Search Linux Wireless

Fwd: UBSAN: array-index-out-of-bounds in net/wireless/nl80211.c and net/mac80211/scan.c

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Hi,

Jannik Glückert <jannik.glueckert@xxxxxxxxx> reported on Bugzilla array index
out-of-bounds catched by ubsan along with full kernel trace dump (see
https://bugzilla.kernel.org/show_bug.cgi?id=218810):

> I am seeing multiple array-index-out-of-bounds related to `ieee80211_channel[]` iteration.
> 
> This is with a Mediatek MT7921 chipset.
> I have only tested with kernel 6.8.9, but I don't see any channel index related fixes in master.
> 
> This was discovered as part of Gentoo Hardened enabling CONFIG_UBSAN_ARRAY_BOUNDS
> 
> 
> [  106.194465] UBSAN: array-index-out-of-bounds in /var/tmp/portage/sys-kernel/gentoo-kernel-6.8.9/work/linux-6.8/net/wireless/nl80211.c:9203:29
> [  106.195063] index 42 is out of range for type 'struct ieee80211_channel *[]'
> [  106.195599] CPU: 11 PID: 4166 Comm: wpa_supplicant Not tainted 6.8.9-gentoo-dist-hardened #1
> [  106.196038] Hardware name: ASUS System Product Name/TUF GAMING B650M-PLUS WIFI, BIOS 2214 01/02/2024
> [  106.196485] Call Trace:
> [  106.196913]  <TASK>
> [  106.197439]  dump_stack_lvl+0x71/0x90
> [  106.197899]  __ubsan_handle_out_of_bounds+0xed/0x160
> [  106.198420]  nl80211_exit+0x7c3f/0x21f70 [cfg80211]
> [  106.198917]  genl_family_rcv_msg_doit+0xea/0x150
> [  106.198922]  genl_rcv_msg+0x234/0x260
> [  106.198923]  ? nl80211_exit+0x40/0x21f70 [cfg80211]
> [  106.198930]  ? nl80211_exit+0x7290/0x21f70 [cfg80211]
> [  106.200847]  ? nl80211_exit+0x290/0x21f70 [cfg80211]
> [  106.200854]  ? __cfi_genl_rcv_msg+0x10/0x10
> [  106.200856]  netlink_rcv_skb+0xff/0x140
> [  106.200859]  genl_rcv+0x28/0x40
> [  106.200860]  netlink_unicast+0x265/0x390
> [  106.200862]  netlink_sendmsg+0x381/0x440
> [  106.200865]  __sock_sendmsg+0x94/0xb0
> [  106.200868]  ____sys_sendmsg+0x1c3/0x250
> [  106.200871]  ___sys_sendmsg+0x293/0x2d0
> [  106.200873]  ? do_sock_setsockopt+0xf5/0x190
> [  106.200879]  __se_sys_sendmsg+0x102/0x140
> [  106.200882]  do_syscall_64+0x8e/0x170
> [  106.200884]  ? srso_alias_return_thunk+0x5/0xfbef5
> [  106.200886]  ? do_syscall_64+0x9a/0x170
> [  106.200889]  ? srso_alias_return_thunk+0x5/0xfbef5
> [  106.200890]  ? do_user_addr_fault+0x506/0x6b0
> [  106.200892]  ? srso_alias_return_thunk+0x5/0xfbef5
> [  106.200893]  ? srso_alias_return_thunk+0x5/0xfbef5
> [  106.200895]  entry_SYSCALL_64_after_hwframe+0x78/0x80
> [  106.200896] RIP: 0033:0x7fe10ad2fde4
> [  106.200911] Code: 89 02 b8 ff ff ff ff eb af 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 f3 0f 1e fa 80 3d 85 e5 0c 00 00 74 13 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 54 c3 0f 1f 00 53 48 83 ec 20 89 54 24 1c 48
> [  106.200912] RSP: 002b:00007ffe72950598 EFLAGS: 00000202 ORIG_RAX: 000000000000002e
> [  106.200913] RAX: ffffffffffffffda RBX: 000055e0ceb8d180 RCX: 00007fe10ad2fde4
> [  106.200914] RDX: 0000000000000000 RSI: 00007ffe729505f8 RDI: 0000000000000005
> [  106.200915] RBP: 0000000000000000 R08: 0000000000000004 R09: 0000000000000001
> [  106.200915] R10: 00007ffe72950688 R11: 0000000000000202 R12: 000055e0ceb8d090
> [  106.200916] R13: 0000000000000000 R14: 000055e0ceb8d180 R15: 00007ffe729505f8
> [  106.200918]  </TASK>
> 
> 
> [  106.200924] UBSAN: array-index-out-of-bounds in /var/tmp/portage/sys-kernel/gentoo-kernel-6.8.9/work/linux-6.8/net/wireless/nl80211.c:9252:5
> [  106.200926] index 0 is out of range for type 'struct ieee80211_channel *[]'
> [  106.200926] CPU: 11 PID: 4166 Comm: wpa_supplicant Not tainted 6.8.9-gentoo-dist-hardened #1
> [  106.200928] Hardware name: ASUS System Product Name/TUF GAMING B650M-PLUS WIFI, BIOS 2214 01/02/2024
> [  106.200928] Call Trace:
> [  106.200929]  <TASK>
> [  106.200930]  dump_stack_lvl+0x71/0x90
> [  106.200932]  __ubsan_handle_out_of_bounds+0xed/0x160
> [  106.200936]  nl80211_exit+0x7643/0x21f70 [cfg80211]
> [  106.200947]  genl_family_rcv_msg_doit+0xea/0x150
> [  106.200950]  genl_rcv_msg+0x234/0x260
> [  106.200952]  ? nl80211_exit+0x40/0x21f70 [cfg80211]
> [  106.200960]  ? nl80211_exit+0x7290/0x21f70 [cfg80211]
> [  106.200966]  ? nl80211_exit+0x290/0x21f70 [cfg80211]
> [  106.200976]  ? __cfi_genl_rcv_msg+0x10/0x10
> [  106.200978]  netlink_rcv_skb+0xff/0x140
> [  106.200981]  genl_rcv+0x28/0x40
> [  106.200982]  netlink_unicast+0x265/0x390
> [  106.200985]  netlink_sendmsg+0x381/0x440
> [  106.200988]  __sock_sendmsg+0x94/0xb0
> [  106.200990]  ____sys_sendmsg+0x1c3/0x250
> [  106.200993]  ___sys_sendmsg+0x293/0x2d0
> [  106.200994]  ? do_sock_setsockopt+0xf5/0x190
> [  106.201000]  __se_sys_sendmsg+0x102/0x140
> [  106.201003]  do_syscall_64+0x8e/0x170
> [  106.201004]  ? srso_alias_return_thunk+0x5/0xfbef5
> [  106.201006]  ? do_syscall_64+0x9a/0x170
> [  106.201010]  ? srso_alias_return_thunk+0x5/0xfbef5
> [  106.201011]  ? do_user_addr_fault+0x506/0x6b0
> [  106.201014]  ? srso_alias_return_thunk+0x5/0xfbef5
> [  106.201015]  ? srso_alias_return_thunk+0x5/0xfbef5
> [  106.201017]  entry_SYSCALL_64_after_hwframe+0x78/0x80
> [  106.201018] RIP: 0033:0x7fe10ad2fde4
> [  106.201021] Code: 89 02 b8 ff ff ff ff eb af 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 f3 0f 1e fa 80 3d 85 e5 0c 00 00 74 13 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 54 c3 0f 1f 00 53 48 83 ec 20 89 54 24 1c 48
> [  106.201022] RSP: 002b:00007ffe72950598 EFLAGS: 00000202 ORIG_RAX: 000000000000002e
> [  106.201023] RAX: ffffffffffffffda RBX: 000055e0ceb8d180 RCX: 00007fe10ad2fde4
> [  106.201024] RDX: 0000000000000000 RSI: 00007ffe729505f8 RDI: 0000000000000005
> [  106.201025] RBP: 0000000000000000 R08: 0000000000000004 R09: 0000000000000001
> [  106.201026] R10: 00007ffe72950688 R11: 0000000000000202 R12: 000055e0ceb8d090
> [  106.201026] R13: 0000000000000000 R14: 000055e0ceb8d180 R15: 00007ffe729505f8
> [  106.201029]  </TASK>
> 
> 
> [  106.201036] UBSAN: array-index-out-of-bounds in /var/tmp/portage/sys-kernel/gentoo-kernel-6.8.9/work/linux-6.8/net/mac80211/scan.c:364:4
> [  106.201037] index 0 is out of range for type 'struct ieee80211_channel *[]'
> [  106.201038] CPU: 11 PID: 4166 Comm: wpa_supplicant Not tainted 6.8.9-gentoo-dist-hardened #1
> [  106.201039] Hardware name: ASUS System Product Name/TUF GAMING B650M-PLUS WIFI, BIOS 2214 01/02/2024
> [  106.201040] Call Trace:
> [  106.201040]  <TASK>
> [  106.201041]  dump_stack_lvl+0x71/0x90
> [  106.201043]  __ubsan_handle_out_of_bounds+0xed/0x160
> [  106.201046]  ieee80211_sched_scan_stopped+0x42a/0x720 [mac80211]
> [  106.201062]  ? vprintk_emit+0x2b4/0x340
> [  106.201064]  ? srso_alias_return_thunk+0x5/0xfbef5
> [  106.201065]  ? __kmalloc+0x1e8/0x430
> [  106.201068]  __ieee80211_start_scan+0x4fa/0xb90 [mac80211]
> [  106.201081]  cfg80211_scan+0x22d/0x1270 [cfg80211]
> [  106.201091]  nl80211_exit+0x7bde/0x21f70 [cfg80211]
> [  106.201101]  genl_family_rcv_msg_doit+0xea/0x150
> [  106.201105]  genl_rcv_msg+0x234/0x260
> [  106.201106]  ? nl80211_exit+0x40/0x21f70 [cfg80211]
> [  106.201112]  ? nl80211_exit+0x7290/0x21f70 [cfg80211]
> [  106.201118]  ? nl80211_exit+0x290/0x21f70 [cfg80211]
> [  106.201124]  ? __cfi_genl_rcv_msg+0x10/0x10
> [  106.201125]  netlink_rcv_skb+0xff/0x140
> [  106.201128]  genl_rcv+0x28/0x40
> [  106.201129]  netlink_unicast+0x265/0x390
> [  106.201131]  netlink_sendmsg+0x381/0x440
> [  106.201133]  __sock_sendmsg+0x94/0xb0
> [  106.201134]  ____sys_sendmsg+0x1c3/0x250
> [  106.201136]  ___sys_sendmsg+0x293/0x2d0
> [  106.201137]  ? do_sock_setsockopt+0xf5/0x190
> [  106.201142]  __se_sys_sendmsg+0x102/0x140
> [  106.201145]  do_syscall_64+0x8e/0x170
> [  106.201147]  ? srso_alias_return_thunk+0x5/0xfbef5
> [  106.201148]  ? do_syscall_64+0x9a/0x170
> [  106.201152]  ? srso_alias_return_thunk+0x5/0xfbef5
> [  106.201153]  ? do_user_addr_fault+0x506/0x6b0
> [  106.201155]  ? srso_alias_return_thunk+0x5/0xfbef5
> [  106.201157]  ? srso_alias_return_thunk+0x5/0xfbef5
> [  106.201159]  entry_SYSCALL_64_after_hwframe+0x78/0x80
> [  106.201160] RIP: 0033:0x7fe10ad2fde4
> [  106.201162] Code: 89 02 b8 ff ff ff ff eb af 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 f3 0f 1e fa 80 3d 85 e5 0c 00 00 74 13 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 54 c3 0f 1f 00 53 48 83 ec 20 89 54 24 1c 48
> [  106.201163] RSP: 002b:00007ffe72950598 EFLAGS: 00000202 ORIG_RAX: 000000000000002e
> [  106.201165] RAX: ffffffffffffffda RBX: 000055e0ceb8d180 RCX: 00007fe10ad2fde4
> [  106.201165] RDX: 0000000000000000 RSI: 00007ffe729505f8 RDI: 0000000000000005
> [  106.201166] RBP: 0000000000000000 R08: 0000000000000004 R09: 0000000000000001
> [  106.201167] R10: 00007ffe72950688 R11: 0000000000000202 R12: 000055e0ceb8d090
> [  106.201168] R13: 0000000000000000 R14: 000055e0ceb8d180 R15: 00007ffe729505f8
> [  106.201170]  </TASK>

Thanks.

-- 
An old man doll... just what I always wanted! - Clara

Attachment: signature.asc
Description: PGP signature


[Index of Archives]     [Linux Host AP]     [ATH6KL]     [Linux Wireless Personal Area Network]     [Linux Bluetooth]     [Wireless Regulations]     [Linux Netdev]     [Kernel Newbies]     [Linux Kernel]     [IDE]     [Git]     [Netfilter]     [Bugtraq]     [Yosemite Hiking]     [MIPS Linux]     [ARM Linux]     [Linux RAID]

  Powered by Linux