On Tue, May 14, 2024 at 05:51:02AM +0100, Sam James wrote:
> I think I've just hit this, unless it's been fixed since and it's just
> similar.
>
> ```
> [ 291.051876] ================================================================================
> [ 291.051892] UBSAN: array-index-out-of-bounds in /var/tmp/portage/sys-kernel/gentoo-kernel-6.6.30/work/linux-6.6/include/linux/ieee80211.h:4455:28
> [ 291.051901] index 1 is out of range for type 'u8 [1]'
> [ 291.051908] CPU: 2 PID: 627 Comm: kworker/2:3 Not tainted 6.6.30-gentoo-dist-hardened #1
> [ 291.051917] Hardware name: ASUSTeK COMPUTER INC. UX305FA/UX305FA, BIOS UX305FA.216 04/17/2019
> [ 291.051922] Workqueue: events cfg80211_wiphy_work [cfg80211]
> [ 291.052082] Call Trace:
> [ 291.052088] <TASK>
> [ 291.052096] dump_stack_lvl (lib/dump_stack.c:107)
> [ 291.052114] __ubsan_handle_out_of_bounds (lib/ubsan.c:218 (discriminator 1) lib/ubsan.c:348 (discriminator 1))
> [ 291.052130] ieee80211_rx_mgmt_beacon (include/linux/ieee80211.h:4455 net/mac80211/mlme.c:6047) mac80211
This looks like it's this line in ieee80211_rx_mgmt_beacon():
ieee80211_check_tim(elems->tim, elems->tim_len, vif_cfg->aid)) {
which is:
static inline bool ieee80211_check_tim(const struct ieee80211_tim_ie *tim,
u8 tim_len, u16 aid)
{ ...
return !!(tim->virtual_map[index] & mask);
^^^^^^^^^^^^^^^^^^^^^^^
}
UBSAN says it's because the array is defined as "virtual_map[1]":
struct ieee80211_tim_ie {
u8 dtim_count;
u8 dtim_period;
u8 bitmap_ctrl;
/* variable size: 1 - 251 bytes */
u8 virtual_map[1];
} __packed;
This was fixed in
commit 2ae5c9248e06 ("wifi: mac80211: Use flexible array in struct ieee80211_tim_ie")
which was part of the v6.7 release.
> (It was a fun mini-adventure to get the trace usable and I should send
> some patches to decode_stacktrace.sh, I think...)
Please do! :)
--
Kees Cook
