Aquantia GbE LAN driver causes UBSAN error during kernel boot

Same in my system:
[ 294.432996] UBSAN: array-index-out-of-bounds in /build/linux-Qow4fL/linux-5.15.0/drivers/net/ethernet/aquantia/atlantic/aq_nic.c:484:48
[ 294.433695] index 8 is out of range for type 'aq_vec_s *[8]'
[ 294.434372] CPU: 5 PID: 1341 Comm: systemd-network Tainted: P O 5.15.0-17-generic #17-Ubuntu
[ 294.434374] Hardware name: System manufacturer System Product Name/Z170-PRO, BIOS 3801 03/14/2018
[ 294.434374] Call Trace:
[ 294.434376] <TASK>
[ 294.434377] show_stack+0x52/0x58
[ 294.434380] dump_stack_lvl+0x4a/0x5f
[ 294.434383] dump_stack+0x10/0x12
[ 294.434384] ubsan_epilogue+0x9/0x45
[ 294.434385] __ubsan_handle_out_of_bounds.cold+0x44/0x49
[ 294.434386] ? aq_nic_get_link_ksettings+0x58/0x380 [atlantic]
[ 294.434393] ? aq_vec_start+0x94/0xb0 [atlantic]
[ 294.434398] aq_nic_start+0x3af/0x3d0 [atlantic]
[ 294.434402] aq_ndev_open+0x49/0x70 [atlantic]
[ 294.434405] __dev_open+0xf3/0x1c0
[ 294.434408] __dev_change_flags+0x1a3/0x220
[ 294.434410] dev_change_flags+0x26/0x60
[ 294.434411] do_setlink+0x28a/0xc50
[ 294.434414] ? __nla_validate_parse+0x4c/0x1a0
[ 294.434416] rtnl_setlink+0xf6/0x170
[ 294.434419] rtnetlink_rcv_msg+0x15d/0x400
[ 294.434421] ? rtnl_calcit.isra.0+0x130/0x130
[ 294.434422] netlink_rcv_skb+0x55/0x100
[ 294.434424] rtnetlink_rcv+0x15/0x20
[ 294.434426] netlink_unicast+0x21d/0x330
[ 294.434427] netlink_sendmsg+0x24c/0x4c0
[ 294.434428] sock_sendmsg+0x65/0x70
[ 294.434430] __sys_sendto+0x113/0x190
[ 294.434433] __x64_sys_sendto+0x24/0x30
[ 294.434435] do_syscall_64+0x5c/0xc0
[ 294.434437] ? syscall_exit_to_user_mode+0x27/0x50
[ 294.434439] ? do_syscall_64+0x69/0xc0
[ 294.434440] ? __secure_computing+0x42/0xe0
[ 294.434442] ? syscall_trace_enter.constprop.0+0xa3/0x1c0
[ 294.434444] ? exit_to_user_mode_prepare+0x37/0xb0
[ 294.434446] ? syscall_exit_to_user_mode+0x27/0x50
[ 294.434447] ? __do_sys_gettid+0x1b/0x20
[ 294.434449] ? do_syscall_64+0x69/0xc0
[ 294.434450] ? do_syscall_64+0x69/0xc0
[ 294.434451] entry_SYSCALL_64_after_hwframe+0x44/0xae
[ 294.434453] RIP: 0033:0x7feeaf99146a
[ 294.434455] Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb b8 0f 1f 00 f3 0f 1e fa 41 89 ca 64 8b 04 25 18 00 00 00 85 c0 75 15 b8 2c 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 7e c3 0f 1f 44 00 00 41 54 48 83 ec 30 44 89
[ 294.434456] RSP: 002b:00007ffc9cf72cf8 EFLAGS: 00000246 ORIG_RAX: 000000000000002c
[ 294.434458] RAX: ffffffffffffffda RBX: 000055afe2a315e8 RCX: 00007feeaf99146a
[ 294.434458] RDX: 0000000000000020 RSI: 000055afe2a30290 RDI: 0000000000000003
[ 294.434459] RBP: 000055afe2a11900 R08: 00007ffc9cf72d00 R09: 0000000000000080
[ 294.434460] R10: 0000000000000000 R11: 0000000000000246 R12: 000055afe2a32bf0
[ 294.434461] R13: 000000000000053d R14: 000055afe2a315a0 R15: 000055afe13b0e40
[ 294.434462] </TASK>

Status changed to 'Confirmed' because the bug affects multiple users.

dmesg logfile

lspci logfile

uname logfile

Updated to 5.15.0-18-generic and now the network adapter doesn't work at all.

reverted to 5.13.0-28-generic from impish and aqc107 is still broken. is this caused by some updated firmware blob in jammy?

My system seems to be working now. My dmesg shows the driver as loading:

[ 1.439880] atlantic 0000:07:00.0 enp7s0: renamed from eth0

I had some problems with my distribution upgrade and had to re-run it, ie "apt dist-upgrade" along with other commands.

Out of bounds still happens to me in 5.15.0-18.18.

This bug returned on my machine. Not sure why it disappeared & reappeared. Also now on 5.15.0-18-generic.

Does latest mainline kernel have this issue?

I checked on 5.17-rc3 most recently and reproduced it. AFAICT this code hasn't changed since 5.16-rc4.

Please give this patch a try, thanks!

@KH:
Yeah that fixes it for me. I applied on top of a 5.15 kernel and would have seen UBSAN error at bootup.

Feel free to added a "Tested-by: Mario Limonciello <email address hidden>" tag for it when you submit up if you don't change it.

This doesn't seem to resolve it for me. It's been a long time since I recompiled kernel modules, these are the steps I took:

# module compile instructions from https://wiki.ubuntu.com/Kernel/SourceCode

$ uname -r
5.15.0-18-generic
$ git clone git://git.launchpad.net/~ubuntu-kernel/ubuntu/+source/linux/+git/jammy linux-jammy
$ cd linux-jammy
$ git checkout Ubuntu-5.15.0-18.18
$ cd drivers/net/ethernet/aquantia/atlantic
# edit Makefile and add fq path to Include:
# ccflags-y += -I$(srctree)/$(src) -I/blahblah/linux-jammy/drivers/net/ethernet/aquantia/atlantic
$ make -C /lib/modules/`uname -r`/build M=$PWD
...
$ sudo modprobe -v -r atlantic
rmmod atlantic
rmmod macsec
$ sudo cp atlantic.ko /lib/modules/5.15.0-18-generic/kernel/drivers/net/ethernet/aquantia/atlantic/
$ sudo modprobe -v atlantic
insmod /lib/modules/5.15.0-18-generic/kernel/drivers/net/macsec.ko
insmod /lib/modules/5.15.0-18-generic/kernel/drivers/net/ethernet/aquantia/atlantic/atlantic.ko
$ sudo dmesg
14218.647296] ================================================================================
[14218.647297] UBSAN: array-index-out-of-bounds in /blahblah/linux-jammy/drivers/net/ethernet/aquantia/atlantic/aq_nic.c:515:49
[14218.647299] index 8 is out of range for type 'aq_vec_s *[8]'
[14218.647300] CPU: 4 PID: 2680 Comm: NetworkManager Tainted: P OE 5.15.0-18-generic #18-Ubuntu
[14218.647301] Hardware name: Gigabyte Technology Co., Ltd. X399 AORUS XTREME/X399 AORUS XTREME-CF, BIOS F5 12/11/2019
[14218.647302] Call Trace:
[14218.647302] <TASK>
[14218.647303] show_stack+0x52/0x58
[14218.647304] dump_stack_lvl+0x4a/0x5f
[14218.647306] dump_stack+0x10/0x12
[14218.647307] ubsan_epilogue+0x9/0x45
[14218.647308] __ubsan_handle_out_of_bounds.cold+0x44/0x49
[14218.647309] ? aq_vec_ring_free+0x80/0x80 [atlantic]
[14218.647316] aq_nic_start+0x3c3/0x3d0 [atlantic]
[14218.647322] aq_ndev_open+0x49/0x70 [atlantic]
[14218.647329] __dev_open+0xf3/0x1c0
[14218.647331] __dev_change_flags+0x1a3/0x220
[14218.647332] ? __nla_validate_parse+0x14b/0x1a0
[14218.647334] dev_change_flags+0x26/0x60
[14218.647335] do_setlink+0x28a/0xc50
[14218.647337] ? inet6_set_link_af+0x4e/0xb0
[14218.647338] ? cpumask_next+0x23/0x30
[14218.647340] ? __nla_validate_parse+0x4c/0x1a0
[14218.647341] ? __snmp6_fill_stats64.constprop.0+0x121/0x150
[14218.647342] __rtnl_newlink+0x608/0xa10
[14218.647344] ? __nla_reserve+0x41/0x50
[14218.647345] ? skb_free_head+0x68/0x80
[14218.647347] ? cpumask_next_and+0x24/0x30
[14218.647348] ? update_sg_lb_stats+0x7c/0x4f0
[14218.647349] ? cpufreq_driver_resolve_freq+0x10/0x20
[14218.647351] ? get_next_freq+0x65/0x90
[14218.647352] ? sugov_get_util+0x77/0xa0
[14218.647353] ? sugov_update_single_freq+0xf1/0x220
[14218.647354] ? sugov_exit+0xb0/0xb0
[14218.647357] ? kmem_cache_alloc_trace+0x19e/0x2e0
[14218.647359] rtnl_newlink+0x49/0x70
[14218.647360] rtnetlink_rcv_msg+0x15d/0x400
[14218.647362] ? rtnl_calcit.isra.0+0x130/0x130
[14218.647363] netlink_rcv_skb+0x55/0x100
[14218.647365] rtnetlink_rcv+0x15/0x20
[14218.647366] netlink_unicast+0x21d/0x330
[14218.647367] netlink_sendmsg+0x24c/0x4c0
[14218.647369] sock_sendmsg+0x65/0x70
[14218.64...

Oh I forgot to add that i also applied the patch before compiling.

Please try this one:
https://<email address hidden>/

which converts all the usage pattern to a safer form.

This new patch doesn't appear to resolve issue either. However, I did get it to work if I extended your technique to aq_nic.c. See following comment with patch.

Then I see the following in my dmesg:

[ 2991.604548] atlantic 0000:07:00.0 enp7s0: renamed from eth0

Patch as file.

I'm gonna chime in too. I have applied both patches from #18 and #20 and recompiled the module, however I still get the UBSAN: array-index-out-of-bounds messsage. NIC seems to work though. I am not a programmer, so unfortunately I can't come up with a solution, but I am willing to test.

Kernel: 5.15.0-25-generic
MB: ASRock Fatal1ty X399 Professional Gaming
NIC: Aquantia AQC107

This might be fixed in a future kernel release. I see the above patches in github (18 days old).

https://github.com/torvalds/linux/commit/8d3a6c37d50d5a0504c126c932cc749e6dd9c78f

I can see aq_vec_stop in your stack trace and I can see the above patch addresses that frame.

That said, are you sure you've successfully loaded the module after patching and compiling? (like in my comment #16 but also including step to patch the files). One thing I did was add a printf statement as well as patch code to be sure (you might need to include stdio.h).

I'm not 100% sure if I loaded the new module correctly, but I believe that I did. Here are the steps I took to compile the module and load it, which resulted in the output of #21:

git clone git://git.launchpad.net/~ubuntu-kernel/ubuntu/+source/linux/+git/jammy linux-jammy
cd linux-jammy/
uname -r
git checkout Ubuntu-5.15.0-25.25
cd drivers/net/ethernet/aquantia/atlantic
nano Makefile # added PWD to ccflags line
nano aq_vec.c.patch
nano aq_nic.c.patch
patch < aq_vec.c.patch
patch < aq_nic.c.patch
nano aq_vec.c
make -C /lib/modules/`uname -r`/build M=$PWD
sudo modprobe -v -r atlantic
sudo rmmod atlantic
sudo rmmod macsec
sudo cp atlantic.ko /lib/modules/5.15.0-25-generic/kernel/drivers/net/ethernet/aquantia/atlantic/
sudo modprobe -v atlantic
sudo dmesg

I have tried including stdio.h and adding a printf to verify the new module was indeed loaded, but that kept failing with "no such file" errors when trying to compile, even though I have build-essentials installed.

I have tried compiling the module with the files from https://github.com/torvalds/linux/tree/master/drivers/net/ethernet/aquantia/atlantic, however that errors out with "implicit declaration of function ‘platform_get_ethdev_address’ [-Werror=implicit-function-declaration]". A quick google search revealed that this is supposedly a 'new' function which isn't present in 5.15.0 yet, though I might be wrong.

Just a couple of other suggestions.

You can generate a patch file from the upstream kernel repo. eg

cd linux-jammy
curl https://github.com/torvalds/linux/commit/8d3a6c37d50d5a0504c126c932cc749e6dd9c78f.patch -o ./atlantic.patch
git diff
git apply ./atlantic.patch
git diff

I was wrong about printf. You need to use printk

printk(KERN_INFO "HERE!\n");

I expect printk just will work although you might need to "#include <linux/kernel.h>"

Sorry for the delay, life happened...

After mucking about with this for the past few days and not being able to get the module to compile on 5.15 for the life of me (always same error "implicit declaration of function ‘platform_get_ethdev_address’ [-Werror=implicit-function-declaration]"), I have decided to just build 5.18-rc6 out of desperation. I figured the changes should be included by now, though I'm not sure and don't know how to check...

This is what I did:

sudo apt install alien autoconf bison build-essential ccache fakeroot flex gawk git libattr1-dev libblkid-dev libdevmapper-dev libelf-dev libncurses5-dev libselinux-dev libssl-dev libtool libudev-dev linux-headers-$(uname -r) uuid-dev zlib1g-dev
mkdir build
cd build
git clone git://git.launchpad.net/~ubuntu-kernel-test/ubuntu/+source/linux/+git/mainline-crack ubuntu_kernel
cd ubuntu_kernel
git checkout tags/v5.18-rc6
cp /boot/config-"$(uname -r)" .config
yes '' | make oldconfig
make prepare scripts
cd ..
git clone https://github.com/zfsonlinux/zfs.git
cd zfs
git checkout zfs-2.1.5-staging
sh autogen.sh
./configure --prefix=/ --libdir=/lib --includedir=/usr/include --datarootdir=/usr/share --enable-linux-builtin=yes --with-linux=$HOME/build/ubuntu_kernel --with-linux-obj=$HOME/build/ubuntu_kernel
./copy-builtin $HOME/build/ubuntu_kernel
cd ../ubuntu_kernel
make menuconfig # include zfs
scripts/config --set-str SYSTEM_TRUSTED_KEYS ""
scripts/config --set-str CONFIG_SYSTEM_REVOCATION_KEYS ""
make clean
make -j 16 bindeb-pkg LOCALVERSION=-aq107-test
cd ..
sudo apt install ./linux-headers-5.18.0-rc6-aq107-test_5.18.0-rc6-aq107-test-1_amd64.deb ./linux-image-5.18.0-rc6-aq107-test_5.18.0-rc6-aq107-test-1_amd64.deb

After a reboot I seem to get exactly the same error, stack trace is near the bottom of the log.
What should I do now?

Actually I took a look at the aq_nic.c and it looks like there are still places in the code that need patching to avoid UB. For example, from your dmesg I see it pointing to this section of code (https://github.com/torvalds/linux/blob/8d3a6c37d50d5a0504c126c932cc749e6dd9c78f/drivers/net/ethernet/aquantia/atlantic/aq_nic.c#L1267-L1269).

Which looks like this:

 for (i = 0U, aq_vec = self->aq_vec[0];
  self->aq_vecs > i; ++i, aq_vec = self->aq_vec[i])
  aq_vec_stop(aq_vec);

And, to avoid UBSAN, should be rewritten as:

 for (i = 0U; self->aq_vecs > i; ++i) {
  aq_vec = self->aq_vec[i];
  aq_vec_stop(aq_vec);
        }

And, in fact, looks like there are another two places in that file that require the same treatment.

Nice catch, mind to send a patch to fix it?

I tried changing the function, now the module doesn't compile.

EDIT: Sorry, forgot to close the curly bracket...

I have successfully modified two of the mentioned three functions and tested the module, so far UBSAN does not complain anymore :)

Unfdortunately I can't rewrite the third function, since it does not match the pattern (and I have no idea what I'm doing)

for (tc = 0U; tc < self->aq_nic_cfg.tcs; tc++) {
    for (i = 0U, aq_vec = self->aq_vec[0];
        aq_vec && self->aq_vecs > i;
        ++i, aq_vec = self->aq_vec[i]) {
            data += count;
            count = aq_vec_get_sw_stats(aq_vec, tc, data);
    }
}

I have included a diff for the other two functions.

I think the last/3rd one might be rewritten like:

 for (tc = 0U; tc < self->aq_nic_cfg.tcs; tc++) {
  for (i = 0U; self->aq_vecs > i; ++i) {
   aq_vec = self->aq_vec[i];
   if (aq_vec) {
    data += count;
    count = aq_vec_get_sw_stats(aq_vec, tc, data);
   }
  }
 }

Have tested whether it compiles sorry.

Thank you @bsdz, compiles and works flawlessly since yesterday. UBSAN is happy, performance is as expected.

@kaihengfeng, is this patch suitable for inclusion upstream?

I think that's a bit different to the original version, which breaks out the loop as soon as "aq_vec" evaluates to false.

So, instead of

if (aq_vec) {
...
}

Should be

if (!aq_vec)
    break;

I have implemented your suggestion, so far no issues. I'm going to kick off my backup now and do some more testing later.

The following two lines shouldn't be omitted:
data += count;
count = aq_vec_get_sw_stats(aq_vec, tc, data);

Sorry. Like this?

 for (tc = 0U; tc < self->aq_nic_cfg.tcs; tc++) {
  for (i = 0U; self->aq_vecs > i; ++i) {
   aq_vec = self->aq_vec[i];
   if (!aq_vec)
    break;
    data += count;
    count = aq_vec_get_sw_stats(aq_vec, tc, data);
  }
 }

Yes, that one looks correct.

OK, so far everything seems to be working great. Performance is good, no UBSAN messages, no other abnormalities. I think we are good now.

Great! Please consider to send it to upstream mailing list.

How would I go about doing so, while giving credit to bsdz and you?

https://www.kernel.org/doc/html/latest/process/submitting-patches.html
You can use tags like "Suggested-by:" for the email of KH and bsdz.

This bug is awaiting verification that the linux-oem-5.17/5.17.0-1006.6 kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-jammy' to 'verification-done-jammy'. If the problem still exists, change the tag 'verification-needed-jammy' to 'verification-failed-jammy'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

This bug is awaiting verification that the linux-oem-5.14/5.14.0-1040.44 kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-focal' to 'verification-done-focal'. If the problem still exists, change the tag 'verification-needed-focal' to 'verification-failed-focal'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

I followed instructions under the wiki (https://wiki.ubuntu.com/Testing/EnableProposed) using the "Developer Options" to enable pre-released updates (jammy-proposed); I then also followed section "Selective upgrading from -proposed" to set a pin-priority of 400. I then installed proposed kernel as follows:

sudo apt-get install linux-generic/jammy-proposed linux-headers-generic/jammy-proposed

However, inspection of dmesg shows the proposed/installed kernel is 5.15.0-35-generic (not the version from the above Ubuntu kernel bot, i.e. linux-oem-5.17/5.17.0-1006.6 or linux-oem-5.14/5.14.0-1040.44).

Also, the UBSAN issue still persists.

Do I need to do something else?

I experience this with Ubuntu kernel 5.15.0-33, but not with 5.15.0-25.
I installed the system with the latter, and then updated to the former, with which it stopped working. Selecting 5.15.0-25 in grub still works.

the fix for oem-5.14 comes via stable updates

oem-5.17 verification missing

oh well, the fix came via stable backports, so marking verified

This bug was fixed in the package linux-oem-5.17 - 5.17.0-1011.12

---------------
linux-oem-5.17 (5.17.0-1011.12) jammy; urgency=medium

  * CVE-2022-1972
    - netfilter: nf_tables: sanitize nft_set_desc_concat_parse()

  * CVE-2022-1966
    - netfilter: nf_tables: disallow non-stateful expression in sets earlier

 -- Thadeu Lima de Souza Cascardo <email address hidden> Fri, 03 Jun 2022 14:17:23 -0300

This bug was fixed in the package linux-oem-5.14 - 5.14.0-1042.47

---------------
linux-oem-5.14 (5.14.0-1042.47) focal; urgency=medium

  * CVE-2022-1972
    - netfilter: nf_tables: sanitize nft_set_desc_concat_parse()

  * CVE-2022-1966
    - netfilter: nf_tables: disallow non-stateful expression in sets earlier

 -- Thadeu Lima de Souza Cascardo <email address hidden> Fri, 03 Jun 2022 15:00:01 -0300

Status changed to 'Confirmed' because the bug affects multiple users.

What package/version is this release in? I tried (among others) linux-oem-22.04 from the proposed ppa with no luck. I still see this issue. When I looked at the source, it appeared the problem cod (++i, aq_vec = self->aq_vec[i]) is still present in the aq_nic.c file in three places, including line 1268. I get an UBSAN error on boot for aq_nic.c:1268

This bug was fixed in the package linux - 5.15.0-41.44

---------------
linux (5.15.0-41.44) jammy; urgency=medium

  * jammy/linux: 5.15.0-41.44 -proposed tracker (LP: #1979448)

  * Fix can't boot up after change to vmd (LP: #1976587)
    - PCI: vmd: Assign VMD IRQ domain before enumeration
    - PCI: vmd: Revert 2565e5b69c44 ("PCI: vmd: Do not disable MSI-X remapping if
      interrupt remapping is enabled by IOMMU.")

  * [SRU][Jammy/OEM-5.17][PATCH 0/1] Fix calltrace in mac80211 (LP: #1978297)
    - mac80211: fix struct ieee80211_tx_info size

  * [SRU][Jammy][PATCH 0/1] Fix amd display corruption on s2idle resume
    (LP: #1978244)
    - drm/amd/display: Don't reinitialize DMCUB on s0ix resume

  * pl2303 serial adapter not recognized (LP: #1967493)
    - USB: serial: pl2303: fix type detection for odd device

  * Remove SAUCE patches from test_vxlan_under_vrf.sh in net of
    ubuntu_kernel_selftests (LP: #1975691)
    - Revert "UBUNTU: SAUCE: selftests: net: Don't fail test_vxlan_under_vrf on
      xfail"
    - Revert "UBUNTU: SAUCE: selftests: net: Make test for VXLAN underlay in non-
      default VRF an expected failure"

  * Fix hp_wmi_read_int() reporting error (0x05) (LP: #1979051)
    - platform/x86: hp-wmi: Fix hp_wmi_read_int() reporting error (0x05)

  * Request to back port vmci patches to Ubuntu kernel (LP: #1978145)
    - VMCI: dma dg: whitespace formatting change for vmci register defines
    - VMCI: dma dg: add MMIO access to registers
    - VMCI: dma dg: detect DMA datagram capability
    - VMCI: dma dg: set OS page size
    - VMCI: dma dg: register dummy IRQ handlers for DMA datagrams
    - VMCI: dma dg: allocate send and receive buffers for DMA datagrams
    - VMCI: dma dg: add support for DMA datagrams sends
    - VMCI: dma dg: add support for DMA datagrams receive
    - VMCI: Fix some error handling paths in vmci_guest_probe_device()
    - VMCI: Release notification_bitmap in error path
    - VMCI: Check exclusive_vectors when freeing interrupt 1
    - VMCI: Add support for ARM64
    - [Config] Update policies for VMWARE_VMCI and VMWARE_VMCI_VSOCKETS

  * [UBUNTU 20.04] rcu stalls with many storage key guests (LP: #1975582)
    - s390/gmap: voluntarily schedule during key setting
    - s390/mm: use non-quiescing sske for KVM switch to keyed guest

  * [SRU][OEM-5.14/OEM-5.17/Jammy][PATCH 0/1] Fix i915 calltrace on new ADL BIOS
    (LP: #1976214)
    - drm/i915: update new TMDS clock setting defined by VBT

  * Revert PPC get_user workaround (LP: #1976248)
    - powerpc: Export mmu_feature_keys[] as non-GPL

  * Jammy update: v5.15.39 upstream stable release (LP: #1978240)
    - MIPS: Fix CP0 counter erratum detection for R4k CPUs
    - parisc: Merge model and model name into one line in /proc/cpuinfo
    - ALSA: hda/realtek: Add quirk for Yoga Duet 7 13ITL6 speakers
    - ALSA: fireworks: fix wrong return count shorter than expected by 4 bytes
    - mmc: sdhci-msm: Reset GCC_SDCC_BCR register for SDHC
    - mmc: sunxi-mmc: Fix DMA descriptors allocated above 32 bits
    - mmc: core: Set HS clock speed before sending HS CMD13
    - gpiolib: of: fix bounds check for 'gpio-reserved-ranges'
    - x86/fpu: Prevent FPU s...

I had updated to 5.15.0-41.44, but I still get the error.

syslog:
Jul 13 15:05:58 *** kernel: [ 0.000000] Linux version 5.15.0-41-generic (buildd@lcy02-amd64-065) (gcc (Ubuntu 11.2.0-19ubuntu1) 11.2.0, GNU ld (GNU Binutils for Ubuntu) 2.38) #44-Ubuntu SMP Wed Jun 22 14:20:53 UTC 2022 (Ubuntu 5.15.0-41.44-generic 5.15.39)
...
Jul 13 15:06:04 *** kernel: [ 13.227143] UBSAN: array-index-out-of-bounds in /build/linux-TxVM9Q/linux-5.15.0/drivers/net/ethernet/aquantia/atlantic/aq_nic.c:1262:48
Jul 13 15:06:04 *** kernel: [ 13.228858] index 8 is out of range for type 'aq_vec_s *[8]'

uname -a:
Linux ***.***.*** 5.15.0-41-generic #44-Ubuntu SMP Wed Jun 22 14:20:53 UTC 2022 x86_64 x86_64 x86_64 GNU/Linux

I am still getting this on 5.15.0-43-lowlatency as well. Filed bug report that turned out to be a duplicate at Bug #1982878

7/26/22 7:33 AM kernel ================================================================================
7/26/22 7:33 AM kernel UBSAN: array-index-out-of-bounds in /build/linux-lowlatency-gn5Bpn/linux-lowlatency-5.15.0/drivers/net/ethernet/aquantia/atlantic/aq_nic.c:1262:48
7/26/22 7:33 AM kernel index 8 is out of range for type 'aq_vec_s *[8]'
7/26/22 7:33 AM kernel CPU: 2 PID: 2109 Comm: daemon-init Not tainted 5.15.0-43-lowlatency #46-Ubuntu
7/26/22 7:33 AM kernel Hardware name: To Be Filled By O.E.M. X570 Creator/X570 Creator, BIOS P3.72 05/17/2022
7/26/22 7:33 AM kernel Call Trace:
7/26/22 7:33 AM kernel <TASK>
7/26/22 7:33 AM kernel show_stack+0x52/0x58
7/26/22 7:33 AM kernel dump_stack_lvl+0x4a/0x5f
7/26/22 7:33 AM kernel dump_stack+0x10/0x12
7/26/22 7:33 AM kernel ubsan_epilogue+0x9/0x45
7/26/22 7:33 AM kernel __ubsan_handle_out_of_bounds.cold+0x44/0x49
7/26/22 7:33 AM kernel ? netdev_set_tc_queue+0x78/0x90
7/26/22 7:33 AM kernel ? aq_vec_stop+0x72/0x80 [atlantic]
7/26/22 7:33 AM kernel aq_nic_stop+0x1b2/0x1c0 [atlantic]
7/26/22 7:33 AM kernel aq_ndev_set_features+0x13f/0x1a0 [atlantic]
7/26/22 7:33 AM kernel __netdev_update_features+0x184/0x810
7/26/22 7:33 AM kernel dev_disable_lro+0x34/0x150
7/26/22 7:33 AM kernel devinet_sysctl_forward+0x1f7/0x230
7/26/22 7:33 AM kernel proc_sys_call_handler+0x161/0x2d0
7/26/22 7:33 AM kernel proc_sys_write+0x13/0x20
7/26/22 7:33 AM kernel new_sync_write+0x117/0x1a0
7/26/22 7:33 AM kernel vfs_write+0x1f3/0x290
7/26/22 7:33 AM kernel ksys_write+0x67/0xe0
7/26/22 7:33 AM kernel __x64_sys_write+0x19/0x20
7/26/22 7:33 AM kernel do_syscall_64+0x5c/0xc0
7/26/22 7:33 AM kernel ? exit_to_user_mode_prepare+0x37/0xb0
7/26/22 7:33 AM kernel ? syscall_exit_to_user_mode+0x27/0x50
7/26/22 7:33 AM kernel ? do_syscall_64+0x69/0xc0
7/26/22 7:33 AM kernel ? exit_to_user_mode_prepare+0x37/0xb0
7/26/22 7:33 AM kernel ? syscall_exit_to_user_mode+0x27/0x50
7/26/22 7:33 AM kernel ? do_syscall_64+0x69/0xc0
7/26/22 7:33 AM kernel ? asm_exc_page_fault+0x8/0x30
7/26/22 7:33 AM kernel entry_SYSCALL_64_after_hwframe+0x44/0xae
7/26/22 7:33 AM kernel RIP: 0033:0x7f4be0057a6f
7/26/22 7:33 AM kernel Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 19 c0 f7 ff 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 5c c0 f7 ff 48
7/26/22 7:33 AM kernel RSP: 002b:00007f4b9bffe810 EFLAGS: 00000293 ORIG_RAX: 0000000000000001
7/26/22 7:33 AM kernel RAX: ffffffffffffffda RBX: 0000000000000002 RCX: 00007f4be0057a6f
7/26/22 7:33 AM kernel RDX: 0000000000000002 RSI: 00007f4be09dd5e5 RDI: 0000000000000013
7/26/22 7:33 AM kernel RBP: 00007f4be09dd5e5 R08: 0000000000000000 R09: 0000000000000001
7/26/22 7:33 AM kernel R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000013
7/26/22 7:33 AM kernel R13: 0000000000000013 R14: 0000000000000000 R15: 00007f4b90024b50
7/26/22 7:33 AM kernel </TASK>
7/26/22 7:33 AM kernel ================================================================================

I have the same problem. Curiously, the patch previously submitted should fix those code lines reported in the UBSAN report

https://launchpadlibrarian.net/601133815/aq_nic.c.patch

Still present on 5.15.0-45-lowlatency after update to it.

8/6/22 10:11 AM kernel ================================================================================
8/6/22 10:11 AM kernel UBSAN: array-index-out-of-bounds in /build/linux-lowlatency-gNNzPd/linux-lowlatency-5.15.0/drivers/net/ethernet/aquantia/atlantic/aq_nic.c:1262:48
8/6/22 10:11 AM kernel index 8 is out of range for type 'aq_vec_s *[8]'
8/6/22 10:11 AM kernel CPU: 2 PID: 2097 Comm: daemon-init Not tainted 5.15.0-45-lowlatency #48-Ubuntu
8/6/22 10:11 AM kernel Hardware name: To Be Filled By O.E.M. X570 Creator/X570 Creator, BIOS P3.72 05/17/2022
8/6/22 10:11 AM kernel Call Trace:
8/6/22 10:11 AM kernel <TASK>
8/6/22 10:11 AM kernel show_stack+0x52/0x5c
8/6/22 10:11 AM kernel dump_stack_lvl+0x4a/0x63
8/6/22 10:11 AM kernel dump_stack+0x10/0x16
8/6/22 10:11 AM kernel ubsan_epilogue+0x9/0x49
8/6/22 10:11 AM kernel __ubsan_handle_out_of_bounds.cold+0x44/0x49
8/6/22 10:11 AM kernel ? qdisc_pkt_len_init+0x128/0x180
8/6/22 10:11 AM kernel ? aq_vec_stop+0x72/0x80 [atlantic]
8/6/22 10:11 AM kernel aq_nic_stop+0x1b6/0x1c0 [atlantic]
8/6/22 10:11 AM kernel aq_ndev_set_features+0x143/0x1a0 [atlantic]
8/6/22 10:11 AM kernel __netdev_update_features+0x184/0x820
8/6/22 10:11 AM kernel dev_disable_lro+0x34/0x150
8/6/22 10:11 AM kernel devinet_sysctl_forward+0x1fb/0x230
8/6/22 10:11 AM kernel proc_sys_call_handler+0x161/0x2d0
8/6/22 10:11 AM kernel proc_sys_write+0x13/0x20
8/6/22 10:11 AM kernel new_sync_write+0x117/0x1b0
8/6/22 10:11 AM kernel ? blk_tracer_print_header+0x10/0x30
8/6/22 10:11 AM kernel vfs_write+0x1fb/0x290
8/6/22 10:11 AM kernel ksys_write+0x67/0xf0
8/6/22 10:11 AM kernel __x64_sys_write+0x19/0x20
8/6/22 10:11 AM kernel do_syscall_64+0x5c/0xc0
8/6/22 10:11 AM kernel ? exit_to_user_mode_prepare+0x37/0xb0
8/6/22 10:11 AM kernel ? syscall_exit_to_user_mode+0x27/0x50
8/6/22 10:11 AM kernel ? do_syscall_64+0x69/0xc0
8/6/22 10:11 AM kernel entry_SYSCALL_64_after_hwframe+0x61/0xcb
8/6/22 10:11 AM kernel RIP: 0033:0x7ff6d640da6f
8/6/22 10:11 AM kernel Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 19 c0 f7 ff 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 5c c0 f7 ff 48
8/6/22 10:11 AM kernel RSP: 002b:00007ff6a27fb810 EFLAGS: 00000293 ORIG_RAX: 0000000000000001
8/6/22 10:11 AM kernel RAX: ffffffffffffffda RBX: 0000000000000002 RCX: 00007ff6d640da6f
8/6/22 10:11 AM kernel RDX: 0000000000000002 RSI: 00007ff6d6d965e5 RDI: 0000000000000013
8/6/22 10:11 AM kernel RBP: 00007ff6d6d965e5 R08: 0000000000000000 R09: 0000000000000001
8/6/22 10:11 AM kernel R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000013
8/6/22 10:11 AM kernel R13: 0000000000000013 R14: 0000000000000000 R15: 00007ff684024b10
8/6/22 10:11 AM kernel </TASK>

Still present in 5.15.0-46.49-lowlatency

8/10/22 7:56 AM kernel ================================================================================
8/10/22 7:56 AM kernel UBSAN: array-index-out-of-bounds in /build/linux-lowlatency-Q9YOeF/linux-lowlatency-5.15.0/drivers/net/ethernet/aquantia/atlantic/aq_nic.c:1262:48
8/10/22 7:56 AM kernel index 8 is out of range for type 'aq_vec_s *[8]'
8/10/22 7:56 AM kernel CPU: 12 PID: 2172 Comm: daemon-init Not tainted 5.15.0-46-lowlatency #49-Ubuntu
8/10/22 7:56 AM kernel Hardware name: To Be Filled By O.E.M. X570 Creator/X570 Creator, BIOS P3.72 05/17/2022
8/10/22 7:56 AM kernel Call Trace:
8/10/22 7:56 AM kernel <TASK>
8/10/22 7:56 AM kernel show_stack+0x52/0x5c
8/10/22 7:56 AM kernel dump_stack_lvl+0x4a/0x63
8/10/22 7:56 AM kernel dump_stack+0x10/0x16
8/10/22 7:56 AM kernel ubsan_epilogue+0x9/0x49
8/10/22 7:56 AM kernel __ubsan_handle_out_of_bounds.cold+0x44/0x49
8/10/22 7:56 AM kernel ? qdisc_pkt_len_init+0x108/0x180
8/10/22 7:56 AM kernel ? aq_vec_stop+0x72/0x80 [atlantic]
8/10/22 7:56 AM kernel aq_nic_stop+0x1b6/0x1c0 [atlantic]
8/10/22 7:56 AM kernel aq_ndev_set_features+0x143/0x1a0 [atlantic]
8/10/22 7:56 AM kernel __netdev_update_features+0x184/0x820
8/10/22 7:56 AM kernel dev_disable_lro+0x34/0x150
8/10/22 7:56 AM kernel devinet_sysctl_forward+0x1fb/0x230
8/10/22 7:56 AM kernel proc_sys_call_handler+0x161/0x2d0
8/10/22 7:56 AM kernel proc_sys_write+0x13/0x20
8/10/22 7:56 AM kernel new_sync_write+0x117/0x1b0
8/10/22 7:56 AM kernel ? intel_pmu_cpu_starting+0x280/0x3c0
8/10/22 7:56 AM kernel vfs_write+0x1fb/0x290
8/10/22 7:56 AM kernel ksys_write+0x67/0xf0
8/10/22 7:56 AM kernel __x64_sys_write+0x19/0x20
8/10/22 7:56 AM kernel do_syscall_64+0x5c/0xc0
8/10/22 7:56 AM kernel ? exit_to_user_mode_prepare+0x37/0xb0
8/10/22 7:56 AM kernel ? syscall_exit_to_user_mode+0x27/0x50
8/10/22 7:56 AM kernel ? do_syscall_64+0x69/0xc0
8/10/22 7:56 AM kernel entry_SYSCALL_64_after_hwframe+0x61/0xcb
8/10/22 7:56 AM kernel RIP: 0033:0x7f0adb562a6f
8/10/22 7:56 AM kernel Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 19 c0 f7 ff 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 5c c0 f7 ff 48
8/10/22 7:56 AM kernel RSP: 002b:00007f0a9b7fd810 EFLAGS: 00000293 ORIG_RAX: 0000000000000001
8/10/22 7:56 AM kernel RAX: ffffffffffffffda RBX: 0000000000000002 RCX: 00007f0adb562a6f
8/10/22 7:56 AM kernel RDX: 0000000000000002 RSI: 00007f0adbeeb5e5 RDI: 0000000000000013
8/10/22 7:56 AM kernel RBP: 00007f0adbeeb5e5 R08: 0000000000000000 R09: 0000000000000001
8/10/22 7:56 AM kernel R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000013
8/10/22 7:56 AM kernel R13: 0000000000000013 R14: 0000000000000000 R15: 00007f0a90024b10
8/10/22 7:56 AM kernel </TASK>
8/10/22 7:56 AM kernel ================================================================================

Still present in 5.15.0-47.53-lowlatency

8/20/22 7:42 AM kernel ================================================================================
8/20/22 7:42 AM kernel UBSAN: array-index-out-of-bounds in /build/linux-lowlatency-uED6sK/linux-lowlatency-5.15.0/drivers/net/ethernet/aquantia/atlantic/aq_nic.c:1262:48
8/20/22 7:42 AM kernel index 8 is out of range for type 'aq_vec_s *[8]'
8/20/22 7:42 AM kernel CPU: 12 PID: 2174 Comm: daemon-init Not tainted 5.15.0-47-lowlatency #53-Ubuntu
8/20/22 7:42 AM kernel Hardware name: To Be Filled By O.E.M. X570 Creator/X570 Creator, BIOS P3.72 05/17/2022
8/20/22 7:42 AM kernel Call Trace:
8/20/22 7:42 AM kernel <TASK>
8/20/22 7:42 AM kernel show_stack+0x52/0x5c
8/20/22 7:42 AM kernel dump_stack_lvl+0x4a/0x63
8/20/22 7:42 AM kernel dump_stack+0x10/0x16
8/20/22 7:42 AM kernel ubsan_epilogue+0x9/0x49
8/20/22 7:42 AM kernel __ubsan_handle_out_of_bounds.cold+0x44/0x49
8/20/22 7:42 AM kernel ? is_skb_forwardable+0x48/0x50
8/20/22 7:42 AM kernel ? aq_vec_stop+0x72/0x80 [atlantic]
8/20/22 7:42 AM kernel aq_nic_stop+0x1b6/0x1c0 [atlantic]
8/20/22 7:42 AM kernel aq_ndev_set_features+0x143/0x1a0 [atlantic]
8/20/22 7:42 AM kernel __netdev_update_features+0x184/0x820
8/20/22 7:42 AM kernel dev_disable_lro+0x34/0x150
8/20/22 7:42 AM kernel devinet_sysctl_forward+0x1fb/0x230
8/20/22 7:42 AM kernel proc_sys_call_handler+0x161/0x2d0
8/20/22 7:42 AM kernel proc_sys_write+0x13/0x20
8/20/22 7:42 AM kernel new_sync_write+0x117/0x1b0
8/20/22 7:42 AM kernel ? intel_pmu_cpu_starting+0x240/0x3c0
8/20/22 7:42 AM kernel vfs_write+0x1fb/0x290
8/20/22 7:42 AM kernel ksys_write+0x67/0xf0
8/20/22 7:42 AM kernel __x64_sys_write+0x19/0x20
8/20/22 7:42 AM kernel do_syscall_64+0x5c/0xc0
8/20/22 7:42 AM kernel ? syscall_exit_to_user_mode+0x27/0x50
8/20/22 7:42 AM kernel ? do_syscall_64+0x69/0xc0
8/20/22 7:42 AM kernel ? exit_to_user_mode_prepare+0x37/0xb0
8/20/22 7:42 AM kernel entry_SYSCALL_64_after_hwframe+0x61/0xcb
8/20/22 7:42 AM kernel RIP: 0033:0x7f8073495a6f
8/20/22 7:42 AM kernel Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 19 c0 f7 ff 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 5c c0 f7 ff 48
8/20/22 7:42 AM kernel RSP: 002b:00007f803b7fd810 EFLAGS: 00000293 ORIG_RAX: 0000000000000001
8/20/22 7:42 AM kernel RAX: ffffffffffffffda RBX: 0000000000000002 RCX: 00007f8073495a6f
8/20/22 7:42 AM kernel RDX: 0000000000000002 RSI: 00007f8073e1e5e5 RDI: 0000000000000013
8/20/22 7:42 AM kernel RBP: 00007f8073e1e5e5 R08: 0000000000000000 R09: 0000000000000001
8/20/22 7:42 AM kernel R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000013
8/20/22 7:42 AM kernel R13: 0000000000000013 R14: 0000000000000000 R15: 00007f8028024ab0
8/20/22 7:42 AM kernel </TASK>
8/20/22 7:42 AM kernel ================================================================================

Still present on 5.15.0-46-generic (Ubuntu 20.04.3)

[ 30.346347] UBSAN: array-index-out-of-bounds in /build/linux-hwe-5.15-69LdM0/linux-hwe-5.15-5.15.0/drivers/net/ethernet/aquantia/atlantic/aq_nic.c:1262:48
[ 30.346349] index 8 is out of range for type 'aq_vec_s *[8]'

Still present in 5.15.0-48-generic

8/31/22 8:01 AM kernel ================================================================================
8/31/22 8:01 AM kernel UBSAN: array-index-out-of-bounds in /build/linux-kQ6jNR/linux-5.15.0/drivers/net/ethernet/aquantia/atlantic/aq_nic.c:1262:48
8/31/22 8:01 AM kernel index 8 is out of range for type 'aq_vec_s *[8]'
8/31/22 8:01 AM kernel CPU: 22 PID: 1987 Comm: daemon-init Tainted: G O 5.15.0-48-generic #54-Ubuntu
8/31/22 8:01 AM kernel Hardware name: To Be Filled By O.E.M. X570 Creator/X570 Creator, BIOS P3.72 05/17/2022
8/31/22 8:01 AM kernel Call Trace:
8/31/22 8:01 AM kernel <TASK>
8/31/22 8:01 AM kernel show_stack+0x52/0x5c
8/31/22 8:01 AM kernel dump_stack_lvl+0x4a/0x63
8/31/22 8:01 AM kernel dump_stack+0x10/0x16
8/31/22 8:01 AM kernel ubsan_epilogue+0x9/0x49
8/31/22 8:01 AM kernel __ubsan_handle_out_of_bounds.cold+0x44/0x49
8/31/22 8:01 AM kernel ? netdev_has_any_upper_dev+0x48/0x70
8/31/22 8:01 AM kernel ? aq_vec_stop+0x72/0x80 [atlantic]
8/31/22 8:01 AM kernel aq_nic_stop+0x10a/0x110 [atlantic]
8/31/22 8:01 AM kernel aq_ndev_set_features+0x143/0x1a0 [atlantic]
8/31/22 8:01 AM kernel __netdev_update_features+0x184/0x820
8/31/22 8:01 AM kernel dev_disable_lro+0x34/0x150
8/31/22 8:01 AM kernel devinet_sysctl_forward+0x1fb/0x230
8/31/22 8:01 AM kernel proc_sys_call_handler+0x16a/0x2f0
8/31/22 8:01 AM kernel proc_sys_write+0x13/0x20
8/31/22 8:01 AM kernel new_sync_write+0x117/0x1b0
8/31/22 8:01 AM kernel vfs_write+0x1d5/0x270
8/31/22 8:01 AM kernel ksys_write+0x67/0xf0
8/31/22 8:01 AM kernel __x64_sys_write+0x19/0x20
8/31/22 8:01 AM kernel do_syscall_64+0x5c/0xc0
8/31/22 8:01 AM kernel ? exit_to_user_mode_prepare+0x37/0xb0
8/31/22 8:01 AM kernel ? syscall_exit_to_user_mode+0x27/0x50
8/31/22 8:01 AM kernel ? do_syscall_64+0x69/0xc0
8/31/22 8:01 AM kernel entry_SYSCALL_64_after_hwframe+0x61/0xcb
8/31/22 8:01 AM kernel RIP: 0033:0x7fdfff746a6f
8/31/22 8:01 AM kernel Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 19 c0 f7 ff 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 5c c0 f7 ff 48
8/31/22 8:01 AM kernel RSP: 002b:00007fdfc37fd810 EFLAGS: 00000293 ORIG_RAX: 0000000000000001
8/31/22 8:01 AM kernel RAX: ffffffffffffffda RBX: 0000000000000002 RCX: 00007fdfff746a6f
8/31/22 8:01 AM kernel RDX: 0000000000000002 RSI: 00007fe0000cf5e5 RDI: 0000000000000013
8/31/22 8:01 AM kernel RBP: 00007fe0000cf5e5 R08: 0000000000000000 R09: 0000000000000001
8/31/22 8:01 AM kernel R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000013
8/31/22 8:01 AM kernel R13: 0000000000000013 R14: 0000000000000000 R15: 00007fdfb4024b50
8/31/22 8:01 AM kernel </TASK>

Still present in 5.15.0-48-lowlatency as well. Interestingly, the logs say the kernel is tainted in generic, but not in lowlatency, despite no other configuration changes when this is handled.

9/1/22 8:01 AM kernel ================================================================================
9/1/22 8:01 AM kernel UBSAN: array-index-out-of-bounds in /build/linux-lowlatency-FlX6Pk/linux-lowlatency-5.15.0/drivers/net/ethernet/aquantia/atlantic/aq_nic.c:1262:48
9/1/22 8:01 AM kernel index 8 is out of range for type 'aq_vec_s *[8]'
9/1/22 8:01 AM kernel CPU: 0 PID: 2103 Comm: daemon-init Not tainted 5.15.0-48-lowlatency #54-Ubuntu
9/1/22 8:01 AM kernel Hardware name: To Be Filled By O.E.M. X570 Creator/X570 Creator, BIOS P3.72 05/17/2022
9/1/22 8:01 AM kernel Call Trace:
9/1/22 8:01 AM kernel <TASK>
9/1/22 8:01 AM kernel show_stack+0x52/0x5c
9/1/22 8:01 AM kernel dump_stack_lvl+0x4a/0x63
9/1/22 8:01 AM kernel dump_stack+0x10/0x16
9/1/22 8:01 AM kernel ubsan_epilogue+0x9/0x49
9/1/22 8:01 AM kernel __ubsan_handle_out_of_bounds.cold+0x44/0x49
9/1/22 8:01 AM kernel ? call_netdevice_notifiers+0x38/0x50
9/1/22 8:01 AM kernel ? aq_vec_stop+0x72/0x80 [atlantic]
9/1/22 8:01 AM kernel aq_nic_stop+0x1b6/0x1c0 [atlantic]
9/1/22 8:01 AM kernel aq_ndev_set_features+0x143/0x1a0 [atlantic]
9/1/22 8:01 AM kernel __netdev_update_features+0x184/0x820
9/1/22 8:01 AM kernel dev_disable_lro+0x34/0x150
9/1/22 8:01 AM kernel devinet_sysctl_forward+0x1fb/0x230
9/1/22 8:01 AM kernel proc_sys_call_handler+0x161/0x2d0
9/1/22 8:01 AM kernel proc_sys_write+0x13/0x20
9/1/22 8:01 AM kernel new_sync_write+0x117/0x1b0
9/1/22 8:01 AM kernel ? io_req_prep_async+0x2a0/0x2a0
9/1/22 8:01 AM kernel vfs_write+0x1fb/0x290
9/1/22 8:01 AM kernel ksys_write+0x67/0xf0
9/1/22 8:01 AM kernel __x64_sys_write+0x19/0x20
9/1/22 8:01 AM kernel do_syscall_64+0x5c/0xc0
9/1/22 8:01 AM kernel ? do_syscall_64+0x69/0xc0
9/1/22 8:01 AM kernel ? syscall_exit_to_user_mode+0x27/0x50
9/1/22 8:01 AM kernel ? irqentry_exit+0x3b/0x50
9/1/22 8:01 AM kernel ? exc_page_fault+0x89/0x190
9/1/22 8:01 AM kernel entry_SYSCALL_64_after_hwframe+0x61/0xcb
9/1/22 8:01 AM kernel RIP: 0033:0x7f79df4f1a6f
9/1/22 8:01 AM kernel Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 19 c0 f7 ff 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 5c c0 f7 ff 48
9/1/22 8:01 AM kernel RSP: 002b:00007f799f7fd810 EFLAGS: 00000293 ORIG_RAX: 0000000000000001
9/1/22 8:01 AM kernel RAX: ffffffffffffffda RBX: 0000000000000002 RCX: 00007f79df4f1a6f
9/1/22 8:01 AM kernel RDX: 0000000000000002 RSI: 00007f79dfe7a5e5 RDI: 0000000000000013
9/1/22 8:01 AM kernel RBP: 00007f79dfe7a5e5 R08: 0000000000000000 R09: 0000000000000001
9/1/22 8:01 AM kernel R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000013
9/1/22 8:01 AM kernel R13: 0000000000000013 R14: 0000000000000000 R15: 00007f7994024a70
9/1/22 8:01 AM kernel </TASK>
9/1/22 8:01 AM kernel ================================================================================

Still present in 5.15.0-50-generic

9/21/22 7:54 AM kernel ================================================================================
9/21/22 7:54 AM kernel UBSAN: array-index-out-of-bounds in /build/linux-lU2d47/linux-5.15.0/drivers/net/ethernet/aquantia/atlantic/aq_nic.c:1262:48
9/21/22 7:54 AM kernel index 8 is out of range for type 'aq_vec_s *[8]'
9/21/22 7:54 AM kernel CPU: 4 PID: 1930 Comm: daemon-init Tainted: G O 5.15.0-50-generic #56-Ubuntu
9/21/22 7:54 AM kernel Hardware name: To Be Filled By O.E.M. X570 Creator/X570 Creator, BIOS P3.72 05/17/2022
9/21/22 7:54 AM kernel Call Trace:
9/21/22 7:54 AM kernel <TASK>
9/21/22 7:54 AM kernel show_stack+0x52/0x5c
9/21/22 7:54 AM kernel dump_stack_lvl+0x4a/0x63
9/21/22 7:54 AM kernel dump_stack+0x10/0x16
9/21/22 7:54 AM kernel ubsan_epilogue+0x9/0x49
9/21/22 7:54 AM kernel __ubsan_handle_out_of_bounds.cold+0x44/0x49
9/21/22 7:54 AM kernel ? dev_get_port_parent_id+0x18/0x160
9/21/22 7:54 AM kernel ? aq_vec_stop+0x72/0x80 [atlantic]
9/21/22 7:54 AM kernel aq_nic_stop+0x10a/0x110 [atlantic]
9/21/22 7:54 AM kernel aq_ndev_set_features+0x143/0x1a0 [atlantic]
9/21/22 7:54 AM kernel __netdev_update_features+0x184/0x820
9/21/22 7:54 AM kernel dev_disable_lro+0x34/0x150
9/21/22 7:54 AM kernel devinet_sysctl_forward+0x1fb/0x230
9/21/22 7:54 AM kernel proc_sys_call_handler+0x16a/0x2f0
9/21/22 7:54 AM kernel proc_sys_write+0x13/0x20
9/21/22 7:54 AM kernel new_sync_write+0x114/0x1a0
9/21/22 7:54 AM kernel vfs_write+0x1d5/0x270
9/21/22 7:54 AM kernel ksys_write+0x67/0xf0
9/21/22 7:54 AM kernel __x64_sys_write+0x19/0x20
9/21/22 7:54 AM kernel do_syscall_64+0x5c/0xc0
9/21/22 7:54 AM kernel ? exit_to_user_mode_prepare+0x37/0xb0
9/21/22 7:54 AM kernel ? syscall_exit_to_user_mode+0x27/0x50
9/21/22 7:54 AM kernel ? do_syscall_64+0x69/0xc0
9/21/22 7:54 AM kernel ? exit_to_user_mode_loop+0x10d/0x160
9/21/22 7:54 AM kernel entry_SYSCALL_64_after_hwframe+0x61/0xcb
9/21/22 7:54 AM kernel RIP: 0033:0x7fed8a694a6f
9/21/22 7:54 AM kernel Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 19 c0 f7 ff 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 5c c0 f7 ff 48
9/21/22 7:54 AM kernel RSP: 002b:00007fed4e7fb810 EFLAGS: 00000293 ORIG_RAX: 0000000000000001
9/21/22 7:54 AM kernel RAX: ffffffffffffffda RBX: 0000000000000002 RCX: 00007fed8a694a6f
9/21/22 7:54 AM kernel RDX: 0000000000000002 RSI: 00007fed8b01c5e5 RDI: 0000000000000013
9/21/22 7:54 AM kernel RBP: 00007fed8b01c5e5 R08: 0000000000000000 R09: 0000000000000001
9/21/22 7:54 AM kernel R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000013
9/21/22 7:54 AM kernel R13: 0000000000000013 R14: 0000000000000000 R15: 00007fed38024ab0
9/21/22 7:54 AM kernel </TASK>
9/21/22 7:54 AM kernel ================================================================================

Present in 5.15.0-50-lowlatency . Continues the trend where tainted in the Generic version of the kernel, but not the lowlatency version.

9/22/22 1:41 PM kernel ================================================================================
9/22/22 1:41 PM kernel UBSAN: array-index-out-of-bounds in /build/linux-lowlatency-jwscnu/linux-lowlatency-5.15.0/drivers/net/ethernet/aquantia/atlantic/aq_nic.c:1262:48
9/22/22 1:41 PM kernel index 8 is out of range for type 'aq_vec_s *[8]'
9/22/22 1:41 PM kernel CPU: 22 PID: 2103 Comm: daemon-init Not tainted 5.15.0-50-lowlatency #56-Ubuntu
9/22/22 1:41 PM kernel Hardware name: To Be Filled By O.E.M. X570 Creator/X570 Creator, BIOS P3.72 05/17/2022
9/22/22 1:41 PM kernel Call Trace:
9/22/22 1:41 PM kernel <TASK>
9/22/22 1:41 PM kernel show_stack+0x52/0x5c
9/22/22 1:41 PM kernel dump_stack_lvl+0x4a/0x63
9/22/22 1:41 PM kernel dump_stack+0x10/0x16
9/22/22 1:41 PM kernel ubsan_epilogue+0x9/0x49
9/22/22 1:41 PM kernel __ubsan_handle_out_of_bounds.cold+0x44/0x49
9/22/22 1:41 PM kernel ? dev_fetch_sw_netstats+0x48/0x90
9/22/22 1:41 PM kernel ? aq_vec_stop+0x72/0x80 [atlantic]
9/22/22 1:41 PM kernel aq_nic_stop+0x1b6/0x1c0 [atlantic]
9/22/22 1:41 PM kernel aq_ndev_set_features+0x143/0x1a0 [atlantic]
9/22/22 1:41 PM kernel __netdev_update_features+0x184/0x820
9/22/22 1:41 PM kernel dev_disable_lro+0x34/0x150
9/22/22 1:41 PM kernel devinet_sysctl_forward+0x1fb/0x230
9/22/22 1:41 PM kernel proc_sys_call_handler+0x161/0x2d0
9/22/22 1:41 PM kernel proc_sys_write+0x13/0x20
9/22/22 1:41 PM kernel new_sync_write+0x114/0x1a0
9/22/22 1:41 PM kernel vfs_write+0x1fb/0x290
9/22/22 1:41 PM kernel ksys_write+0x67/0xf0
9/22/22 1:41 PM kernel __x64_sys_write+0x19/0x20
9/22/22 1:41 PM kernel do_syscall_64+0x5c/0xc0
9/22/22 1:41 PM kernel entry_SYSCALL_64_after_hwframe+0x61/0xcb
9/22/22 1:41 PM kernel RIP: 0033:0x7f492a2f6a6f
9/22/22 1:41 PM kernel Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 19 c0 f7 ff 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 5c c0 f7 ff 48
9/22/22 1:41 PM kernel RSP: 002b:00007f48fe7fb810 EFLAGS: 00000293 ORIG_RAX: 0000000000000001
9/22/22 1:41 PM kernel RAX: ffffffffffffffda RBX: 0000000000000002 RCX: 00007f492a2f6a6f
9/22/22 1:41 PM kernel RDX: 0000000000000002 RSI: 00007f492ac7e5e5 RDI: 0000000000000013
9/22/22 1:41 PM kernel RBP: 00007f492ac7e5e5 R08: 0000000000000000 R09: 0000000000000001
9/22/22 1:41 PM kernel R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000013
9/22/22 1:41 PM kernel R13: 0000000000000013 R14: 0000000000000000 R15: 00007f48dc030970
9/22/22 1:41 PM kernel </TASK>
9/22/22 1:41 PM kernel ================================================================================

Still present in 5.15.0-52-lowlatency

10/19/22 7:59 AM kernel ================================================================================
10/19/22 7:59 AM kernel UBSAN: array-index-out-of-bounds in /build/linux-lowlatency-rWNFY0/linux-lowlatency-5.15.0/drivers/net/ethernet/aquantia/atlantic/aq_nic.c:1262:48
10/19/22 7:59 AM kernel index 8 is out of range for type 'aq_vec_s *[8]'
10/19/22 7:59 AM kernel CPU: 7 PID: 2084 Comm: daemon-init Not tainted 5.15.0-52-lowlatency #58-Ubuntu
10/19/22 7:59 AM kernel Hardware name: To Be Filled By O.E.M. X570 Creator/X570 Creator, BIOS P3.72 05/17/2022
10/19/22 7:59 AM kernel Call Trace:
10/19/22 7:59 AM kernel <TASK>
10/19/22 7:59 AM kernel show_stack+0x52/0x5c
10/19/22 7:59 AM kernel dump_stack_lvl+0x4a/0x63
10/19/22 7:59 AM kernel dump_stack+0x10/0x16
10/19/22 7:59 AM kernel ubsan_epilogue+0x9/0x49
10/19/22 7:59 AM kernel __ubsan_handle_out_of_bounds.cold+0x44/0x49
10/19/22 7:59 AM kernel ? dev_fetch_sw_netstats+0x48/0x90
10/19/22 7:59 AM kernel ? aq_vec_stop+0x72/0x80 [atlantic]
10/19/22 7:59 AM kernel aq_nic_stop+0x1b6/0x1c0 [atlantic]
10/19/22 7:59 AM kernel aq_ndev_set_features+0x143/0x1a0 [atlantic]
10/19/22 7:59 AM kernel __netdev_update_features+0x184/0x820
10/19/22 7:59 AM kernel dev_disable_lro+0x34/0x150
10/19/22 7:59 AM kernel devinet_sysctl_forward+0x1fb/0x230
10/19/22 7:59 AM kernel proc_sys_call_handler+0x161/0x2d0
10/19/22 7:59 AM kernel proc_sys_write+0x13/0x20
10/19/22 7:59 AM kernel new_sync_write+0x114/0x1a0
10/19/22 7:59 AM kernel ? icl_set_topdown_event_period+0x70/0xe0
10/19/22 7:59 AM kernel vfs_write+0x1fb/0x290
10/19/22 7:59 AM kernel ksys_write+0x67/0xf0
10/19/22 7:59 AM kernel __x64_sys_write+0x19/0x20
10/19/22 7:59 AM kernel do_syscall_64+0x5c/0xc0
10/19/22 7:59 AM kernel ? syscall_exit_to_user_mode+0x27/0x50
10/19/22 7:59 AM kernel ? do_syscall_64+0x69/0xc0
10/19/22 7:59 AM kernel ? irqentry_exit_to_user_mode+0x9/0x20
10/19/22 7:59 AM kernel ? irqentry_exit+0x3b/0x50
10/19/22 7:59 AM kernel ? exc_page_fault+0x89/0x190
10/19/22 7:59 AM kernel entry_SYSCALL_64_after_hwframe+0x61/0xcb
10/19/22 7:59 AM kernel RIP: 0033:0x7f61c36a1a6f
10/19/22 7:59 AM kernel Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 19 c0 f7 ff 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 5c c0 f7 ff 48
10/19/22 7:59 AM kernel RSP: 002b:00007f61837fd810 EFLAGS: 00000293 ORIG_RAX: 0000000000000001
10/19/22 7:59 AM kernel RAX: ffffffffffffffda RBX: 0000000000000002 RCX: 00007f61c36a1a6f
10/19/22 7:59 AM kernel RDX: 0000000000000002 RSI: 00007f61c40265e5 RDI: 0000000000000013
10/19/22 7:59 AM kernel RBP: 00007f61c40265e5 R08: 0000000000000000 R09: 0000000000000001
10/19/22 7:59 AM kernel R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000013
10/19/22 7:59 AM kernel R13: 0000000000000013 R14: 0000000000000000 R15: 00007f6178031e10
10/19/22 7:59 AM kernel </TASK>
10/19/22 7:59 AM kernel ================================================================================

Appears to be fixed in 5.15.0-53-lowlatency; no longer appearing in my error logs.

included upstream in 5.18 and up

5.15.0-91-generic

Nov 16 21:15:29 mon-host kernel: [ 101.739280] ================================================================================
Nov 16 21:15:29 mon-host kernel: [ 101.785597] UBSAN: array-index-out-of-bounds in /build/linux-90ta4T/linux-5.15.0/drivers/edac/i5000_edac.c:956:20
Nov 16 21:15:29 mon-host kernel: [ 101.786940] IPMI message handler: version 39.2
Nov 16 21:15:29 mon-host kernel: [ 101.836146] index 4 is out of range for type 'u16 [4]'
Nov 16 21:15:29 mon-host kernel: [ 101.836152] CPU: 0 PID: 447 Comm: systemd-udevd Not tainted 5.15.0-91-generic #101-Ubuntu
Nov 16 21:15:29 mon-host kernel: [ 101.836156] Hardware name: Dell Inc. PowerEdge 1950/0D8635, BIOS 2.7.0 10/30/2010
Nov 16 21:15:29 mon-host kernel: [ 101.836158] Call Trace:
Nov 16 21:15:29 mon-host kernel: [ 101.836162] <TASK>
Nov 16 21:15:29 mon-host kernel: [ 101.836166] show_stack+0x52/0x5c
Nov 16 21:15:29 mon-host kernel: [ 101.836175] dump_stack_lvl+0x4a/0x63
Nov 16 21:15:29 mon-host kernel: [ 101.836182] dump_stack+0x10/0x16
Nov 16 21:15:29 mon-host kernel: [ 101.836184] ubsan_epilogue+0x9/0x36
Nov 16 21:15:29 mon-host kernel: [ 101.836187] __ubsan_handle_out_of_bounds.cold+0x44/0x49
Nov 16 21:15:29 mon-host kernel: [ 101.836190] ? i5000_get_mc_regs.isra.0+0x14c/0x1c0 [i5000_edac]
Nov 16 21:15:29 mon-host kernel: [ 101.836197] i5000_probe1+0x506/0x5c0 [i5000_edac]
Nov 16 21:15:29 mon-host kernel: [ 101.836201] ? pci_bus_read_config_byte+0x40/0x70
Nov 16 21:15:29 mon-host kernel: [ 101.862944] ? do_pci_enable_device+0x54/0x110
Nov 16 21:15:29 mon-host kernel: [ 101.862948] i5000_init_one+0x26/0x30 [i5000_edac]
Nov 16 21:15:29 mon-host kernel: [ 101.862952] local_pci_probe+0x4b/0x90
Nov 16 21:15:29 mon-host kernel: [ 101.862956] pci_device_probe+0x119/0x1f0
Nov 16 21:15:29 mon-host kernel: [ 101.862960] really_probe+0x222/0x420
Nov 16 21:15:29 mon-host kernel: [ 101.862964] __driver_probe_device+0xe8/0x140
Nov 16 21:15:29 mon-host kernel: [ 101.862966] driver_probe_device+0x23/0xc0
Nov 16 21:15:29 mon-host kernel: [ 101.862969] __driver_attach+0xf7/0x1f0
Nov 16 21:15:29 mon-host kernel: [ 101.862971] ? __device_attach_driver+0x140/0x140
Nov 16 21:15:29 mon-host kernel: [ 101.862974] bus_for_each_dev+0x7f/0xd0
Nov 16 21:15:29 mon-host kernel: [ 101.862978] driver_attach+0x1e/0x30
Nov 16 21:15:29 mon-host kernel: [ 101.862980] bus_add_driver+0x148/0x220
Nov 16 21:15:29 mon-host kernel: [ 101.862982] ? vunmap_range_noflush+0x3d5/0x470
Nov 16 21:15:29 mon-host kernel: [ 101.862987] driver_register+0x95/0x100
Nov 16 21:15:29 mon-host kernel: [ 101.862990] ? 0xffffffffc03d8000
Nov 16 21:15:29 mon-host kernel: [ 101.862993] __pci_register_driver+0x68/0x70
Nov 16 21:15:29 mon-host kernel: [ 101.862996] i5000_init+0x36/0x1000 [i5000_edac]
Nov 16 21:15:29 mon-host kernel: [ 101.863000] do_one_initcall+0x49/0x1e0
Nov 16 21:15:29 mon-host kernel: [ 101.863005] ? kmem_cache_alloc_trace+0x19e/0x2e0
Nov 16 21:15:29 mon-host kernel: [ 101.863011] do_init_module+0x52/0x260
Nov 16 21:15:29 mon-host kernel: [ 101.863016] load_module+0xb2b/0xbc0
Nov 16 21:15:29 mon-host kernel: [ 101.863019] __do_sys_finit...