From: Bagas Sanjaya <bagasdotme@gmail.com>
To: Linux Kernel Mailing List <linux-kernel@vger.kernel.org>,
Linux Networking <netdev@vger.kernel.org>,
Linux Wireless <linux-wireless@vger.kernel.org>
Cc: "Jouni Malinen" <jouni.malinen@atheros.com>,
"John W. Linville" <linville@tuxdriver.com>,
"Kalle Valo" <kvalo@kernel.org>,
"Johannes Berg" <johannes@sipsolutions.net>,
"Emmanuel Grumbach" <emmanuel.grumbach@intel.com>,
"David S. Miller" <davem@davemloft.net>,
"Eric Dumazet" <edumazet@google.com>,
"Jakub Kicinski" <kuba@kernel.org>,
"Paolo Abeni" <pabeni@redhat.com>,
"Jannik Glückert" <jannik.glueckert@gmail.com>
Subject: Fwd: UBSAN: array-index-out-of-bounds in net/wireless/nl80211.c and net/mac80211/scan.c
Date: Thu, 9 May 2024 07:07:36 +0700 [thread overview]
Message-ID: <ZjwTyGqcey0HXxTT@archie.me> (raw)
[-- Attachment #1: Type: text/plain, Size: 8835 bytes --]
Hi,
Jannik Glückert <jannik.glueckert@gmail.com> reported on Bugzilla array index
out-of-bounds catched by ubsan along with full kernel trace dump (see
https://bugzilla.kernel.org/show_bug.cgi?id=218810):
> I am seeing multiple array-index-out-of-bounds related to `ieee80211_channel[]` iteration.
>
> This is with a Mediatek MT7921 chipset.
> I have only tested with kernel 6.8.9, but I don't see any channel index related fixes in master.
>
> This was discovered as part of Gentoo Hardened enabling CONFIG_UBSAN_ARRAY_BOUNDS
>
>
> [ 106.194465] UBSAN: array-index-out-of-bounds in /var/tmp/portage/sys-kernel/gentoo-kernel-6.8.9/work/linux-6.8/net/wireless/nl80211.c:9203:29
> [ 106.195063] index 42 is out of range for type 'struct ieee80211_channel *[]'
> [ 106.195599] CPU: 11 PID: 4166 Comm: wpa_supplicant Not tainted 6.8.9-gentoo-dist-hardened #1
> [ 106.196038] Hardware name: ASUS System Product Name/TUF GAMING B650M-PLUS WIFI, BIOS 2214 01/02/2024
> [ 106.196485] Call Trace:
> [ 106.196913] <TASK>
> [ 106.197439] dump_stack_lvl+0x71/0x90
> [ 106.197899] __ubsan_handle_out_of_bounds+0xed/0x160
> [ 106.198420] nl80211_exit+0x7c3f/0x21f70 [cfg80211]
> [ 106.198917] genl_family_rcv_msg_doit+0xea/0x150
> [ 106.198922] genl_rcv_msg+0x234/0x260
> [ 106.198923] ? nl80211_exit+0x40/0x21f70 [cfg80211]
> [ 106.198930] ? nl80211_exit+0x7290/0x21f70 [cfg80211]
> [ 106.200847] ? nl80211_exit+0x290/0x21f70 [cfg80211]
> [ 106.200854] ? __cfi_genl_rcv_msg+0x10/0x10
> [ 106.200856] netlink_rcv_skb+0xff/0x140
> [ 106.200859] genl_rcv+0x28/0x40
> [ 106.200860] netlink_unicast+0x265/0x390
> [ 106.200862] netlink_sendmsg+0x381/0x440
> [ 106.200865] __sock_sendmsg+0x94/0xb0
> [ 106.200868] ____sys_sendmsg+0x1c3/0x250
> [ 106.200871] ___sys_sendmsg+0x293/0x2d0
> [ 106.200873] ? do_sock_setsockopt+0xf5/0x190
> [ 106.200879] __se_sys_sendmsg+0x102/0x140
> [ 106.200882] do_syscall_64+0x8e/0x170
> [ 106.200884] ? srso_alias_return_thunk+0x5/0xfbef5
> [ 106.200886] ? do_syscall_64+0x9a/0x170
> [ 106.200889] ? srso_alias_return_thunk+0x5/0xfbef5
> [ 106.200890] ? do_user_addr_fault+0x506/0x6b0
> [ 106.200892] ? srso_alias_return_thunk+0x5/0xfbef5
> [ 106.200893] ? srso_alias_return_thunk+0x5/0xfbef5
> [ 106.200895] entry_SYSCALL_64_after_hwframe+0x78/0x80
> [ 106.200896] RIP: 0033:0x7fe10ad2fde4
> [ 106.200911] Code: 89 02 b8 ff ff ff ff eb af 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 f3 0f 1e fa 80 3d 85 e5 0c 00 00 74 13 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 54 c3 0f 1f 00 53 48 83 ec 20 89 54 24 1c 48
> [ 106.200912] RSP: 002b:00007ffe72950598 EFLAGS: 00000202 ORIG_RAX: 000000000000002e
> [ 106.200913] RAX: ffffffffffffffda RBX: 000055e0ceb8d180 RCX: 00007fe10ad2fde4
> [ 106.200914] RDX: 0000000000000000 RSI: 00007ffe729505f8 RDI: 0000000000000005
> [ 106.200915] RBP: 0000000000000000 R08: 0000000000000004 R09: 0000000000000001
> [ 106.200915] R10: 00007ffe72950688 R11: 0000000000000202 R12: 000055e0ceb8d090
> [ 106.200916] R13: 0000000000000000 R14: 000055e0ceb8d180 R15: 00007ffe729505f8
> [ 106.200918] </TASK>
>
>
> [ 106.200924] UBSAN: array-index-out-of-bounds in /var/tmp/portage/sys-kernel/gentoo-kernel-6.8.9/work/linux-6.8/net/wireless/nl80211.c:9252:5
> [ 106.200926] index 0 is out of range for type 'struct ieee80211_channel *[]'
> [ 106.200926] CPU: 11 PID: 4166 Comm: wpa_supplicant Not tainted 6.8.9-gentoo-dist-hardened #1
> [ 106.200928] Hardware name: ASUS System Product Name/TUF GAMING B650M-PLUS WIFI, BIOS 2214 01/02/2024
> [ 106.200928] Call Trace:
> [ 106.200929] <TASK>
> [ 106.200930] dump_stack_lvl+0x71/0x90
> [ 106.200932] __ubsan_handle_out_of_bounds+0xed/0x160
> [ 106.200936] nl80211_exit+0x7643/0x21f70 [cfg80211]
> [ 106.200947] genl_family_rcv_msg_doit+0xea/0x150
> [ 106.200950] genl_rcv_msg+0x234/0x260
> [ 106.200952] ? nl80211_exit+0x40/0x21f70 [cfg80211]
> [ 106.200960] ? nl80211_exit+0x7290/0x21f70 [cfg80211]
> [ 106.200966] ? nl80211_exit+0x290/0x21f70 [cfg80211]
> [ 106.200976] ? __cfi_genl_rcv_msg+0x10/0x10
> [ 106.200978] netlink_rcv_skb+0xff/0x140
> [ 106.200981] genl_rcv+0x28/0x40
> [ 106.200982] netlink_unicast+0x265/0x390
> [ 106.200985] netlink_sendmsg+0x381/0x440
> [ 106.200988] __sock_sendmsg+0x94/0xb0
> [ 106.200990] ____sys_sendmsg+0x1c3/0x250
> [ 106.200993] ___sys_sendmsg+0x293/0x2d0
> [ 106.200994] ? do_sock_setsockopt+0xf5/0x190
> [ 106.201000] __se_sys_sendmsg+0x102/0x140
> [ 106.201003] do_syscall_64+0x8e/0x170
> [ 106.201004] ? srso_alias_return_thunk+0x5/0xfbef5
> [ 106.201006] ? do_syscall_64+0x9a/0x170
> [ 106.201010] ? srso_alias_return_thunk+0x5/0xfbef5
> [ 106.201011] ? do_user_addr_fault+0x506/0x6b0
> [ 106.201014] ? srso_alias_return_thunk+0x5/0xfbef5
> [ 106.201015] ? srso_alias_return_thunk+0x5/0xfbef5
> [ 106.201017] entry_SYSCALL_64_after_hwframe+0x78/0x80
> [ 106.201018] RIP: 0033:0x7fe10ad2fde4
> [ 106.201021] Code: 89 02 b8 ff ff ff ff eb af 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 f3 0f 1e fa 80 3d 85 e5 0c 00 00 74 13 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 54 c3 0f 1f 00 53 48 83 ec 20 89 54 24 1c 48
> [ 106.201022] RSP: 002b:00007ffe72950598 EFLAGS: 00000202 ORIG_RAX: 000000000000002e
> [ 106.201023] RAX: ffffffffffffffda RBX: 000055e0ceb8d180 RCX: 00007fe10ad2fde4
> [ 106.201024] RDX: 0000000000000000 RSI: 00007ffe729505f8 RDI: 0000000000000005
> [ 106.201025] RBP: 0000000000000000 R08: 0000000000000004 R09: 0000000000000001
> [ 106.201026] R10: 00007ffe72950688 R11: 0000000000000202 R12: 000055e0ceb8d090
> [ 106.201026] R13: 0000000000000000 R14: 000055e0ceb8d180 R15: 00007ffe729505f8
> [ 106.201029] </TASK>
>
>
> [ 106.201036] UBSAN: array-index-out-of-bounds in /var/tmp/portage/sys-kernel/gentoo-kernel-6.8.9/work/linux-6.8/net/mac80211/scan.c:364:4
> [ 106.201037] index 0 is out of range for type 'struct ieee80211_channel *[]'
> [ 106.201038] CPU: 11 PID: 4166 Comm: wpa_supplicant Not tainted 6.8.9-gentoo-dist-hardened #1
> [ 106.201039] Hardware name: ASUS System Product Name/TUF GAMING B650M-PLUS WIFI, BIOS 2214 01/02/2024
> [ 106.201040] Call Trace:
> [ 106.201040] <TASK>
> [ 106.201041] dump_stack_lvl+0x71/0x90
> [ 106.201043] __ubsan_handle_out_of_bounds+0xed/0x160
> [ 106.201046] ieee80211_sched_scan_stopped+0x42a/0x720 [mac80211]
> [ 106.201062] ? vprintk_emit+0x2b4/0x340
> [ 106.201064] ? srso_alias_return_thunk+0x5/0xfbef5
> [ 106.201065] ? __kmalloc+0x1e8/0x430
> [ 106.201068] __ieee80211_start_scan+0x4fa/0xb90 [mac80211]
> [ 106.201081] cfg80211_scan+0x22d/0x1270 [cfg80211]
> [ 106.201091] nl80211_exit+0x7bde/0x21f70 [cfg80211]
> [ 106.201101] genl_family_rcv_msg_doit+0xea/0x150
> [ 106.201105] genl_rcv_msg+0x234/0x260
> [ 106.201106] ? nl80211_exit+0x40/0x21f70 [cfg80211]
> [ 106.201112] ? nl80211_exit+0x7290/0x21f70 [cfg80211]
> [ 106.201118] ? nl80211_exit+0x290/0x21f70 [cfg80211]
> [ 106.201124] ? __cfi_genl_rcv_msg+0x10/0x10
> [ 106.201125] netlink_rcv_skb+0xff/0x140
> [ 106.201128] genl_rcv+0x28/0x40
> [ 106.201129] netlink_unicast+0x265/0x390
> [ 106.201131] netlink_sendmsg+0x381/0x440
> [ 106.201133] __sock_sendmsg+0x94/0xb0
> [ 106.201134] ____sys_sendmsg+0x1c3/0x250
> [ 106.201136] ___sys_sendmsg+0x293/0x2d0
> [ 106.201137] ? do_sock_setsockopt+0xf5/0x190
> [ 106.201142] __se_sys_sendmsg+0x102/0x140
> [ 106.201145] do_syscall_64+0x8e/0x170
> [ 106.201147] ? srso_alias_return_thunk+0x5/0xfbef5
> [ 106.201148] ? do_syscall_64+0x9a/0x170
> [ 106.201152] ? srso_alias_return_thunk+0x5/0xfbef5
> [ 106.201153] ? do_user_addr_fault+0x506/0x6b0
> [ 106.201155] ? srso_alias_return_thunk+0x5/0xfbef5
> [ 106.201157] ? srso_alias_return_thunk+0x5/0xfbef5
> [ 106.201159] entry_SYSCALL_64_after_hwframe+0x78/0x80
> [ 106.201160] RIP: 0033:0x7fe10ad2fde4
> [ 106.201162] Code: 89 02 b8 ff ff ff ff eb af 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 f3 0f 1e fa 80 3d 85 e5 0c 00 00 74 13 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 54 c3 0f 1f 00 53 48 83 ec 20 89 54 24 1c 48
> [ 106.201163] RSP: 002b:00007ffe72950598 EFLAGS: 00000202 ORIG_RAX: 000000000000002e
> [ 106.201165] RAX: ffffffffffffffda RBX: 000055e0ceb8d180 RCX: 00007fe10ad2fde4
> [ 106.201165] RDX: 0000000000000000 RSI: 00007ffe729505f8 RDI: 0000000000000005
> [ 106.201166] RBP: 0000000000000000 R08: 0000000000000004 R09: 0000000000000001
> [ 106.201167] R10: 00007ffe72950688 R11: 0000000000000202 R12: 000055e0ceb8d090
> [ 106.201168] R13: 0000000000000000 R14: 000055e0ceb8d180 R15: 00007ffe729505f8
> [ 106.201170] </TASK>
Thanks.
--
An old man doll... just what I always wanted! - Clara
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 228 bytes --]
next reply other threads:[~2024-05-09 0:07 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-05-09 0:07 Bagas Sanjaya [this message]
2024-05-09 8:48 ` Fwd: UBSAN: array-index-out-of-bounds in net/wireless/nl80211.c and net/mac80211/scan.c Johannes Berg
2024-05-09 9:17 ` Bagas Sanjaya
2024-05-09 10:49 ` Jannik Glückert
2024-05-09 10:52 ` Johannes Berg
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=ZjwTyGqcey0HXxTT@archie.me \
--to=bagasdotme@gmail.com \
--cc=davem@davemloft.net \
--cc=edumazet@google.com \
--cc=emmanuel.grumbach@intel.com \
--cc=jannik.glueckert@gmail.com \
--cc=johannes@sipsolutions.net \
--cc=jouni.malinen@atheros.com \
--cc=kuba@kernel.org \
--cc=kvalo@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-wireless@vger.kernel.org \
--cc=linville@tuxdriver.com \
--cc=netdev@vger.kernel.org \
--cc=pabeni@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).