Received-SPF: pass (google.com: domain of linux-wireless+bounces-7367-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:4601:e00::3 as permitted sender) client-ip=2604:1380:4601:e00::3;
Date: Thu, 9 May 2024 07:07:36 +0700
From: Bagas Sanjaya <bagasdotme@gmail.com>
To: Linux Kernel Mailing List <linux-kernel@vger.kernel.org>,
	Linux Networking <netdev@vger.kernel.org>,
	Linux Wireless <linux-wireless@vger.kernel.org>
Cc: Jouni Malinen <jouni.malinen@atheros.com>,
	"John W. Linville" <linville@tuxdriver.com>,
	Kalle Valo <kvalo@kernel.org>,
	Johannes Berg <johannes@sipsolutions.net>,
	Emmanuel Grumbach <emmanuel.grumbach@intel.com>,
	"David S. Miller" <davem@davemloft.net>,
	Eric Dumazet <edumazet@google.com>,
	Jakub Kicinski <kuba@kernel.org>, Paolo Abeni <pabeni@redhat.com>,
	Jannik =?utf-8?B?R2zDvGNrZXJ0?= <jannik.glueckert@gmail.com>
Subject: Fwd: UBSAN: array-index-out-of-bounds in net/wireless/nl80211.c and
 net/mac80211/scan.c
Message-ID: <ZjwTyGqcey0HXxTT@archie.me>
Precedence: bulk
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha512;
	protocol="application/pgp-signature"; boundary="uVq9w8jupfQiwLWt"
Content-Disposition: inline


--uVq9w8jupfQiwLWt
Content-Type: text/plain; charset=utf-8
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

Hi,

Jannik Gl=C3=BCckert <jannik.glueckert@gmail.com> reported on Bugzilla arra=
y index
out-of-bounds catched by ubsan along with full kernel trace dump (see
https://bugzilla.kernel.org/show_bug.cgi?id=3D218810):

> I am seeing multiple array-index-out-of-bounds related to `ieee80211_chan=
nel[]` iteration.
>=20
> This is with a Mediatek MT7921 chipset.
> I have only tested with kernel 6.8.9, but I don't see any channel index r=
elated fixes in master.
>=20
> This was discovered as part of Gentoo Hardened enabling CONFIG_UBSAN_ARRA=
Y_BOUNDS
>=20
>=20
> [  106.194465] UBSAN: array-index-out-of-bounds in /var/tmp/portage/sys-k=
ernel/gentoo-kernel-6.8.9/work/linux-6.8/net/wireless/nl80211.c:9203:29
> [  106.195063] index 42 is out of range for type 'struct ieee80211_channe=
l *[]'
> [  106.195599] CPU: 11 PID: 4166 Comm: wpa_supplicant Not tainted 6.8.9-g=
entoo-dist-hardened #1
> [  106.196038] Hardware name: ASUS System Product Name/TUF GAMING B650M-P=
LUS WIFI, BIOS 2214 01/02/2024
> [  106.196485] Call Trace:
> [  106.196913]  <TASK>
> [  106.197439]  dump_stack_lvl+0x71/0x90
> [  106.197899]  __ubsan_handle_out_of_bounds+0xed/0x160
> [  106.198420]  nl80211_exit+0x7c3f/0x21f70 [cfg80211]
> [  106.198917]  genl_family_rcv_msg_doit+0xea/0x150
> [  106.198922]  genl_rcv_msg+0x234/0x260
> [  106.198923]  ? nl80211_exit+0x40/0x21f70 [cfg80211]
> [  106.198930]  ? nl80211_exit+0x7290/0x21f70 [cfg80211]
> [  106.200847]  ? nl80211_exit+0x290/0x21f70 [cfg80211]
> [  106.200854]  ? __cfi_genl_rcv_msg+0x10/0x10
> [  106.200856]  netlink_rcv_skb+0xff/0x140
> [  106.200859]  genl_rcv+0x28/0x40
> [  106.200860]  netlink_unicast+0x265/0x390
> [  106.200862]  netlink_sendmsg+0x381/0x440
> [  106.200865]  __sock_sendmsg+0x94/0xb0
> [  106.200868]  ____sys_sendmsg+0x1c3/0x250
> [  106.200871]  ___sys_sendmsg+0x293/0x2d0
> [  106.200873]  ? do_sock_setsockopt+0xf5/0x190
> [  106.200879]  __se_sys_sendmsg+0x102/0x140
> [  106.200882]  do_syscall_64+0x8e/0x170
> [  106.200884]  ? srso_alias_return_thunk+0x5/0xfbef5
> [  106.200886]  ? do_syscall_64+0x9a/0x170
> [  106.200889]  ? srso_alias_return_thunk+0x5/0xfbef5
> [  106.200890]  ? do_user_addr_fault+0x506/0x6b0
> [  106.200892]  ? srso_alias_return_thunk+0x5/0xfbef5
> [  106.200893]  ? srso_alias_return_thunk+0x5/0xfbef5
> [  106.200895]  entry_SYSCALL_64_after_hwframe+0x78/0x80
> [  106.200896] RIP: 0033:0x7fe10ad2fde4
> [  106.200911] Code: 89 02 b8 ff ff ff ff eb af 66 2e 0f 1f 84 00 00 00 0=
0 00 0f 1f 00 f3 0f 1e fa 80 3d 85 e5 0c 00 00 74 13 b8 2e 00 00 00 0f 05 <=
48> 3d 00 f0 ff ff 77 54 c3 0f 1f 00 53 48 83 ec 20 89 54 24 1c 48
> [  106.200912] RSP: 002b:00007ffe72950598 EFLAGS: 00000202 ORIG_RAX: 0000=
00000000002e
> [  106.200913] RAX: ffffffffffffffda RBX: 000055e0ceb8d180 RCX: 00007fe10=
ad2fde4
> [  106.200914] RDX: 0000000000000000 RSI: 00007ffe729505f8 RDI: 000000000=
0000005
> [  106.200915] RBP: 0000000000000000 R08: 0000000000000004 R09: 000000000=
0000001
> [  106.200915] R10: 00007ffe72950688 R11: 0000000000000202 R12: 000055e0c=
eb8d090
> [  106.200916] R13: 0000000000000000 R14: 000055e0ceb8d180 R15: 00007ffe7=
29505f8
> [  106.200918]  </TASK>
>=20
>=20
> [  106.200924] UBSAN: array-index-out-of-bounds in /var/tmp/portage/sys-k=
ernel/gentoo-kernel-6.8.9/work/linux-6.8/net/wireless/nl80211.c:9252:5
> [  106.200926] index 0 is out of range for type 'struct ieee80211_channel=
 *[]'
> [  106.200926] CPU: 11 PID: 4166 Comm: wpa_supplicant Not tainted 6.8.9-g=
entoo-dist-hardened #1
> [  106.200928] Hardware name: ASUS System Product Name/TUF GAMING B650M-P=
LUS WIFI, BIOS 2214 01/02/2024
> [  106.200928] Call Trace:
> [  106.200929]  <TASK>
> [  106.200930]  dump_stack_lvl+0x71/0x90
> [  106.200932]  __ubsan_handle_out_of_bounds+0xed/0x160
> [  106.200936]  nl80211_exit+0x7643/0x21f70 [cfg80211]
> [  106.200947]  genl_family_rcv_msg_doit+0xea/0x150
> [  106.200950]  genl_rcv_msg+0x234/0x260
> [  106.200952]  ? nl80211_exit+0x40/0x21f70 [cfg80211]
> [  106.200960]  ? nl80211_exit+0x7290/0x21f70 [cfg80211]
> [  106.200966]  ? nl80211_exit+0x290/0x21f70 [cfg80211]
> [  106.200976]  ? __cfi_genl_rcv_msg+0x10/0x10
> [  106.200978]  netlink_rcv_skb+0xff/0x140
> [  106.200981]  genl_rcv+0x28/0x40
> [  106.200982]  netlink_unicast+0x265/0x390
> [  106.200985]  netlink_sendmsg+0x381/0x440
> [  106.200988]  __sock_sendmsg+0x94/0xb0
> [  106.200990]  ____sys_sendmsg+0x1c3/0x250
> [  106.200993]  ___sys_sendmsg+0x293/0x2d0
> [  106.200994]  ? do_sock_setsockopt+0xf5/0x190
> [  106.201000]  __se_sys_sendmsg+0x102/0x140
> [  106.201003]  do_syscall_64+0x8e/0x170
> [  106.201004]  ? srso_alias_return_thunk+0x5/0xfbef5
> [  106.201006]  ? do_syscall_64+0x9a/0x170
> [  106.201010]  ? srso_alias_return_thunk+0x5/0xfbef5
> [  106.201011]  ? do_user_addr_fault+0x506/0x6b0
> [  106.201014]  ? srso_alias_return_thunk+0x5/0xfbef5
> [  106.201015]  ? srso_alias_return_thunk+0x5/0xfbef5
> [  106.201017]  entry_SYSCALL_64_after_hwframe+0x78/0x80
> [  106.201018] RIP: 0033:0x7fe10ad2fde4
> [  106.201021] Code: 89 02 b8 ff ff ff ff eb af 66 2e 0f 1f 84 00 00 00 0=
0 00 0f 1f 00 f3 0f 1e fa 80 3d 85 e5 0c 00 00 74 13 b8 2e 00 00 00 0f 05 <=
48> 3d 00 f0 ff ff 77 54 c3 0f 1f 00 53 48 83 ec 20 89 54 24 1c 48
> [  106.201022] RSP: 002b:00007ffe72950598 EFLAGS: 00000202 ORIG_RAX: 0000=
00000000002e
> [  106.201023] RAX: ffffffffffffffda RBX: 000055e0ceb8d180 RCX: 00007fe10=
ad2fde4
> [  106.201024] RDX: 0000000000000000 RSI: 00007ffe729505f8 RDI: 000000000=
0000005
> [  106.201025] RBP: 0000000000000000 R08: 0000000000000004 R09: 000000000=
0000001
> [  106.201026] R10: 00007ffe72950688 R11: 0000000000000202 R12: 000055e0c=
eb8d090
> [  106.201026] R13: 0000000000000000 R14: 000055e0ceb8d180 R15: 00007ffe7=
29505f8
> [  106.201029]  </TASK>
>=20
>=20
> [  106.201036] UBSAN: array-index-out-of-bounds in /var/tmp/portage/sys-k=
ernel/gentoo-kernel-6.8.9/work/linux-6.8/net/mac80211/scan.c:364:4
> [  106.201037] index 0 is out of range for type 'struct ieee80211_channel=
 *[]'
> [  106.201038] CPU: 11 PID: 4166 Comm: wpa_supplicant Not tainted 6.8.9-g=
entoo-dist-hardened #1
> [  106.201039] Hardware name: ASUS System Product Name/TUF GAMING B650M-P=
LUS WIFI, BIOS 2214 01/02/2024
> [  106.201040] Call Trace:
> [  106.201040]  <TASK>
> [  106.201041]  dump_stack_lvl+0x71/0x90
> [  106.201043]  __ubsan_handle_out_of_bounds+0xed/0x160
> [  106.201046]  ieee80211_sched_scan_stopped+0x42a/0x720 [mac80211]
> [  106.201062]  ? vprintk_emit+0x2b4/0x340
> [  106.201064]  ? srso_alias_return_thunk+0x5/0xfbef5
> [  106.201065]  ? __kmalloc+0x1e8/0x430
> [  106.201068]  __ieee80211_start_scan+0x4fa/0xb90 [mac80211]
> [  106.201081]  cfg80211_scan+0x22d/0x1270 [cfg80211]
> [  106.201091]  nl80211_exit+0x7bde/0x21f70 [cfg80211]
> [  106.201101]  genl_family_rcv_msg_doit+0xea/0x150
> [  106.201105]  genl_rcv_msg+0x234/0x260
> [  106.201106]  ? nl80211_exit+0x40/0x21f70 [cfg80211]
> [  106.201112]  ? nl80211_exit+0x7290/0x21f70 [cfg80211]
> [  106.201118]  ? nl80211_exit+0x290/0x21f70 [cfg80211]
> [  106.201124]  ? __cfi_genl_rcv_msg+0x10/0x10
> [  106.201125]  netlink_rcv_skb+0xff/0x140
> [  106.201128]  genl_rcv+0x28/0x40
> [  106.201129]  netlink_unicast+0x265/0x390
> [  106.201131]  netlink_sendmsg+0x381/0x440
> [  106.201133]  __sock_sendmsg+0x94/0xb0
> [  106.201134]  ____sys_sendmsg+0x1c3/0x250
> [  106.201136]  ___sys_sendmsg+0x293/0x2d0
> [  106.201137]  ? do_sock_setsockopt+0xf5/0x190
> [  106.201142]  __se_sys_sendmsg+0x102/0x140
> [  106.201145]  do_syscall_64+0x8e/0x170
> [  106.201147]  ? srso_alias_return_thunk+0x5/0xfbef5
> [  106.201148]  ? do_syscall_64+0x9a/0x170
> [  106.201152]  ? srso_alias_return_thunk+0x5/0xfbef5
> [  106.201153]  ? do_user_addr_fault+0x506/0x6b0
> [  106.201155]  ? srso_alias_return_thunk+0x5/0xfbef5
> [  106.201157]  ? srso_alias_return_thunk+0x5/0xfbef5
> [  106.201159]  entry_SYSCALL_64_after_hwframe+0x78/0x80
> [  106.201160] RIP: 0033:0x7fe10ad2fde4
> [  106.201162] Code: 89 02 b8 ff ff ff ff eb af 66 2e 0f 1f 84 00 00 00 0=
0 00 0f 1f 00 f3 0f 1e fa 80 3d 85 e5 0c 00 00 74 13 b8 2e 00 00 00 0f 05 <=
48> 3d 00 f0 ff ff 77 54 c3 0f 1f 00 53 48 83 ec 20 89 54 24 1c 48
> [  106.201163] RSP: 002b:00007ffe72950598 EFLAGS: 00000202 ORIG_RAX: 0000=
00000000002e
> [  106.201165] RAX: ffffffffffffffda RBX: 000055e0ceb8d180 RCX: 00007fe10=
ad2fde4
> [  106.201165] RDX: 0000000000000000 RSI: 00007ffe729505f8 RDI: 000000000=
0000005
> [  106.201166] RBP: 0000000000000000 R08: 0000000000000004 R09: 000000000=
0000001
> [  106.201167] R10: 00007ffe72950688 R11: 0000000000000202 R12: 000055e0c=
eb8d090
> [  106.201168] R13: 0000000000000000 R14: 000055e0ceb8d180 R15: 00007ffe7=
29505f8
> [  106.201170]  </TASK>

Thanks.

--=20
An old man doll... just what I always wanted! - Clara

--uVq9w8jupfQiwLWt
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iHUEABYKAB0WIQSSYQ6Cy7oyFNCHrUH2uYlJVVFOowUCZjwTwQAKCRD2uYlJVVFO
o3WkAQCHGn43HO2WTzTmn+NztzAimlbwnmkbpLDeCML2Zk/qjwD/bBw/OzIlKi+V
2WLVY4dUrX8Ha8koZlcToM1iGNsbSAM=
=JIIK
-----END PGP SIGNATURE-----

--uVq9w8jupfQiwLWt--