====================================== | [ 20.557770] ata10: SATA link down (SStatus 0 SControl 300) | [ 20.705421] ------------[ cut here ]------------ | [ 20.711419] UBSAN: array-index-out-of-bounds in drivers/net/ethernet/broadcom/bnxt/bnxt.c:2588:26 | [ 20.722187] index 12 is out of range for type 'bnxt_bs_trace_info [11]' | [ 20.730412] CPU: 0 UID: 0 PID: 9 Comm: kworker/0:0 Not tainted 7.0.0-rc3-mkqq-g76f4f4965ab1 #1 PREEMPT(full) [ 20.730416] Hardware name: Giga Computing E163-Z34-AAH1-000/MZ33-DC1-000, BIOS R30_F44 12/24/2025 [ 20.730418] Workqueue: sync_wq local_pci_probe_callback [ 20.730427] Call Trace: [ 20.730429] [ 20.730432] dump_stack_lvl+0x6f/0xa0 [ 20.730439] ubsan_epilogue+0x5/0x2b [ 20.730443] __ubsan_handle_out_of_bounds.cold+0x54/0x59 [ 20.730447] bnxt_backing_store_cfg_v2+0x8d5/0xa00 [ 20.730454] bnxt_alloc_ctx_mem+0x610/0x970 [ 20.730459] bnxt_hwrm_func_qcaps.part.0+0x62f/0xb20 [ 20.730463] ? __bnxt_hwrm_func_qcaps+0xe15/0x1c30 [ 20.730468] ? bnxt_hwrm_func_resc_qcaps+0x1040/0x1040 [ 20.730474] bnxt_fw_init_one_p2+0x89/0xda0 [ 20.730477] ? bnxt_hwrm_func_qcaps.part.0+0xb20/0xb20 [ 20.730479] ? trace_kmalloc+0x107/0x130 [ 20.730483] ? __kasan_kmalloc+0x7b/0x90 [ 20.730486] ? __kmalloc_noprof+0x30c/0x7e0 [ 20.730491] bnxt_init_one+0x55b/0x29b0 [ 20.730496] ? bnxt_set_dflt_rings.constprop.0+0xdd0/0xdd0 [ 20.730501] ? lockdep_hardirqs_on_prepare.part.0+0x9a/0x160 [ 20.730504] ? lockdep_hardirqs_on+0x84/0x130 [ 20.730508] ? _raw_spin_unlock_irqrestore+0x53/0x80 [ 20.730512] ? _raw_spin_unlock_irqrestore+0x40/0x80 [ 20.730514] ? bnxt_set_dflt_rings.constprop.0+0xdd0/0xdd0 [ 20.730517] local_pci_probe+0xcc/0x170 [ 20.730520] local_pci_probe_callback+0x35/0x80 [ 20.730522] ? process_one_work+0xd30/0x1390 [ 20.730525] process_one_work+0xd57/0x1390 [ 20.730531] ? pwq_dec_nr_in_flight+0x700/0x700 [ 20.730533] ? lock_acquire.part.0+0xbc/0x260 [ 20.730541] worker_thread+0x4d6/0xd40 [ 20.730547] ? rescuer_thread+0x1330/0x1330 [ 20.730549] kthread+0x30f/0x3f0 [ 20.730552] ? trace_irq_enable.constprop.0+0x13c/0x190 [ 20.730555] ? kthread_affine_node+0x150/0x150 [ 20.730558] ret_from_fork+0x4a2/0x720 [ 20.730561] ? arch_exit_to_user_mode_prepare.isra.0+0xb0/0xb0 [ 20.730565] ? __switch_to+0x538/0xcf0 [ 20.730570] ? kthread_affine_node+0x150/0x150 [ 20.730573] ret_from_fork_asm+0x11/0x20 | [ 20.990104] ================================================================== | [ 20.991089] BUG: KASAN: slab-out-of-bounds in bnxt_backing_store_cfg_v2+0x88b/0xa00 | [ 20.991089] Write of size 2 at addr ff1100012178eb86 by task kworker/0:0/9 | [ 20.991089] | [ 20.991089] CPU: 0 UID: 0 PID: 9 Comm: kworker/0:0 Not tainted 7.0.0-rc3-mkqq-g76f4f4965ab1 #1 PREEMPT(full) [ 20.991089] Hardware name: Giga Computing E163-Z34-AAH1-000/MZ33-DC1-000, BIOS R30_F44 12/24/2025 [ 20.991089] Workqueue: sync_wq local_pci_probe_callback [ 20.991089] Call Trace: [ 20.991089] [ 20.991089] dump_stack_lvl+0x6f/0xa0 [ 20.991089] print_address_description.constprop.0+0x6e/0x300 [ 20.991089] print_report+0xfc/0x1fb [ 20.991089] ? bnxt_backing_store_cfg_v2+0x88b/0xa00 [ 20.991089] ? __virt_addr_valid+0x1da/0x430 [ 20.991089] ? bnxt_backing_store_cfg_v2+0x88b/0xa00 [ 20.991089] kasan_report+0xe8/0x120 [ 20.991089] ? bnxt_backing_store_cfg_v2+0x88b/0xa00 [ 20.991089] bnxt_backing_store_cfg_v2+0x88b/0xa00 [ 20.991089] bnxt_alloc_ctx_mem+0x610/0x970 [ 20.991089] bnxt_hwrm_func_qcaps.part.0+0x62f/0xb20 [ 20.991089] ? __bnxt_hwrm_func_qcaps+0xe15/0x1c30 [ 20.991089] ? bnxt_hwrm_func_resc_qcaps+0x1040/0x1040 [ 20.991089] bnxt_fw_init_one_p2+0x89/0xda0 [ 20.991089] ? bnxt_hwrm_func_qcaps.part.0+0xb20/0xb20 [ 20.991089] ? trace_kmalloc+0x107/0x130 [ 20.991089] ? __kasan_kmalloc+0x7b/0x90 [ 20.991089] ? __kmalloc_noprof+0x30c/0x7e0 [ 20.991089] bnxt_init_one+0x55b/0x29b0 [ 20.991089] ? bnxt_set_dflt_rings.constprop.0+0xdd0/0xdd0 [ 20.991089] ? lockdep_hardirqs_on_prepare.part.0+0x9a/0x160 [ 20.991089] ? lockdep_hardirqs_on+0x84/0x130 [ 20.991089] ? _raw_spin_unlock_irqrestore+0x53/0x80 [ 20.991089] ? _raw_spin_unlock_irqrestore+0x40/0x80 [ 20.991089] ? bnxt_set_dflt_rings.constprop.0+0xdd0/0xdd0 [ 20.991089] local_pci_probe+0xcc/0x170 [ 20.991089] local_pci_probe_callback+0x35/0x80 [ 20.991089] ? process_one_work+0xd30/0x1390 [ 20.991089] process_one_work+0xd57/0x1390 [ 20.991089] ? pwq_dec_nr_in_flight+0x700/0x700 [ 20.991089] ? lock_acquire.part.0+0xbc/0x260 [ 20.991089] worker_thread+0x4d6/0xd40 [ 20.991089] ? rescuer_thread+0x1330/0x1330 [ 20.991089] kthread+0x30f/0x3f0 [ 20.991089] ? trace_irq_enable.constprop.0+0x13c/0x190 [ 20.991089] ? kthread_affine_node+0x150/0x150 [ 20.991089] ret_from_fork+0x4a2/0x720 [ 20.991089] ? arch_exit_to_user_mode_prepare.isra.0+0xb0/0xb0 [ 20.991089] ? __switch_to+0x538/0xcf0 [ 20.991089] ? kthread_affine_node+0x150/0x150 [ 20.991089] ret_from_fork_asm+0x11/0x20 | [ 21.482327] ------------[ cut here ]------------ | [ 21.488369] UBSAN: array-index-out-of-bounds in drivers/net/ethernet/broadcom/bnxt/bnxt.c:9202:27 | [ 21.499122] index 12 is out of range for type 'bnxt_bs_trace_info [11]' | [ 21.507340] CPU: 0 UID: 0 PID: 9 Comm: kworker/0:0 Tainted: G B 7.0.0-rc3-mkqq-g76f4f4965ab1 #1 PREEMPT(full) | [ 21.507343] Tainted: [B]=BAD_PAGE [ 21.507343] Hardware name: Giga Computing E163-Z34-AAH1-000/MZ33-DC1-000, BIOS R30_F44 12/24/2025 [ 21.507344] Workqueue: sync_wq local_pci_probe_callback [ 21.507348] Call Trace: [ 21.507348] [ 21.507350] dump_stack_lvl+0x6f/0xa0 [ 21.507352] ubsan_epilogue+0x5/0x2b [ 21.507354] __ubsan_handle_out_of_bounds.cold+0x54/0x59 [ 21.507356] bnxt_hwrm_func_backing_store_cfg_v2+0xad0/0xb80 [ 21.507358] ? bnxt_request_irq+0x8c0/0x8c0 [ 21.507361] bnxt_backing_store_cfg_v2+0x4d7/0xa00 [ 21.507363] bnxt_alloc_ctx_mem+0x610/0x970 [ 21.507366] bnxt_hwrm_func_qcaps.part.0+0x62f/0xb20 [ 21.507368] ? __bnxt_hwrm_func_qcaps+0xe15/0x1c30 [ 21.507370] ? bnxt_hwrm_func_resc_qcaps+0x1040/0x1040 [ 21.507373] bnxt_fw_init_one_p2+0x89/0xda0 [ 21.507375] ? bnxt_hwrm_func_qcaps.part.0+0xb20/0xb20 [ 21.507377] ? trace_kmalloc+0x107/0x130 [ 21.507379] ? __kasan_kmalloc+0x7b/0x90 [ 21.507381] ? __kmalloc_noprof+0x30c/0x7e0 [ 21.507383] bnxt_init_one+0x55b/0x29b0 [ 21.507385] ? bnxt_set_dflt_rings.constprop.0+0xdd0/0xdd0 [ 21.507388] ? lockdep_hardirqs_on_prepare.part.0+0x9a/0x160 [ 21.507390] ? lockdep_hardirqs_on+0x84/0x130 [ 21.507392] ? _raw_spin_unlock_irqrestore+0x53/0x80 [ 21.507393] ? _raw_spin_unlock_irqrestore+0x40/0x80 [ 21.507395] ? bnxt_set_dflt_rings.constprop.0+0xdd0/0xdd0 [ 21.507397] local_pci_probe+0xcc/0x170 [ 21.507399] local_pci_probe_callback+0x35/0x80 [ 21.507400] ? process_one_work+0xd30/0x1390 [ 21.507402] process_one_work+0xd57/0x1390 [ 21.507405] ? pwq_dec_nr_in_flight+0x700/0x700 [ 21.507406] ? lock_acquire.part.0+0xbc/0x260 [ 21.507410] worker_thread+0x4d6/0xd40 [ 21.507413] ? rescuer_thread+0x1330/0x1330 [ 21.507414] kthread+0x30f/0x3f0 [ 21.507416] ? trace_irq_enable.constprop.0+0x13c/0x190 [ 21.507417] ? kthread_affine_node+0x150/0x150 [ 21.507419] ret_from_fork+0x4a2/0x720 [ 21.507420] ? arch_exit_to_user_mode_prepare.isra.0+0xb0/0xb0 [ 21.507422] ? __switch_to+0x538/0xcf0 [ 21.507424] ? kthread_affine_node+0x150/0x150 [ 21.507425] ret_from_fork_asm+0x11/0x20 Finger prints: print_report:kasan_report:bnxt_backing_store_cfg_v2:bnxt_alloc_ctx_mem:bnxt_fw_init_one_p2 ubsan_epilogue:bnxt_hwrm_func_backing_store_cfg_v2:bnxt_backing_store_cfg_v2:bnxt_alloc_ctx_mem:bnxt_fw_init_one_p2 ubsan_epilogue:bnxt_backing_store_cfg_v2:bnxt_alloc_ctx_mem:bnxt_fw_init_one_p2:bnxt_init_one