Received-SPF: pass (google.com: domain of linux-wireless+bounces-7388-linux.lists.archive=gmail.com@vger.kernel.org designates 147.75.199.223 as permitted sender) client-ip=147.75.199.223;
Precedence: bulk
MIME-Version: 1.0
References: <ZjwTyGqcey0HXxTT@archie.me> <12b6ac611c1a44b4eadbb1316636b7268ab66a50.camel@sipsolutions.net>
In-Reply-To: <12b6ac611c1a44b4eadbb1316636b7268ab66a50.camel@sipsolutions.net>
From: =?UTF-8?Q?Jannik_Gl=C3=BCckert?= <jannik.glueckert@gmail.com>
Date: Thu, 9 May 2024 12:49:47 +0200
Message-ID: <CAFqe=z+bnNayKaxEnEFar28Q__yZ9Byaxe3YwtMaBEsASG2VwA@mail.gmail.com>
Subject: Re: Fwd: UBSAN: array-index-out-of-bounds in net/wireless/nl80211.c
 and net/mac80211/scan.c
To: Johannes Berg <johannes@sipsolutions.net>
Cc: Bagas Sanjaya <bagasdotme@gmail.com>, 
	Linux Kernel Mailing List <linux-kernel@vger.kernel.org>, Linux Networking <netdev@vger.kernel.org>, 
	Linux Wireless <linux-wireless@vger.kernel.org>, Jouni Malinen <jouni.malinen@atheros.com>, 
	"John W. Linville" <linville@tuxdriver.com>, Kalle Valo <kvalo@kernel.org>, 
	Emmanuel Grumbach <emmanuel.grumbach@intel.com>, "David S. Miller" <davem@davemloft.net>, 
	Eric Dumazet <edumazet@google.com>, Jakub Kicinski <kuba@kernel.org>, Paolo Abeni <pabeni@redhat.com>, 
	Sam James <sam@gentoo.org>
Content-Type: text/plain; charset="UTF-8"

Am Do., 9. Mai 2024 um 10:48 Uhr schrieb Johannes Berg
<johannes@sipsolutions.net>:
> > > [  106.194465] UBSAN: array-index-out-of-bounds in /var/tmp/portage/sys-kernel/gentoo-kernel-6.8.9/work/linux-6.8/net/wireless/nl80211.c:9203:29
> > > [  106.195063] index 42 is out of range for type 'struct ieee80211_channel *[]'
>
> > > [  106.200924] UBSAN: array-index-out-of-bounds in /var/tmp/portage/sys-kernel/gentoo-kernel-6.8.9/work/linux-6.8/net/wireless/nl80211.c:9252:5
> > > [  106.200926] index 0 is out of range for type 'struct ieee80211_channel *[]'
>
> At least one of these should be fixed by
> https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless.git/commit/?id=838c7b8f1f278404d9d684c34a8cb26dc41aaaa1

I can confirm that this fixes both, thanks.
I only looked through torvalds/linux.git, hence I missed this patch. Sorry.

> > > [  106.201036] UBSAN: array-index-out-of-bounds in /var/tmp/portage/sys-kernel/gentoo-kernel-6.8.9/work/linux-6.8/net/mac80211/scan.c:364:4
> > > [  106.201037] index 0 is out of range for type 'struct ieee80211_channel *[]'
>
> No idea about that one. Send patches.

Sadly unaffected.

> (Seriously. If you're running with bleeding edge toolchains that pretty
> much nobody has yet, send patches.)

I'm not sure what to make of this - this bug has been around ever
since the code was added, modern toolchains just happen to be one way
to expose it.
Alas, distro people are not kernel devs, so best I can do is report this :(

Cheers
Jannik