Received-SPF: pass (google.com: domain of linux-wireless+bounces-7383-linux.lists.archive=gmail.com@vger.kernel.org designates 139.178.88.99 as permitted sender) client-ip=139.178.88.99;
Message-ID: <12b6ac611c1a44b4eadbb1316636b7268ab66a50.camel@sipsolutions.net>
Subject: Re: Fwd: UBSAN: array-index-out-of-bounds in net/wireless/nl80211.c
 and net/mac80211/scan.c
From: Johannes Berg <johannes@sipsolutions.net>
To: Bagas Sanjaya <bagasdotme@gmail.com>, Linux Kernel Mailing List
 <linux-kernel@vger.kernel.org>, Linux Networking <netdev@vger.kernel.org>, 
 Linux Wireless <linux-wireless@vger.kernel.org>
Cc: Jouni Malinen <jouni.malinen@atheros.com>, "John W. Linville"
 <linville@tuxdriver.com>, Kalle Valo <kvalo@kernel.org>, Emmanuel Grumbach
 <emmanuel.grumbach@intel.com>, "David S. Miller" <davem@davemloft.net>,
 Eric Dumazet <edumazet@google.com>, Jakub Kicinski <kuba@kernel.org>, Paolo
 Abeni <pabeni@redhat.com>,  Jannik =?ISO-8859-1?Q?Gl=FCckert?=
 <jannik.glueckert@gmail.com>
Date: Thu, 09 May 2024 10:48:17 +0200
In-Reply-To: <ZjwTyGqcey0HXxTT@archie.me>
References: <ZjwTyGqcey0HXxTT@archie.me>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
User-Agent: Evolution 3.50.4 (3.50.4-1.fc39) 
Precedence: bulk
MIME-Version: 1.0

On Thu, 2024-05-09 at 07:07 +0700, Bagas Sanjaya wrote:
> Hi,
>=20
> Jannik Gl=C3=BCckert <jannik.glueckert@gmail.com> reported on Bugzilla ar=
ray index
> out-of-bounds catched by ubsan along with full kernel trace dump (see
> https://bugzilla.kernel.org/show_bug.cgi?id=3D218810):
>=20
> > I am seeing multiple array-index-out-of-bounds related to `ieee80211_ch=
annel[]` iteration.
> >=20
> > This is with a Mediatek MT7921 chipset.
> > I have only tested with kernel 6.8.9, but I don't see any channel index=
 related fixes in master.
> >=20
> > This was discovered as part of Gentoo Hardened enabling CONFIG_UBSAN_AR=
RAY_BOUNDS
> >=20
> >=20
> > [  106.194465] UBSAN: array-index-out-of-bounds in /var/tmp/portage/sys=
-kernel/gentoo-kernel-6.8.9/work/linux-6.8/net/wireless/nl80211.c:9203:29
> > [  106.195063] index 42 is out of range for type 'struct ieee80211_chan=
nel *[]'

> > [  106.200924] UBSAN: array-index-out-of-bounds in /var/tmp/portage/sys=
-kernel/gentoo-kernel-6.8.9/work/linux-6.8/net/wireless/nl80211.c:9252:5
> > [  106.200926] index 0 is out of range for type 'struct ieee80211_chann=
el *[]'

At least one of these should be fixed by
https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless.git/commi=
t/?id=3D838c7b8f1f278404d9d684c34a8cb26dc41aaaa1

> > [  106.201036] UBSAN: array-index-out-of-bounds in /var/tmp/portage/sys=
-kernel/gentoo-kernel-6.8.9/work/linux-6.8/net/mac80211/scan.c:364:4
> > [  106.201037] index 0 is out of range for type 'struct ieee80211_chann=
el *[]'

No idea about that one. Send patches.

(Seriously. If you're running with bleeding edge toolchains that pretty
much nobody has yet, send patches.)

johannes