====================================== | [ 18.470706] ata10: SATA link down (SStatus 0 SControl 300) | [ 18.634555] ------------[ cut here ]------------ | [ 18.640552] UBSAN: array-index-out-of-bounds in drivers/net/ethernet/broadcom/bnxt/bnxt.c:2588:26 | [ 18.651310] index 12 is out of range for type 'bnxt_bs_trace_info [11]' | [ 18.659533] CPU: 0 UID: 0 PID: 247 Comm: kworker/0:2 Not tainted 7.0.0-rc3-ksww-g9e6c4c06d9c2 #1 PREEMPT(full) [ 18.659537] Hardware name: Giga Computing E163-Z34-AAH1-000/MZ33-DC1-000, BIOS R30_F44 12/24/2025 [ 18.659539] Workqueue: sync_wq local_pci_probe_callback [ 18.659548] Call Trace: [ 18.659550] [ 18.659554] dump_stack_lvl+0x6f/0xa0 [ 18.659561] ubsan_epilogue+0x5/0x2b [ 18.659564] __ubsan_handle_out_of_bounds.cold+0x54/0x59 [ 18.659568] bnxt_backing_store_cfg_v2+0x8d5/0xa00 [ 18.659577] bnxt_alloc_ctx_mem+0x610/0x970 [ 18.659583] bnxt_hwrm_func_qcaps.part.0+0x62f/0xb20 [ 18.659587] ? __bnxt_hwrm_func_qcaps+0xe15/0x1c30 [ 18.659591] ? bnxt_hwrm_func_resc_qcaps+0x1040/0x1040 [ 18.659597] bnxt_fw_init_one_p2+0x89/0xda0 [ 18.659601] ? bnxt_hwrm_func_qcaps.part.0+0xb20/0xb20 [ 18.659603] ? trace_kmalloc+0x107/0x130 [ 18.659607] ? __kasan_kmalloc+0x7b/0x90 [ 18.659610] ? __kmalloc_noprof+0x30c/0x7e0 [ 18.659615] bnxt_init_one+0x55b/0x29b0 [ 18.659620] ? bnxt_set_dflt_rings.constprop.0+0xdd0/0xdd0 [ 18.659624] ? lockdep_hardirqs_on_prepare.part.0+0x9a/0x160 [ 18.659628] ? lockdep_hardirqs_on+0x84/0x130 [ 18.659631] ? _raw_spin_unlock_irqrestore+0x53/0x80 [ 18.659635] ? _raw_spin_unlock_irqrestore+0x40/0x80 [ 18.659638] ? bnxt_set_dflt_rings.constprop.0+0xdd0/0xdd0 [ 18.659641] local_pci_probe+0xcc/0x170 [ 18.659644] local_pci_probe_callback+0x35/0x80 [ 18.659646] ? process_one_work+0xd30/0x1390 [ 18.659649] process_one_work+0xd57/0x1390 [ 18.659655] ? pwq_dec_nr_in_flight+0x700/0x700 [ 18.659657] ? lock_acquire.part.0+0xbc/0x260 [ 18.659665] worker_thread+0x4d6/0xd40 [ 18.659669] ? rescuer_thread+0x1330/0x1330 [ 18.659670] ? __kthread_parkme+0xb3/0x200 [ 18.659674] ? rescuer_thread+0x1330/0x1330 [ 18.659676] kthread+0x30f/0x3f0 [ 18.659678] ? trace_irq_enable.constprop.0+0x13c/0x190 [ 18.659681] ? kthread_affine_node+0x150/0x150 [ 18.659684] ret_from_fork+0x4a2/0x720 [ 18.659688] ? arch_exit_to_user_mode_prepare.isra.0+0xb0/0xb0 [ 18.659691] ? __switch_to+0x538/0xcf0 [ 18.659694] ? kthread_affine_node+0x150/0x150 [ 18.659697] ret_from_fork_asm+0x11/0x20 | [ 18.930150] ================================================================== | [ 18.931133] BUG: KASAN: slab-out-of-bounds in bnxt_backing_store_cfg_v2+0x88b/0xa00 | [ 18.931133] Write of size 2 at addr ff11000120336b86 by task kworker/0:2/247 | [ 18.931133] | [ 18.931133] CPU: 0 UID: 0 PID: 247 Comm: kworker/0:2 Not tainted 7.0.0-rc3-ksww-g9e6c4c06d9c2 #1 PREEMPT(full) [ 18.931133] Hardware name: Giga Computing E163-Z34-AAH1-000/MZ33-DC1-000, BIOS R30_F44 12/24/2025 [ 18.931133] Workqueue: sync_wq local_pci_probe_callback [ 18.931133] Call Trace: [ 18.931133] [ 18.931133] dump_stack_lvl+0x6f/0xa0 [ 18.931133] print_address_description.constprop.0+0x6e/0x300 [ 18.931133] print_report+0xfc/0x1fb [ 18.931133] ? bnxt_backing_store_cfg_v2+0x88b/0xa00 [ 18.931133] ? __virt_addr_valid+0x1da/0x430 [ 18.931133] ? bnxt_backing_store_cfg_v2+0x88b/0xa00 [ 18.931133] kasan_report+0xe8/0x120 [ 18.931133] ? bnxt_backing_store_cfg_v2+0x88b/0xa00 [ 18.931133] bnxt_backing_store_cfg_v2+0x88b/0xa00 [ 18.931133] bnxt_alloc_ctx_mem+0x610/0x970 [ 18.931133] bnxt_hwrm_func_qcaps.part.0+0x62f/0xb20 [ 18.931133] ? __bnxt_hwrm_func_qcaps+0xe15/0x1c30 [ 18.931133] ? bnxt_hwrm_func_resc_qcaps+0x1040/0x1040 [ 18.931133] bnxt_fw_init_one_p2+0x89/0xda0 [ 18.931133] ? bnxt_hwrm_func_qcaps.part.0+0xb20/0xb20 [ 18.931133] ? trace_kmalloc+0x107/0x130 [ 18.931133] ? __kasan_kmalloc+0x7b/0x90 [ 18.931133] ? __kmalloc_noprof+0x30c/0x7e0 [ 18.931133] bnxt_init_one+0x55b/0x29b0 [ 18.931133] ? bnxt_set_dflt_rings.constprop.0+0xdd0/0xdd0 [ 18.931133] ? lockdep_hardirqs_on_prepare.part.0+0x9a/0x160 [ 18.931133] ? lockdep_hardirqs_on+0x84/0x130 [ 18.931133] ? _raw_spin_unlock_irqrestore+0x53/0x80 [ 18.931133] ? _raw_spin_unlock_irqrestore+0x40/0x80 [ 18.931133] ? bnxt_set_dflt_rings.constprop.0+0xdd0/0xdd0 [ 18.931133] local_pci_probe+0xcc/0x170 [ 18.931133] local_pci_probe_callback+0x35/0x80 [ 18.931133] ? process_one_work+0xd30/0x1390 [ 18.931133] process_one_work+0xd57/0x1390 [ 18.931133] ? pwq_dec_nr_in_flight+0x700/0x700 [ 18.931133] ? lock_acquire.part.0+0xbc/0x260 [ 18.931133] worker_thread+0x4d6/0xd40 [ 18.931133] ? rescuer_thread+0x1330/0x1330 [ 18.931133] ? __kthread_parkme+0xb3/0x200 [ 18.931133] ? rescuer_thread+0x1330/0x1330 [ 18.931133] kthread+0x30f/0x3f0 [ 18.931133] ? trace_irq_enable.constprop.0+0x13c/0x190 [ 18.931133] ? kthread_affine_node+0x150/0x150 [ 18.931133] ret_from_fork+0x4a2/0x720 [ 18.931133] ? arch_exit_to_user_mode_prepare.isra.0+0xb0/0xb0 [ 18.931133] ? __switch_to+0x538/0xcf0 [ 18.931133] ? kthread_affine_node+0x150/0x150 [ 18.931133] ret_from_fork_asm+0x11/0x20 | [ 19.434087] ------------[ cut here ]------------ | [ 19.440061] UBSAN: array-index-out-of-bounds in drivers/net/ethernet/broadcom/bnxt/bnxt.c:9202:27 | [ 19.450830] index 12 is out of range for type 'bnxt_bs_trace_info [11]' | [ 19.459048] CPU: 0 UID: 0 PID: 247 Comm: kworker/0:2 Tainted: G B 7.0.0-rc3-ksww-g9e6c4c06d9c2 #1 PREEMPT(full) | [ 19.459052] Tainted: [B]=BAD_PAGE [ 19.459053] Hardware name: Giga Computing E163-Z34-AAH1-000/MZ33-DC1-000, BIOS R30_F44 12/24/2025 [ 19.459054] Workqueue: sync_wq local_pci_probe_callback [ 19.459057] Call Trace: [ 19.459058] [ 19.459059] dump_stack_lvl+0x6f/0xa0 [ 19.459061] ubsan_epilogue+0x5/0x2b [ 19.459063] __ubsan_handle_out_of_bounds.cold+0x54/0x59 [ 19.459066] bnxt_hwrm_func_backing_store_cfg_v2+0xad0/0xb80 [ 19.459068] ? bnxt_request_irq+0x8c0/0x8c0 [ 19.459071] bnxt_backing_store_cfg_v2+0x4d7/0xa00 [ 19.459073] bnxt_alloc_ctx_mem+0x610/0x970 [ 19.459076] bnxt_hwrm_func_qcaps.part.0+0x62f/0xb20 [ 19.459078] ? __bnxt_hwrm_func_qcaps+0xe15/0x1c30 [ 19.459080] ? bnxt_hwrm_func_resc_qcaps+0x1040/0x1040 [ 19.459083] bnxt_fw_init_one_p2+0x89/0xda0 [ 19.459085] ? bnxt_hwrm_func_qcaps.part.0+0xb20/0xb20 [ 19.459087] ? trace_kmalloc+0x107/0x130 [ 19.459089] ? __kasan_kmalloc+0x7b/0x90 [ 19.459091] ? __kmalloc_noprof+0x30c/0x7e0 [ 19.459093] bnxt_init_one+0x55b/0x29b0 [ 19.459095] ? bnxt_set_dflt_rings.constprop.0+0xdd0/0xdd0 [ 19.459098] ? lockdep_hardirqs_on_prepare.part.0+0x9a/0x160 [ 19.459100] ? lockdep_hardirqs_on+0x84/0x130 [ 19.459102] ? _raw_spin_unlock_irqrestore+0x53/0x80 [ 19.459104] ? _raw_spin_unlock_irqrestore+0x40/0x80 [ 19.459106] ? bnxt_set_dflt_rings.constprop.0+0xdd0/0xdd0 [ 19.459108] local_pci_probe+0xcc/0x170 [ 19.459110] local_pci_probe_callback+0x35/0x80 [ 19.459111] ? process_one_work+0xd30/0x1390 [ 19.459113] process_one_work+0xd57/0x1390 [ 19.459116] ? pwq_dec_nr_in_flight+0x700/0x700 [ 19.459117] ? lock_acquire.part.0+0xbc/0x260 [ 19.459121] worker_thread+0x4d6/0xd40 [ 19.459123] ? rescuer_thread+0x1330/0x1330 [ 19.459124] ? __kthread_parkme+0xb3/0x200 [ 19.459126] ? rescuer_thread+0x1330/0x1330 [ 19.459128] kthread+0x30f/0x3f0 [ 19.459129] ? trace_irq_enable.constprop.0+0x13c/0x190 [ 19.459131] ? kthread_affine_node+0x150/0x150 [ 19.459132] ret_from_fork+0x4a2/0x720 [ 19.459134] ? arch_exit_to_user_mode_prepare.isra.0+0xb0/0xb0 [ 19.459136] ? __switch_to+0x538/0xcf0 [ 19.459138] ? kthread_affine_node+0x150/0x150 [ 19.459139] ret_from_fork_asm+0x11/0x20 Finger prints: ubsan_epilogue:bnxt_hwrm_func_backing_store_cfg_v2:bnxt_backing_store_cfg_v2:bnxt_alloc_ctx_mem:bnxt_fw_init_one_p2 print_report:kasan_report:bnxt_backing_store_cfg_v2:bnxt_alloc_ctx_mem:bnxt_fw_init_one_p2 ubsan_epilogue:bnxt_backing_store_cfg_v2:bnxt_alloc_ctx_mem:bnxt_fw_init_one_p2:bnxt_init_one