netdev - Re: KASAN splal in minstrel_ht_update

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:	Thu, 28 Jan 2016 19:52:42 +0100
From:	Felix Fietkau <nbd@...nwrt.org>
To:	Konstantin Khlebnikov <koct9i@...il.com>,
	linux-wireless@...r.kernel.org,
	Johannes Berg <johannes@...solutions.net>
Cc:	Linux Kernel Network Developers <netdev@...r.kernel.org>,
	Thomas Huehn <thomas@....t-labs.tu-berlin.de>
Subject: Re: KASAN splal in minstrel_ht_update_stats()

On 2016-01-15 06:23, Konstantin Khlebnikov wrote:
> Jan 10 17:56:25 hamm kernel: [184374.378842]
> ==================================================================
> Jan 10 17:56:25 hamm kernel: [184374.379001] BUG: KASAN:
> slab-out-of-bounds in minstrel_ht_update_stats.isra.7+0x6e1/0x9e0
[...]
> ==================================================================
> 
> out-of-bound in
> 
> if (mrs->prob_ewma > mg->rates[mg->max_group_prob_rate].prob_ewma)
>              mg->max_group_prob_rate = index;
> 
> 
> 
> Fix should be something like this:
> 
> --- a/net/mac80211/rc80211_minstrel_ht.c
> +++ b/net/mac80211/rc80211_minstrel_ht.c
> @@ -414,15 +414,16 @@ minstrel_ht_set_best_prob_rate(struct
> minstrel_ht_sta *mi, u16 index)
>             (max_tp_group != MINSTREL_CCK_GROUP))
>                 return;
> 
> +       max_gpr_group = mg->max_group_prob_rate / MCS_GROUP_RATES;
> +       max_gpr_idx = mg->max_group_prob_rate % MCS_GROUP_RATES;
> +       max_gpr_prob = mi->groups[max_gpr_group].rates[max_gpr_idx].prob_ewma;
> +
>         if (mrs->prob_ewma > MINSTREL_FRAC(75, 100)) {
>                 cur_tp_avg = minstrel_ht_get_tp_avg(mi, cur_group, cur_idx,
>                                                     mrs->prob_ewma);
>                 if (cur_tp_avg > tmp_tp_avg)
>                         mi->max_prob_rate = index;
> 
> -               max_gpr_group = mg->max_group_prob_rate / MCS_GROUP_RATES;
> -               max_gpr_idx = mg->max_group_prob_rate % MCS_GROUP_RATES;
> -               max_gpr_prob =
> mi->groups[max_gpr_group].rates[max_gpr_idx].prob_ewma;
>                 max_gpr_tp_avg = minstrel_ht_get_tp_avg(mi, max_gpr_group,
>                                                         max_gpr_idx,
>                                                         max_gpr_prob);
> @@ -431,7 +432,7 @@ minstrel_ht_set_best_prob_rate(struct
> minstrel_ht_sta *mi, u16 index)
>         } else {
>                 if (mrs->prob_ewma > tmp_prob)
>                         mi->max_prob_rate = index;
> -               if (mrs->prob_ewma >
> mg->rates[mg->max_group_prob_rate].prob_ewma)
> +               if (mrs->prob_ewma > max_gpr_prob)
>                         mg->max_group_prob_rate = index;
>         }
>  }
Fix looks correct, but does not apply (line wrapped). Please resubmit
with a proper description and your Signed-off-by.

Thanks,

- Felix