[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <12b6ac611c1a44b4eadbb1316636b7268ab66a50.camel@sipsolutions.net>
Date: Thu, 09 May 2024 10:48:17 +0200
From: Johannes Berg <johannes@...solutions.net>
To: Bagas Sanjaya <bagasdotme@...il.com>, Linux Kernel Mailing List
<linux-kernel@...r.kernel.org>, Linux Networking <netdev@...r.kernel.org>,
Linux Wireless <linux-wireless@...r.kernel.org>
Cc: Jouni Malinen <jouni.malinen@...eros.com>, "John W. Linville"
<linville@...driver.com>, Kalle Valo <kvalo@...nel.org>, Emmanuel Grumbach
<emmanuel.grumbach@...el.com>, "David S. Miller" <davem@...emloft.net>,
Eric Dumazet <edumazet@...gle.com>, Jakub Kicinski <kuba@...nel.org>, Paolo
Abeni <pabeni@...hat.com>, Jannik Glückert
<jannik.glueckert@...il.com>
Subject: Re: Fwd: UBSAN: array-index-out-of-bounds in net/wireless/nl80211.c
and net/mac80211/scan.c
On Thu, 2024-05-09 at 07:07 +0700, Bagas Sanjaya wrote:
> Hi,
>
> Jannik Glückert <jannik.glueckert@...il.com> reported on Bugzilla array index
> out-of-bounds catched by ubsan along with full kernel trace dump (see
> https://bugzilla.kernel.org/show_bug.cgi?id=218810):
>
> > I am seeing multiple array-index-out-of-bounds related to `ieee80211_channel[]` iteration.
> >
> > This is with a Mediatek MT7921 chipset.
> > I have only tested with kernel 6.8.9, but I don't see any channel index related fixes in master.
> >
> > This was discovered as part of Gentoo Hardened enabling CONFIG_UBSAN_ARRAY_BOUNDS
> >
> >
> > [ 106.194465] UBSAN: array-index-out-of-bounds in /var/tmp/portage/sys-kernel/gentoo-kernel-6.8.9/work/linux-6.8/net/wireless/nl80211.c:9203:29
> > [ 106.195063] index 42 is out of range for type 'struct ieee80211_channel *[]'
> > [ 106.200924] UBSAN: array-index-out-of-bounds in /var/tmp/portage/sys-kernel/gentoo-kernel-6.8.9/work/linux-6.8/net/wireless/nl80211.c:9252:5
> > [ 106.200926] index 0 is out of range for type 'struct ieee80211_channel *[]'
At least one of these should be fixed by
https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless.git/commit/?id=838c7b8f1f278404d9d684c34a8cb26dc41aaaa1
> > [ 106.201036] UBSAN: array-index-out-of-bounds in /var/tmp/portage/sys-kernel/gentoo-kernel-6.8.9/work/linux-6.8/net/mac80211/scan.c:364:4
> > [ 106.201037] index 0 is out of range for type 'struct ieee80211_channel *[]'
No idea about that one. Send patches.
(Seriously. If you're running with bleeding edge toolchains that pretty
much nobody has yet, send patches.)
johannes
Powered by blists - more mailing lists