UBSAN array-index-out-of-bounds: cfg80211_scan_6ghz

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Hi, I'm experiencing UBSAN array-index-out-of-bounds errors while using
my Framework 13" AMD laptop with its Mediatek MT7922 wifi adapter
(mt7921e).

It seems to happen only once on boot, and occurs with both kernel
versions 6.12.7 and 6.13-rc4, both compiled from vanilla upstream kernel 
sources on Fedora 41 using the kernel.org LLVM toolchain (19.1.6).

I can try some other kernel series if necessary, and also a bisect if I
find a working version, but that may take me a while.

I wasn't sure if I should mark this as a regression, as I'm not sure
which/if there is a working kernel version at this point.

Thanks.

----

[   17.754417] UBSAN: array-index-out-of-bounds in /data/linux/net/wireless/scan.c:766:2
[   17.754423] index 0 is out of range for type 'struct ieee80211_channel *[] __counted_by(n_channels)' (aka 'struct ieee80211_channel *[]')
[   17.754427] CPU: 13 UID: 0 PID: 620 Comm: kworker/u64:10 Tainted: G                T  6.13.0-rc4 #9
[   17.754433] Tainted: [T]=RANDSTRUCT
[   17.754435] Hardware name: Framework Laptop 13 (AMD Ryzen 7040Series)/FRANMDCP07, BIOS 03.05 03/29/2024
[   17.754438] Workqueue: events_unbound cfg80211_wiphy_work
[   17.754446] Call Trace:
[   17.754449]  <TASK>
[   17.754452]  dump_stack_lvl+0x82/0xc0
[   17.754459]  __ubsan_handle_out_of_bounds+0xe7/0x110
[   17.754464]  ? srso_alias_return_thunk+0x5/0xfbef5
[   17.754470]  ? __kmalloc_noprof+0x1a7/0x280
[   17.754477]  cfg80211_scan_6ghz+0x3bb/0xfd0
[   17.754482]  ? srso_alias_return_thunk+0x5/0xfbef5
[   17.754486]  ? try_to_wake_up+0x368/0x4c0
[   17.754491]  ? try_to_wake_up+0x1a9/0x4c0
[   17.754496]  ___cfg80211_scan_done+0xa9/0x1e0
[   17.754500]  cfg80211_wiphy_work+0xb7/0xe0
[   17.754504]  process_scheduled_works+0x205/0x3a0
[   17.754509]  worker_thread+0x24a/0x300
[   17.754514]  ? __cfi_worker_thread+0x10/0x10
[   17.754519]  kthread+0x158/0x180
[   17.754524]  ? __cfi_kthread+0x10/0x10
[   17.754528]  ret_from_fork+0x40/0x50
[   17.754534]  ? __cfi_kthread+0x10/0x10
[   17.754538]  ret_from_fork_asm+0x11/0x30
[   17.754544]  </TASK>






[Index of Archives]     [Linux Kernel]     [Kernel Development Newbies]     [Linux USB Devel]     [Video for Linux]     [Linux Audio Users]     [Yosemite Hiking]     [Linux Kernel]     [Linux SCSI]

  Powered by Linux