Patch "wifi: mac80211: fix UBSAN noise in ieee80211_prep_hw_scan()" has been added to the 6.6-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    wifi: mac80211: fix UBSAN noise in ieee80211_prep_hw_scan()

to the 6.6-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     wifi-mac80211-fix-ubsan-noise-in-ieee80211_prep_hw_s.patch
and it can be found in the queue-6.6 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit bae7cf685a336cc67140787b5b8f25e0eb135d71
Author: Dmitry Antipov <dmantipov@xxxxxxxxx>
Date:   Fri May 17 18:33:32 2024 +0300

    wifi: mac80211: fix UBSAN noise in ieee80211_prep_hw_scan()
    
    [ Upstream commit 92ecbb3ac6f3fe8ae9edf3226c76aa17b6800699 ]
    
    When testing the previous patch with CONFIG_UBSAN_BOUNDS, I've
    noticed the following:
    
    UBSAN: array-index-out-of-bounds in net/mac80211/scan.c:372:4
    index 0 is out of range for type 'struct ieee80211_channel *[]'
    CPU: 0 PID: 1435 Comm: wpa_supplicant Not tainted 6.9.0+ #1
    Hardware name: LENOVO 20UN005QRT/20UN005QRT <...BIOS details...>
    Call Trace:
     <TASK>
     dump_stack_lvl+0x2d/0x90
     __ubsan_handle_out_of_bounds+0xe7/0x140
     ? timerqueue_add+0x98/0xb0
     ieee80211_prep_hw_scan+0x2db/0x480 [mac80211]
     ? __kmalloc+0xe1/0x470
     __ieee80211_start_scan+0x541/0x760 [mac80211]
     rdev_scan+0x1f/0xe0 [cfg80211]
     nl80211_trigger_scan+0x9b6/0xae0 [cfg80211]
     ...<the rest is not too useful...>
    
    Since '__ieee80211_start_scan()' leaves 'hw_scan_req->req.n_channels'
    uninitialized, actual boundaries of 'hw_scan_req->req.channels' can't
    be checked in 'ieee80211_prep_hw_scan()'. Although an initialization
    of 'hw_scan_req->req.n_channels' introduces some confusion around
    allocated vs. used VLA members, this shouldn't be a problem since
    everything is correctly adjusted soon in 'ieee80211_prep_hw_scan()'.
    
    Cleanup 'kmalloc()' math in '__ieee80211_start_scan()' by using the
    convenient 'struct_size()' as well.
    
    Signed-off-by: Dmitry Antipov <dmantipov@xxxxxxxxx>
    Link: https://msgid.link/20240517153332.18271-2-dmantipov@xxxxxxxxx
    [improve (imho) indentation a bit]
    Signed-off-by: Johannes Berg <johannes.berg@xxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/net/mac80211/scan.c b/net/mac80211/scan.c
index b68214f159838..3d68db738cde4 100644
--- a/net/mac80211/scan.c
+++ b/net/mac80211/scan.c
@@ -722,15 +722,21 @@ static int __ieee80211_start_scan(struct ieee80211_sub_if_data *sdata,
 			local->hw_scan_ies_bufsize *= n_bands;
 		}
 
-		local->hw_scan_req = kmalloc(
-				sizeof(*local->hw_scan_req) +
-				req->n_channels * sizeof(req->channels[0]) +
-				local->hw_scan_ies_bufsize, GFP_KERNEL);
+		local->hw_scan_req = kmalloc(struct_size(local->hw_scan_req,
+							 req.channels,
+							 req->n_channels) +
+					     local->hw_scan_ies_bufsize,
+					     GFP_KERNEL);
 		if (!local->hw_scan_req)
 			return -ENOMEM;
 
 		local->hw_scan_req->req.ssids = req->ssids;
 		local->hw_scan_req->req.n_ssids = req->n_ssids;
+		/* None of the channels are actually set
+		 * up but let UBSAN know the boundaries.
+		 */
+		local->hw_scan_req->req.n_channels = req->n_channels;
+
 		ies = (u8 *)local->hw_scan_req +
 			sizeof(*local->hw_scan_req) +
 			req->n_channels * sizeof(req->channels[0]);