linux-hardening - Re: UBSAN array-index-out-of-bounds: cfg80211_scan

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20241230053806.GA129354@ax162>
Date: Sun, 29 Dec 2024 22:38:06 -0700
From: Nathan Chancellor <nathan@...nel.org>
To: John Rowley <lkml@...nrowley.me>
Cc: johannes@...solutions.net, linux-wireless@...r.kernel.org,
	stable@...r.kernel.org, kees@...nel.org, gustavoars@...nel.org,
	linux-hardening@...r.kernel.org
Subject: Re: UBSAN array-index-out-of-bounds: cfg80211_scan_6ghz

Hi John,

On Sat, Dec 28, 2024 at 11:21:27AM +0000, John Rowley wrote:
> Hi, I'm experiencing UBSAN array-index-out-of-bounds errors while using
> my Framework 13" AMD laptop with its Mediatek MT7922 wifi adapter
> (mt7921e).
> 
> It seems to happen only once on boot, and occurs with both kernel
> versions 6.12.7 and 6.13-rc4, both compiled from vanilla upstream kernel 
> sources on Fedora 41 using the kernel.org LLVM toolchain (19.1.6).
> 
> I can try some other kernel series if necessary, and also a bisect if I
> find a working version, but that may take me a while.

This looks related to UBSAN_BOUNDS and the fact that version of clang
supports the __counted_by attribute. I do not have much time at the
moment to look at this but I have added Kees, Gustavo, and
linux-hardening for further analysis.

Cheers,
Nathan

> I wasn't sure if I should mark this as a regression, as I'm not sure
> which/if there is a working kernel version at this point.
> 
> Thanks.
> 
> ----
> 
> [   17.754417] UBSAN: array-index-out-of-bounds in /data/linux/net/wireless/scan.c:766:2
> [   17.754423] index 0 is out of range for type 'struct ieee80211_channel *[] __counted_by(n_channels)' (aka 'struct ieee80211_channel *[]')
> [   17.754427] CPU: 13 UID: 0 PID: 620 Comm: kworker/u64:10 Tainted: G                T  6.13.0-rc4 #9
> [   17.754433] Tainted: [T]=RANDSTRUCT
> [   17.754435] Hardware name: Framework Laptop 13 (AMD Ryzen 7040Series)/FRANMDCP07, BIOS 03.05 03/29/2024
> [   17.754438] Workqueue: events_unbound cfg80211_wiphy_work
> [   17.754446] Call Trace:
> [   17.754449]  <TASK>
> [   17.754452]  dump_stack_lvl+0x82/0xc0
> [   17.754459]  __ubsan_handle_out_of_bounds+0xe7/0x110
> [   17.754464]  ? srso_alias_return_thunk+0x5/0xfbef5
> [   17.754470]  ? __kmalloc_noprof+0x1a7/0x280
> [   17.754477]  cfg80211_scan_6ghz+0x3bb/0xfd0
> [   17.754482]  ? srso_alias_return_thunk+0x5/0xfbef5
> [   17.754486]  ? try_to_wake_up+0x368/0x4c0
> [   17.754491]  ? try_to_wake_up+0x1a9/0x4c0
> [   17.754496]  ___cfg80211_scan_done+0xa9/0x1e0
> [   17.754500]  cfg80211_wiphy_work+0xb7/0xe0
> [   17.754504]  process_scheduled_works+0x205/0x3a0
> [   17.754509]  worker_thread+0x24a/0x300
> [   17.754514]  ? __cfi_worker_thread+0x10/0x10
> [   17.754519]  kthread+0x158/0x180
> [   17.754524]  ? __cfi_kthread+0x10/0x10
> [   17.754528]  ret_from_fork+0x40/0x50
> [   17.754534]  ? __cfi_kthread+0x10/0x10
> [   17.754538]  ret_from_fork_asm+0x11/0x30
> [   17.754544]  </TASK>
>