kernel/panic.c:231
 ubsan_epilogue+0x54/0x5a lib/ubsan.c:162
 __ubsan_handle_out_of_bounds.cold+0x62/0x6c lib/ubsan.c:356
 precalculate_color+0x2621/0x2900 drivers/media/common/v4l2-tpg/v4l2-tpg-core.c:942
 tpg_precalculate_colors drivers/media/common/v4l2-tpg/v4l2-tpg-core.c:1093 [inline]
 tpg_recalc+0x5c8/0x2910 drivers/media/common/v4l2-tpg/v4l2-tpg-core.c:2144
 tpg_calc_text_basep+0xbe/0x2b0 drivers/media/common/v4l2-tpg/v4l2-tpg-core.c:2162
 vivid_fillbuff+0x188d/0x3c50 drivers/media/test-drivers/vivid/vivid-kthread-cap.c:466
 vivid_thread_vid_cap_tick+0x88b/0x2350 drivers/media/test-drivers/vivid/vivid-kthread-cap.c:727
 vivid_thread_vid_cap+0x5d1/0xa50 drivers/media/test-drivers/vivid/vivid-kthread-cap.c:866
 kthread+0x3b5/0x4a0 kernel/kthread.c:292
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:294
Kernel Offset: disabled
Rebooting in 86400 seconds..

Crashes (153):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2020/10/05 08:01 upstream 549738f15da0 5ef9c291 .config console log report syz C ci-upstream-kasan-gce
2020/10/06 17:04 upstream 7575fdda569b 1880b4a9 .config console log report syz C ci-upstream-kasan-gce-386
2020/10/01 19:17 upstream 60e720931556 a9767fb2 .config console log report syz C ci-upstream-kasan-gce-386
2020/10/12 17:13 upstream bbf5c979011a d32b0bbf .config console log report info ci-upstream-kasan-gce
2020/10/11 22:38 upstream 3dd0130f2430 4a77ae0b .config console log report info ci-upstream-kasan-gce
2020/10/11 01:27 upstream da690031a5d6 4a77ae0b .config console log report info ci-upstream-kasan-gce-root
2020/10/10 04:58 upstream 6f2f486d57c4 93817d89 .config console log report info ci-upstream-kasan-gce-root
2020/10/10 03:39 upstream 6f2f486d57c4 93817d89 .config console log report info ci-upstream-kasan-gce-root
2020/10/08 22:49 upstream 3d006ee42dde 92390980 .config console log report info ci-upstream-kasan-gce
2020/10/08 21:19 upstream 3d006ee42dde 92390980 .config console log report info ci-upstream-kasan-gce
2020/10/08 16:21 upstream c85fb28b6f99 92390980 .config console log report info ci-upstream-kasan-gce-root
2020/10/07 11:35 upstream c85fb28b6f99 1880b4a9 .config console log report info ci-upstream-kasan-gce-root
2020/10/06 23:47 upstream c85fb28b6f99 1880b4a9 .config console log report info ci-upstream-kasan-gce
2020/10/06 02:45 upstream 7575fdda569b 1880b4a9 .config console log report info ci-upstream-kasan-gce
2020/10/05 19:25 upstream 549738f15da0 1880b4a9 .config console log report info ci-upstream-kasan-gce-root
2020/10/05 17:35 upstream 549738f15da0 1880b4a9 .config console log report info ci-upstream-kasan-gce-selinux-root
2020/10/05 04:43 upstream 549738f15da0 5ef9c291 .config console log report info ci-upstream-kasan-gce-root
2020/10/05 02:06 upstream 549738f15da0 5ef9c291 .config console log report info ci-upstream-kasan-gce
2020/10/05 00:53 upstream 549738f15da0 5ef9c291 .config console log report info ci-upstream-kasan-gce-selinux-root
2020/10/04 17:38 upstream 22fbc037cd32 5ef9c291 .config console log report info ci-upstream-kasan-gce
2020/10/04 11:32 upstream 22fbc037cd32 5ef9c291 .config console log report info ci-upstream-kasan-gce-selinux-root
2020/10/04 10:06 upstream 22fbc037cd32 5ef9c291 .config console log report info ci-upstream-kasan-gce
2020/10/03 10:19 upstream d3d45f8220d6 2653fa43 .config console log report info ci-upstream-kasan-gce-selinux-root
2020/10/02 17:03 upstream 472e5b056f00 4969d6ca .config console log report info ci-upstream-kasan-gce
2020/10/02 15:33 upstream 472e5b056f00 4969d6ca .config console log report info ci-upstream-kasan-gce-selinux-root
2020/10/02 10:54 upstream fcadab740480 9602ddf4 .config console log report info ci-upstream-kasan-gce-selinux-root
2020/10/02 01:36 upstream fcadab740480 9602ddf4 .config console log report info ci-upstream-kasan-gce
2020/10/02 00:03 upstream fcadab740480 9602ddf4 .config console log report info ci-upstream-kasan-gce-root
2020/10/01 22:18 upstream fcadab740480 9602ddf4 .config console log report info ci-upstream-kasan-gce
2020/10/01 21:15 upstream fcadab740480 9602ddf4 .config console log report info ci-upstream-kasan-gce
2020/10/01 06:14 upstream 60e720931556 a9767fb2 .config console log report info ci-upstream-kasan-gce-root
2020/09/30 20:14 upstream 02de58b24d2e 8516f6d3 .config console log report info ci-upstream-kasan-gce
2020/09/30 17:49 upstream 02de58b24d2e 8516f6d3 .config console log report info ci-upstream-kasan-gce
2020/09/30 05:39 upstream ccc1d052eff9 5abc3f1a .config console log report info ci-upstream-kasan-gce
2020/09/30 05:24 upstream ccc1d052eff9 5abc3f1a .config console log report info ci-upstream-kasan-gce
2020/09/17 12:24 upstream 5925fa68fe82 8247808b .config console log report info ci-upstream-kasan-gce-selinux-root
2020/10/07 01:16 upstream c85fb28b6f99 1880b4a9 .config console log report info ci-upstream-kasan-gce-386
2020/10/04 11:56 upstream 22fbc037cd32 5ef9c291 .config console log report info ci-upstream-kasan-gce-386
2020/10/03 17:35 upstream d3d45f8220d6 2653fa43 .config console log report info ci-upstream-kasan-gce-386
2020/10/02 21:40 upstream 472e5b056f00 4969d6ca .config console log report info ci-upstream-kasan-gce-386
2020/10/02 20:40 upstream 472e5b056f00 4969d6ca .config console log report info ci-upstream-kasan-gce-386
2020/10/01 20:27 upstream fcadab740480 9602ddf4 .config console log report info ci-upstream-kasan-gce-386
2020/10/01 15:16 upstream 60e720931556 a9767fb2 .config console log report info ci-upstream-kasan-gce-386
2020/10/01 08:40 upstream 60e720931556 a9767fb2 .config console log report info ci-upstream-kasan-gce-386
2020/10/01 04:58 upstream 60e720931556 8516f6d3 .config console log report info ci-upstream-kasan-gce-386
2020/10/01 01:36 upstream 02de58b24d2e 8516f6d3 .config console log report info ci-upstream-kasan-gce-386
2020/09/30 12:11 upstream ccc1d052eff9 5abc3f1a .config console log report info ci-upstream-kasan-gce-386
2020/09/30 11:00 upstream ccc1d052eff9 5abc3f1a .config console log report info ci-upstream-kasan-gce-386
2020/09/30 08:10 upstream ccc1d052eff9 5abc3f1a .config console log report info ci-upstream-kasan-gce-386
* Struck through repros no longer work on HEAD.