On Thu, Sep 05, 2024 at 06:04:00PM +0300, Dmitry Antipov wrote: > Looking at https://syzkaller.appspot.com/bug?extid=1a3986bbd3169c307819 > and running reproducer with CONFIG_UBSAN_BOUNDS, I've noticed the > following: > > [ T4985] UBSAN: array-index-out-of-bounds in net/wireless/scan.c:3479:25 > [ T4985] index 164 is out of range for type 'struct ieee80211_channel *[]' > <...skipped...> > [ T4985] Call Trace: > [ T4985] <TASK> > [ T4985] dump_stack_lvl+0x1c2/0x2a0 > [ T4985] ? __pfx_dump_stack_lvl+0x10/0x10 > [ T4985] ? __pfx__printk+0x10/0x10 > [ T4985] __ubsan_handle_out_of_bounds+0x127/0x150 > [ T4985] cfg80211_wext_siwscan+0x11a4/0x1260 > <...the rest is not too useful...> > > Even if we do 'creq->n_channels = n_channels' before 'creq->ssids = > (void *)&creq->channels[n_channels]', UBSAN treats the latter as > off-by-one error. Fix this by using pointer arithmetic rather than > an expression with explicit array indexing and use convenient > 'struct_size()' to simplify the math here and in 'kzalloc()' above. > > Fixes: 5ba63533bbf6 ("cfg80211: fix alignment problem in scan request") > Signed-off-by: Dmitry Antipov <dmantipov@xxxxxxxxx> This looks correct -- the offset is based on the allocation base, not the array within the struct, so no array-out-of-bounds warning will happen. Reviewed-by: Kees Cook <kees@xxxxxxxxxx> -- Kees Cook
