Bug 2275162 - Missing bounds instrumentation: enable CONFIG_UBSAN_BOUNDS=y
Summary: Missing bounds instrumentation: enable CONFIG_UBSAN_BOUNDS=y
Keywords:
Status: CLOSED NEXTRELEASE
Alias: None
Product: Fedora
Classification: Fedora
Component: kernel
Version: rawhide
Hardware: Unspecified
OS: Linux
unspecified
medium
Target Milestone: ---
Assignee: Kernel Maintainer List
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2024-04-15 17:50 UTC by Kees Cook
Modified: 2024-04-21 21:59 UTC (History)
18 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2024-04-18 16:51:00 UTC
Type: ---
Embargoed:


Attachments (Terms of Use)

Description Kees Cook 2024-04-15 17:50:06 UTC
1. Please describe the problem:

Simple bounds overflows (related to fixed-sized arrays, allocations, etc) are not being detected by the Fedora kernel. CONFIG_UBSAN_BOUNDS=y has been available since at least v5.16, and is default enabled on other distros (e.g. Ubuntu and Android).

2. What is the Version-Release number of the kernel:

N/A

3. Did it work previously in Fedora? If so, what kernel version did the issue
   *first* appear?  Old kernels are available for download at
   https://koji.fedoraproject.org/koji/packageinfo?packageID=8 :

no

4. Can you reproduce this issue? If so, please provide the steps to reproduce
   the issue below:

Yes, rebuild with CONFIG_LKDTM=y and notice that:

echo ARRAY_BOUNDS | cat > /sys/kernel/debug/provoke_crash/DIRECT

does not cause a WARN visible in "dmesg".

5. Does this problem occur with the latest Rawhide kernel? To install the
   Rawhide kernel, run ``sudo dnf install fedora-repos-rawhide`` followed by
   ``sudo dnf update --enablerepo=rawhide kernel``:

Yes

6. Are you running any modules that not shipped with directly Fedora's kernel?:

N/A

7. Please attach the kernel logs. You can get the complete kernel log
   for a boot with ``journalctl --no-hostname -k > dmesg.txt``. If the
   issue occurred on a previous boot, use the journalctl ``-b`` flag.

N/A

Reproducible: Always

Comment 1 Justin M. Forbes 2024-04-18 16:51:00 UTC
This has been enabled for Rawhide and will be enabled in 6.8.8 stable updates as they go.


Note You need to log in before you can comment on or make changes to this bug.