linux-kernel - Re: UBSAN array-index-out-of-bounds in ath5k driver

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <871fce95-f7e4-439b-be4c-4037d4f0088b@debian.org>
Date: Mon, 3 Nov 2025 08:26:44 +0100
From: Vincent Danjean <vdanjean@...ian.org>
To: Jiri Slaby <jirislaby@...nel.org>,
 Salvatore Bonaccorso <carnil@...ian.org>,
 Nick Kossifidis <mickflemm@...il.com>, Luis Chamberlain <mcgrof@...nel.org>
Cc: linux-wireless@...r.kernel.org, linux-kernel@...r.kernel.org,
 1119093@...s.debian.org
Subject: Re: UBSAN array-index-out-of-bounds in ath5k driver

Le 03/11/2025 à 08:04, Jiri Slaby a écrit :
> This™:
> --- a/drivers/net/wireless/ath/ath5k/base.c
> +++ b/drivers/net/wireless/ath/ath5k/base.c
> @@ -1738,7 +1738,8 @@ ath5k_tx_frame_completed(struct ath5k_hw *ah, struct sk_buff *skb,
>          }
> 
>          info->status.rates[ts->ts_final_idx].count = ts->ts_final_retry;
> -       info->status.rates[ts->ts_final_idx + 1].idx = -1;
> +       if (ts->ts_final_idx + 1 < IEEE80211_TX_MAX_RATES)
> +               info->status.rates[ts->ts_final_idx + 1].idx = -1;
> 
>          if (unlikely(ts->ts_status)) {
>                  ah->stats.ack_fail++;
> 
> Vincent, can you test this?

It is not easy for me: the computer with this wifi card is in my parent's home.
I won't go back there until Christmas.

I will see if I can test remotely.

   Regards,
     Vincent

>> FWIW, the effect of the UB is it just overwrites the next member of info->status, i.e. ack_signal.
>>
>> thanks,
>