linux-kernel - Re: UBSAN: Undefined behaviour in net/wireless/nl80211.c:718:4: -1665903437 * 100 cannot be represented in type 'int'

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <1515078514.10342.29.camel@sipsolutions.net>
Date:   Thu, 04 Jan 2018 16:08:34 +0100
From:   Johannes Berg <johannes@...solutions.net>
To:     Paul Menzel <pmenzel+linux-wireless@...gen.mpg.de>
Cc:     linux-wireless@...r.kernel.org, linux-kernel@...r.kernel.org,
        it+linux-wireless@...gen.mpg.de,
        Mario Limonciello <mario.limonciello@...l.com>,
        Thorsten Leemhuis <linux@...mhuis.info>
Subject: Re: UBSAN: Undefined behaviour in net/wireless/nl80211.c:718:4:
 -1665903437 * 100 cannot be represented in type 'int'

Hi,

Can you reproduce this?

> [   54.426491] UBSAN: Undefined behaviour in net/wireless/nl80211.c:718:4
> [   54.426492] signed integer overflow:
> [   54.426493] -1665903437 * 100 cannot be represented in type 'int'

Obviously.

However, it looks like the real reason is that there's some garbage (-
1665903437) in chan->max_power, which is just stack memory being leaked
out...

This should help?

diff --git a/net/wireless/reg.c b/net/wireless/reg.c
index 78e71b0390be..7b42f0bacfd8 100644
--- a/net/wireless/reg.c
+++ b/net/wireless/reg.c
@@ -1769,8 +1769,7 @@ static void handle_reg_beacon(struct wiphy *wiphy, unsigned int chan_idx,
 	if (wiphy->regulatory_flags & REGULATORY_DISABLE_BEACON_HINTS)
 		return;
 
-	chan_before.center_freq = chan->center_freq;
-	chan_before.flags = chan->flags;
+	chan_before = *chan;
 
 	if (chan->flags & IEEE80211_CHAN_NO_IR) {
 		chan->flags &= ~IEEE80211_CHAN_NO_IR;

johannes