linux-kernel - Re: UBSAN: Undefined behaviour in net/wireless/nl80211.c:718:4: -1665903437 * 100 cannot be represented in type 'int'

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 17 Jan 2018 13:22:47 +0100
From:   Paul Menzel <pmenzel+linux-wireless@...gen.mpg.de>
To:     Johannes Berg <johannes@...solutions.net>
Cc:     linux-wireless@...r.kernel.org, linux-kernel@...r.kernel.org,
        it+linux-wireless@...gen.mpg.de,
        Mario Limonciello <mario.limonciello@...l.com>,
        Thorsten Leemhuis <linux@...mhuis.info>
Subject: Re: UBSAN: Undefined behaviour in net/wireless/nl80211.c:718:4:
 -1665903437 * 100 cannot be represented in type 'int'

Dear Johannes,


On 01/04/18 16:08, Johannes Berg wrote:
> Hi,
> 
> Can you reproduce this?
> 
>> [   54.426491] UBSAN: Undefined behaviour in net/wireless/nl80211.c:718:4
>> [   54.426492] signed integer overflow:
>> [   54.426493] -1665903437 * 100 cannot be represented in type 'int'
> 
> Obviously.
> 
> However, it looks like the real reason is that there's some garbage (-
> 1665903437) in chan->max_power, which is just stack memory being leaked
> out...
> 
> This should help?
> 
> diff --git a/net/wireless/reg.c b/net/wireless/reg.c
> index 78e71b0390be..7b42f0bacfd8 100644
> --- a/net/wireless/reg.c
> +++ b/net/wireless/reg.c
> @@ -1769,8 +1769,7 @@ static void handle_reg_beacon(struct wiphy *wiphy, unsigned int chan_idx,
>   	if (wiphy->regulatory_flags & REGULATORY_DISABLE_BEACON_HINTS)
>   		return;
>   
> -	chan_before.center_freq = chan->center_freq;
> -	chan_before.flags = chan->flags;
> +	chan_before = *chan;
>   
>   	if (chan->flags & IEEE80211_CHAN_NO_IR) {
>   		chan->flags &= ~IEEE80211_CHAN_NO_IR;

Yes it does. Thank you. Rebuilding Linux 4.15-rc8+ with this patch 
applied, the UBSAN doesn’t report this issue anymore.


Kind regards,

Paul


Download attachment "smime.p7s" of type "application/pkcs7-signature" (5174 bytes)