| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Thu, 9 May 2024 07:07:36 +0700
From: Bagas Sanjaya <bagasdotme@...il.com>
To: Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
Linux Networking <netdev@...r.kernel.org>,
Linux Wireless <linux-wireless@...r.kernel.org>
Cc: Jouni Malinen <jouni.malinen@...eros.com>,
"John W. Linville" <linville@...driver.com>,
Kalle Valo <kvalo@...nel.org>,
Johannes Berg <johannes@...solutions.net>,
Emmanuel Grumbach <emmanuel.grumbach@...el.com>,
"David S. Miller" <davem@...emloft.net>,
Eric Dumazet <edumazet@...gle.com>,
Jakub Kicinski <kuba@...nel.org>, Paolo Abeni <pabeni@...hat.com>,
Jannik Glückert <jannik.glueckert@...il.com>
Subject: Fwd: UBSAN: array-index-out-of-bounds in net/wireless/nl80211.c and
net/mac80211/scan.c
Hi,
Jannik Glückert <jannik.glueckert@...il.com> reported on Bugzilla array index
out-of-bounds catched by ubsan along with full kernel trace dump (see
https://bugzilla.kernel.org/show_bug.cgi?id=218810):
> I am seeing multiple array-index-out-of-bounds related to `ieee80211_channel[]` iteration.
>
> This is with a Mediatek MT7921 chipset.
> I have only tested with kernel 6.8.9, but I don't see any channel index related fixes in master.
>
> This was discovered as part of Gentoo Hardened enabling CONFIG_UBSAN_ARRAY_BOUNDS
>
>
> [ 106.194465] UBSAN: array-index-out-of-bounds in /var/tmp/portage/sys-kernel/gentoo-kernel-6.8.9/work/linux-6.8/net/wireless/nl80211.c:9203:29
> [ 106.195063] index 42 is out of range for type 'struct ieee80211_channel *[]'
> [ 106.195599] CPU: 11 PID: 4166 Comm: wpa_supplicant Not tainted 6.8.9-gentoo-dist-hardened #1
> [ 106.196038] Hardware name: ASUS System Product Name/TUF GAMING B650M-PLUS WIFI, BIOS 2214 01/02/2024
> [ 106.196485] Call Trace:
> [ 106.196913] <TASK>
> [ 106.197439] dump_stack_lvl+0x71/0x90
> [ 106.197899] __ubsan_handle_out_of_bounds+0xed/0x160
> [ 106.198420] nl80211_exit+0x7c3f/0x21f70 [cfg80211]
> [ 106.198917] genl_family_rcv_msg_doit+0xea/0x150
> [ 106.198922] genl_rcv_msg+0x234/0x260
> [ 106.198923] ? nl80211_exit+0x40/0x21f70 [cfg80211]
> [ 106.198930] ? nl80211_exit+0x7290/0x21f70 [cfg80211]
> [ 106.200847] ? nl80211_exit+0x290/0x21f70 [cfg80211]
> [ 106.200854] ? __cfi_genl_rcv_msg+0x10/0x10
> [ 106.200856] netlink_rcv_skb+0xff/0x140
> [ 106.200859] genl_rcv+0x28/0x40
> [ 106.200860] netlink_unicast+0x265/0x390
> [ 106.200862] netlink_sendmsg+0x381/0x440
> [ 106.200865] __sock_sendmsg+0x94/0xb0
> [ 106.200868] ____sys_sendmsg+0x1c3/0x250
> [ 106.200871] ___sys_sendmsg+0x293/0x2d0
> [ 106.200873] ? do_sock_setsockopt+0xf5/0x190
> [ 106.200879] __se_sys_sendmsg+0x102/0x140
> [ 106.200882] do_syscall_64+0x8e/0x170
> [ 106.200884] ? srso_alias_return_thunk+0x5/0xfbef5
> [ 106.200886] ? do_syscall_64+0x9a/0x170
> [ 106.200889] ? srso_alias_return_thunk+0x5/0xfbef5
> [ 106.200890] ? do_user_addr_fault+0x506/0x6b0
> [ 106.200892] ? srso_alias_return_thunk+0x5/0xfbef5
> [ 106.200893] ? srso_alias_return_thunk+0x5/0xfbef5
> [ 106.200895] entry_SYSCALL_64_after_hwframe+0x78/0x80
> [ 106.200896] RIP: 0033:0x7fe10ad2fde4
> [ 106.200911] Code: 89 02 b8 ff ff ff ff eb af 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 f3 0f 1e fa 80 3d 85 e5 0c 00 00 74 13 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 54 c3 0f 1f 00 53 48 83 ec 20 89 54 24 1c 48
> [ 106.200912] RSP: 002b:00007ffe72950598 EFLAGS: 00000202 ORIG_RAX: 000000000000002e
> [ 106.200913] RAX: ffffffffffffffda RBX: 000055e0ceb8d180 RCX: 00007fe10ad2fde4
> [ 106.200914] RDX: 0000000000000000 RSI: 00007ffe729505f8 RDI: 0000000000000005
> [ 106.200915] RBP: 0000000000000000 R08: 0000000000000004 R09: 0000000000000001
> [ 106.200915] R10: 00007ffe72950688 R11: 0000000000000202 R12: 000055e0ceb8d090
> [ 106.200916] R13: 0000000000000000 R14: 000055e0ceb8d180 R15: 00007ffe729505f8
> [ 106.200918] </TASK>
>
>
> [ 106.200924] UBSAN: array-index-out-of-bounds in /var/tmp/portage/sys-kernel/gentoo-kernel-6.8.9/work/linux-6.8/net/wireless/nl80211.c:9252:5
> [ 106.200926] index 0 is out of range for type 'struct ieee80211_channel *[]'
> [ 106.200926] CPU: 11 PID: 4166 Comm: wpa_supplicant Not tainted 6.8.9-gentoo-dist-hardened #1
> [ 106.200928] Hardware name: ASUS System Product Name/TUF GAMING B650M-PLUS WIFI, BIOS 2214 01/02/2024
> [ 106.200928] Call Trace:
> [ 106.200929] <TASK>
> [ 106.200930] dump_stack_lvl+0x71/0x90
> [ 106.200932] __ubsan_handle_out_of_bounds+0xed/0x160
> [ 106.200936] nl80211_exit+0x7643/0x21f70 [cfg80211]
> [ 106.200947] genl_family_rcv_msg_doit+0xea/0x150
> [ 106.200950] genl_rcv_msg+0x234/0x260
> [ 106.200952] ? nl80211_exit+0x40/0x21f70 [cfg80211]
> [ 106.200960] ? nl80211_exit+0x7290/0x21f70 [cfg80211]
> [ 106.200966] ? nl80211_exit+0x290/0x21f70 [cfg80211]
> [ 106.200976] ? __cfi_genl_rcv_msg+0x10/0x10
> [ 106.200978] netlink_rcv_skb+0xff/0x140
> [ 106.200981] genl_rcv+0x28/0x40
> [ 106.200982] netlink_unicast+0x265/0x390
> [ 106.200985] netlink_sendmsg+0x381/0x440
> [ 106.200988] __sock_sendmsg+0x94/0xb0
> [ 106.200990] ____sys_sendmsg+0x1c3/0x250
> [ 106.200993] ___sys_sendmsg+0x293/0x2d0
> [ 106.200994] ? do_sock_setsockopt+0xf5/0x190
> [ 106.201000] __se_sys_sendmsg+0x102/0x140
> [ 106.201003] do_syscall_64+0x8e/0x170
> [ 106.201004] ? srso_alias_return_thunk+0x5/0xfbef5
> [ 106.201006] ? do_syscall_64+0x9a/0x170
> [ 106.201010] ? srso_alias_return_thunk+0x5/0xfbef5
> [ 106.201011] ? do_user_addr_fault+0x506/0x6b0
> [ 106.201014] ? srso_alias_return_thunk+0x5/0xfbef5
> [ 106.201015] ? srso_alias_return_thunk+0x5/0xfbef5
> [ 106.201017] entry_SYSCALL_64_after_hwframe+0x78/0x80
> [ 106.201018] RIP: 0033:0x7fe10ad2fde4
> [ 106.201021] Code: 89 02 b8 ff ff ff ff eb af 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 f3 0f 1e fa 80 3d 85 e5 0c 00 00 74 13 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 54 c3 0f 1f 00 53 48 83 ec 20 89 54 24 1c 48
> [ 106.201022] RSP: 002b:00007ffe72950598 EFLAGS: 00000202 ORIG_RAX: 000000000000002e
> [ 106.201023] RAX: ffffffffffffffda RBX: 000055e0ceb8d180 RCX: 00007fe10ad2fde4
> [ 106.201024] RDX: 0000000000000000 RSI: 00007ffe729505f8 RDI: 0000000000000005
> [ 106.201025] RBP: 0000000000000000 R08: 0000000000000004 R09: 0000000000000001
> [ 106.201026] R10: 00007ffe72950688 R11: 0000000000000202 R12: 000055e0ceb8d090
> [ 106.201026] R13: 0000000000000000 R14: 000055e0ceb8d180 R15: 00007ffe729505f8
> [ 106.201029] </TASK>
>
>
> [ 106.201036] UBSAN: array-index-out-of-bounds in /var/tmp/portage/sys-kernel/gentoo-kernel-6.8.9/work/linux-6.8/net/mac80211/scan.c:364:4
> [ 106.201037] index 0 is out of range for type 'struct ieee80211_channel *[]'
> [ 106.201038] CPU: 11 PID: 4166 Comm: wpa_supplicant Not tainted 6.8.9-gentoo-dist-hardened #1
> [ 106.201039] Hardware name: ASUS System Product Name/TUF GAMING B650M-PLUS WIFI, BIOS 2214 01/02/2024
> [ 106.201040] Call Trace:
> [ 106.201040] <TASK>
> [ 106.201041] dump_stack_lvl+0x71/0x90
> [ 106.201043] __ubsan_handle_out_of_bounds+0xed/0x160
> [ 106.201046] ieee80211_sched_scan_stopped+0x42a/0x720 [mac80211]
> [ 106.201062] ? vprintk_emit+0x2b4/0x340
> [ 106.201064] ? srso_alias_return_thunk+0x5/0xfbef5
> [ 106.201065] ? __kmalloc+0x1e8/0x430
> [ 106.201068] __ieee80211_start_scan+0x4fa/0xb90 [mac80211]
> [ 106.201081] cfg80211_scan+0x22d/0x1270 [cfg80211]
> [ 106.201091] nl80211_exit+0x7bde/0x21f70 [cfg80211]
> [ 106.201101] genl_family_rcv_msg_doit+0xea/0x150
> [ 106.201105] genl_rcv_msg+0x234/0x260
> [ 106.201106] ? nl80211_exit+0x40/0x21f70 [cfg80211]
> [ 106.201112] ? nl80211_exit+0x7290/0x21f70 [cfg80211]
> [ 106.201118] ? nl80211_exit+0x290/0x21f70 [cfg80211]
> [ 106.201124] ? __cfi_genl_rcv_msg+0x10/0x10
> [ 106.201125] netlink_rcv_skb+0xff/0x140
> [ 106.201128] genl_rcv+0x28/0x40
> [ 106.201129] netlink_unicast+0x265/0x390
> [ 106.201131] netlink_sendmsg+0x381/0x440
> [ 106.201133] __sock_sendmsg+0x94/0xb0
> [ 106.201134] ____sys_sendmsg+0x1c3/0x250
> [ 106.201136] ___sys_sendmsg+0x293/0x2d0
> [ 106.201137] ? do_sock_setsockopt+0xf5/0x190
> [ 106.201142] __se_sys_sendmsg+0x102/0x140
> [ 106.201145] do_syscall_64+0x8e/0x170
> [ 106.201147] ? srso_alias_return_thunk+0x5/0xfbef5
> [ 106.201148] ? do_syscall_64+0x9a/0x170
> [ 106.201152] ? srso_alias_return_thunk+0x5/0xfbef5
> [ 106.201153] ? do_user_addr_fault+0x506/0x6b0
> [ 106.201155] ? srso_alias_return_thunk+0x5/0xfbef5
> [ 106.201157] ? srso_alias_return_thunk+0x5/0xfbef5
> [ 106.201159] entry_SYSCALL_64_after_hwframe+0x78/0x80
> [ 106.201160] RIP: 0033:0x7fe10ad2fde4
> [ 106.201162] Code: 89 02 b8 ff ff ff ff eb af 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 f3 0f 1e fa 80 3d 85 e5 0c 00 00 74 13 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 54 c3 0f 1f 00 53 48 83 ec 20 89 54 24 1c 48
> [ 106.201163] RSP: 002b:00007ffe72950598 EFLAGS: 00000202 ORIG_RAX: 000000000000002e
> [ 106.201165] RAX: ffffffffffffffda RBX: 000055e0ceb8d180 RCX: 00007fe10ad2fde4
> [ 106.201165] RDX: 0000000000000000 RSI: 00007ffe729505f8 RDI: 0000000000000005
> [ 106.201166] RBP: 0000000000000000 R08: 0000000000000004 R09: 0000000000000001
> [ 106.201167] R10: 00007ffe72950688 R11: 0000000000000202 R12: 000055e0ceb8d090
> [ 106.201168] R13: 0000000000000000 R14: 000055e0ceb8d180 R15: 00007ffe729505f8
> [ 106.201170] </TASK>
Thanks.
--
An old man doll... just what I always wanted! - Clara
Download attachment "signature.asc" of type "application/pgp-signature" (229 bytes)
Powered by blists - more mailing lists