| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <75bc638e-99a8-2f3f-6260-491f8a018af6@molgen.mpg.de>
Date: Wed, 13 Dec 2017 14:25:01 +0100
From: Paul Menzel <pmenzel+linux-wireless@...gen.mpg.de>
To: Johannes Berg <johannes.berg@...el.com>,
Emmanuel Grumbach <emmanuel.grumbach@...el.com>,
Luca Coelho <luciano.coelho@...el.com>,
Intel Linux Wireless <linuxwifi@...el.com>
Cc: linux-wireless@...r.kernel.org, linux-kernel@...r.kernel.org,
it+linux-wireless@...gen.mpg.de
Subject: UBSAN: Undefined behaviour in
drivers/net/wireless/intel/iwlwifi/mvm/utils.c:838:5
Dear Linux folks,
I enabled the undefined behavior sanitizer, and built Linus’ master
branch under Ubuntu 17.10 with gcc (Ubuntu 7.2.0-8ubuntu3) 7.2.0.
```
$ grep UBSAN /boot/config-4.15.0-rc3+
CONFIG_ARCH_HAS_UBSAN_SANITIZE_ALL=y
# CONFIG_ARCH_WANTS_UBSAN_NO_NULL is not set
CONFIG_UBSAN=y
CONFIG_UBSAN_SANITIZE_ALL=y
# CONFIG_UBSAN_ALIGNMENT is not set
CONFIG_UBSAN_NULL=y
```
Starting the system the messages below are printed.
Starting the system and using the wireless device shows the messages below.
```
$ git describe --tags
v4.15-rc3-37-gd39a01eff9af
$ git log --oneline -1
d39a01eff9af (HEAD -> master, origin/master, origin/HEAD) Merge tag
'platform-drivers-x86-v4.15-3' of
git://git.infradead.org/linux-platform-drivers-x86
$ dmesg
[…]
[ 20.717777] IPv6: ADDRCONF(NETDEV_UP): wlp2s0: link is not ready
[ 23.347354] Could not find key with description: [8ac72712aa32e6df]
[ 23.347359] process_request_key_err: No key
[ 23.347361] Could not find valid key in user session keyring for sig
specified in mount option: [8ac72712aa32e6df]
[ 23.347363] One or more global auth toks could not properly register;
rc = [-2]
[ 23.347366] Error parsing options; rc = [-2]
[ 25.416104] wlp2s0: authenticate with 6c:f3:7f:10:ae:18
[ 25.423402] wlp2s0: send auth to 6c:f3:7f:10:ae:18 (try 1/3)
[ 25.434818] wlp2s0: authenticated
[ 25.436298] wlp2s0: associate with 6c:f3:7f:10:ae:18 (try 1/3)
[ 25.439399] wlp2s0: RX AssocResp from 6c:f3:7f:10:ae:18 (capab=0x411
status=0 aid=1)
[ 25.441283] wlp2s0: associated
[ 25.517382] calling crypto_ccm_module_init+0x0/0x1000 [ccm] @ 8735
[ 25.517425] initcall crypto_ccm_module_init+0x0/0x1000 [ccm] returned
0 after 23 usecs
[ 25.534281] IPv6: ADDRCONF(NETDEV_CHANGE): wlp2s0: link becomes ready
[ 26.788309] calling crypto_cmac_module_init+0x0/0x1000 [cmac] @ 8843
[ 26.788333] initcall crypto_cmac_module_init+0x0/0x1000 [cmac]
returned 0 after 7 usecs
[ 167.148167] wlp2s0: deauthenticating from 6c:f3:7f:10:ae:18 by local
choice (Reason: 3=DEAUTH_LEAVING)
[ 167.157085] wlp2s0: failed to remove key (1, ff:ff:ff:ff:ff:ff) from
hardware (-22)
[ 167.185161]
================================================================================
[ 167.185167] UBSAN: Undefined behaviour in
drivers/net/wireless/intel/iwlwifi/mvm/utils.c:838:5
[ 167.185171] shift exponent 255 is too large for 64-bit type 'long
unsigned int'
[ 167.185175] CPU: 2 PID: 2178 Comm: wpa_supplicant Not tainted
4.15.0-rc3+ #12
[ 167.185176] Hardware name: Notebook
N24_25BU/N24_25BU, BIOS 5.12 07/07/2017
[ 167.185178] Call Trace:
[ 167.185186] dump_stack+0x70/0xae
[ 167.185191] ubsan_epilogue+0x9/0x40
[ 167.185194] __ubsan_handle_shift_out_of_bounds+0x12b/0x170
[ 167.185210] ? iwl_mvm_disable_txq+0x662/0xa00 [iwlmvm]
[ 167.185213] ? _raw_spin_lock_bh+0x5/0x30
[ 167.185220] iwl_mvm_disable_txq+0x662/0xa00 [iwlmvm]
[ 167.185224] ? ftrace_graph_caller+0x68/0x98
[ 167.185238] ? iwl_mvm_send_rm_bcast_sta+0xbe/0x2c0 [iwlmvm]
[ 167.185246] iwl_mvm_send_rm_bcast_sta+0xbe/0x2c0 [iwlmvm]
[ 167.185256] iwl_mvm_rm_p2p_bcast_sta+0x31/0x110 [iwlmvm]
[ 167.185263] ? iwl_mvm_rm_p2p_bcast_sta+0x5/0x110 [iwlmvm]
[ 167.185272] iwl_mvm_mac_remove_interface+0x15d/0x1d0 [iwlmvm]
[ 167.185291] drv_remove_interface+0x5c/0x210 [mac80211]
[ 167.185309] ieee80211_do_stop+0x672/0x1070 [mac80211]
[ 167.185330] cfg80211_stop_p2p_device+0x99/0x340 [cfg80211]
[ 167.185342] ? cfg80211_stop_p2p_device+0x5/0x340 [cfg80211]
[ 167.185357] nl80211_stop_p2p_device+0x48/0xa0 [cfg80211]
[ 167.185361] genl_family_rcv_msg+0x286/0x730
[ 167.185365] ? ftrace_graph_caller+0x68/0x98
[ 167.185372] genl_rcv_msg+0x5d/0xf0
[ 167.185375] ? genl_family_rcv_msg+0x730/0x730
[ 167.185378] netlink_rcv_skb+0xa4/0x190
[ 167.185383] genl_rcv+0x24/0x40
[ 167.185385] netlink_unicast+0x1d0/0x300
[ 167.185390] netlink_sendmsg+0x35a/0x640
[ 167.185396] sock_sendmsg+0x4c/0xa0
[ 167.185400] ___sys_sendmsg+0x2db/0x440
[ 167.185404] ? fget_raw+0x10/0x10
[ 167.185407] ? sockfd_lookup_light+0x1c/0xc0
[ 167.185410] ? trace_graph_entry+0xdc/0x2b0
[ 167.185413] ? copy_msghdr_from_user+0x150/0x150
[ 167.185415] ? __sys_sendmsg+0x51/0x90
[ 167.185418] ? prepare_ftrace_return+0xaa/0x170
[ 167.185422] ? ftrace_graph_caller+0x68/0x98
[ 167.185425] ? trace_graph_entry+0xdc/0x2b0
[ 167.185432] ? __sys_sendmsg+0x51/0x90
[ 167.185434] ? ___sys_sendmsg+0x5/0x440
[ 167.185436] __sys_sendmsg+0x51/0x90
[ 167.185442] entry_SYSCALL_64_fastpath+0x1e/0x81
[ 167.185459] RIP: 0033:0x7f6335800d07
[ 167.185460] RSP: 002b:00007ffdc8c51a98 EFLAGS: 00000246 ORIG_RAX:
000000000000002e
[ 167.185463] RAX: ffffffffffffffda RBX: 0000556ebcc69550 RCX:
00007f6335800d07
[ 167.185465] RDX: 0000000000000000 RSI: 00007ffdc8c51ad0 RDI:
0000000000000007
[ 167.185466] RBP: 0000556ebcc69480 R08: 0000000000000000 R09:
0000556ebccb1e50
[ 167.185468] R10: 0000000000000007 R11: 0000000000000246 R12:
0000556ebcc694a0
[ 167.185469] R13: 0000556ebcc6ad38 R14: 0000000000000001 R15:
0000000000000000
[ 167.185476]
================================================================================
```
Please tell me, if you need anything else to address this.
Kind regards,
Paul
View attachment "config-4.15.0-rc3+" of type "text/plain" (212468 bytes)
Powered by blists - more mailing lists