Re: [PATCH v2 5/5] iommu/arm-smmu-v3-test: Fix UBSAN error
flat view
From: Pranjal Shrivastava <praan@google.com>
Date: 2026-09-29 00:03:47
Also in:
linux-iommu, lkml
On Thu, Sep 24, 2026 at 08:56:16AM +0000, Mostafa Saleh wrote:
struct arm_smmu_invs marks its flexible array member inv[] with the
__counted_by(max_invs).
arm_smmu_v3_invs_test() uses invs1 to invs5 which has num_invs = 3
but omit max_invs.
This causes the following UBSAN error:
[ 2.333240] UBSAN: array-index-out-of-bounds in drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c:1116:21
[ 2.333604] # arm_smmu_v3_invs_test: lib/ubsan.c:228: array-index-out-of-bounds in drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c
[ 2.334129] index 1 is out of range for type 'struct arm_smmu_inv[] __counted_by(max_invs)' (aka 'struct arm_smmu_inv[]')
[ 2.335375] CPU: 6 UID: 0 PID: 155 Comm: kunit_try_catch Tainted: G N 7.2.0-g8dcb331fbb72 #2 PREEMPT
[ 2.335759] Tainted: [N]=TEST
[ 2.335791] Hardware name: linux,dummy-virt (DT)
[ 2.336254] Call trace:
[ 2.336932] show_stack+0x18/0x24 (C)
[ 2.338443] __dump_stack+0x28/0x38
[ 2.338494] dump_stack_lvl+0x54/0x6c
[ 2.338518] dump_stack+0x18/0x24
[ 2.338541] ubsan_epilogue+0x10/0x44
[ 2.338565] __ubsan_handle_out_of_bounds+0xb8/0xbc
[ 2.338834] arm_smmu_invs_merge+0x688/0x8ac
[ 2.338862] arm_smmu_v3_invs_test+0xd4/0x598
[ 2.338890] kunit_try_run_case+0x64/0x160
[ 2.338914] kunit_generic_run_threadfn_adapter+0x28/0x4c
[ 2.338955] kthread+0x10c/0x12c
[ 2.338984] ret_from_fork+0x10/0x20
[ 2.339433] ---[ end trace ]---
Explicitly set max_invs = 3 on the test arrays to match the number of
elements.
Fixes: 15a2a5645ad7 ("iommu/arm-smmu-v3: Introduce a per-domain arm_smmu_invs array")
Reviewed-by: Nicolin Chen <redacted>
Reviewed-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Mostafa Saleh <smostafa@google.com>Reviewed-by: Pranjal Shrivastava <praan@google.com> Thanks, Praan