On Thu, 2024-05-09 at 07:07 +0700, Bagas Sanjaya wrote: > Hi, > > Jannik Glückert <jannik.glueckert@xxxxxxxxx> reported on Bugzilla array index > out-of-bounds catched by ubsan along with full kernel trace dump (see > https://bugzilla.kernel.org/show_bug.cgi?id=218810): > > > I am seeing multiple array-index-out-of-bounds related to `ieee80211_channel[]` iteration. > > > > This is with a Mediatek MT7921 chipset. > > I have only tested with kernel 6.8.9, but I don't see any channel index related fixes in master. > > > > This was discovered as part of Gentoo Hardened enabling CONFIG_UBSAN_ARRAY_BOUNDS > > > > > > [ 106.194465] UBSAN: array-index-out-of-bounds in /var/tmp/portage/sys-kernel/gentoo-kernel-6.8.9/work/linux-6.8/net/wireless/nl80211.c:9203:29 > > [ 106.195063] index 42 is out of range for type 'struct ieee80211_channel *[]' > > [ 106.200924] UBSAN: array-index-out-of-bounds in /var/tmp/portage/sys-kernel/gentoo-kernel-6.8.9/work/linux-6.8/net/wireless/nl80211.c:9252:5 > > [ 106.200926] index 0 is out of range for type 'struct ieee80211_channel *[]' At least one of these should be fixed by https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless.git/commit/?id=838c7b8f1f278404d9d684c34a8cb26dc41aaaa1 > > [ 106.201036] UBSAN: array-index-out-of-bounds in /var/tmp/portage/sys-kernel/gentoo-kernel-6.8.9/work/linux-6.8/net/mac80211/scan.c:364:4 > > [ 106.201037] index 0 is out of range for type 'struct ieee80211_channel *[]' No idea about that one. Send patches. (Seriously. If you're running with bleeding edge toolchains that pretty much nobody has yet, send patches.) johannes
