Hi John, On Sat, Dec 28, 2024 at 11:21:27AM +0000, John Rowley wrote: > Hi, I'm experiencing UBSAN array-index-out-of-bounds errors while using > my Framework 13" AMD laptop with its Mediatek MT7922 wifi adapter > (mt7921e). > > It seems to happen only once on boot, and occurs with both kernel > versions 6.12.7 and 6.13-rc4, both compiled from vanilla upstream kernel > sources on Fedora 41 using the kernel.org LLVM toolchain (19.1.6). > > I can try some other kernel series if necessary, and also a bisect if I > find a working version, but that may take me a while. This looks related to UBSAN_BOUNDS and the fact that version of clang supports the __counted_by attribute. I do not have much time at the moment to look at this but I have added Kees, Gustavo, and linux-hardening for further analysis. Cheers, Nathan > I wasn't sure if I should mark this as a regression, as I'm not sure > which/if there is a working kernel version at this point. > > Thanks. > > ---- > > [ 17.754417] UBSAN: array-index-out-of-bounds in /data/linux/net/wireless/scan.c:766:2 > [ 17.754423] index 0 is out of range for type 'struct ieee80211_channel *[] __counted_by(n_channels)' (aka 'struct ieee80211_channel *[]') > [ 17.754427] CPU: 13 UID: 0 PID: 620 Comm: kworker/u64:10 Tainted: G T 6.13.0-rc4 #9 > [ 17.754433] Tainted: [T]=RANDSTRUCT > [ 17.754435] Hardware name: Framework Laptop 13 (AMD Ryzen 7040Series)/FRANMDCP07, BIOS 03.05 03/29/2024 > [ 17.754438] Workqueue: events_unbound cfg80211_wiphy_work > [ 17.754446] Call Trace: > [ 17.754449] <TASK> > [ 17.754452] dump_stack_lvl+0x82/0xc0 > [ 17.754459] __ubsan_handle_out_of_bounds+0xe7/0x110 > [ 17.754464] ? srso_alias_return_thunk+0x5/0xfbef5 > [ 17.754470] ? __kmalloc_noprof+0x1a7/0x280 > [ 17.754477] cfg80211_scan_6ghz+0x3bb/0xfd0 > [ 17.754482] ? srso_alias_return_thunk+0x5/0xfbef5 > [ 17.754486] ? try_to_wake_up+0x368/0x4c0 > [ 17.754491] ? try_to_wake_up+0x1a9/0x4c0 > [ 17.754496] ___cfg80211_scan_done+0xa9/0x1e0 > [ 17.754500] cfg80211_wiphy_work+0xb7/0xe0 > [ 17.754504] process_scheduled_works+0x205/0x3a0 > [ 17.754509] worker_thread+0x24a/0x300 > [ 17.754514] ? __cfi_worker_thread+0x10/0x10 > [ 17.754519] kthread+0x158/0x180 > [ 17.754524] ? __cfi_kthread+0x10/0x10 > [ 17.754528] ret_from_fork+0x40/0x50 > [ 17.754534] ? __cfi_kthread+0x10/0x10 > [ 17.754538] ret_from_fork_asm+0x11/0x30 > [ 17.754544] </TASK> >
