Re: UBSAN array-index-out-of-bounds: cfg80211_scan_6ghz

Re: UBSAN array-index-out-of-bounds: cfg80211_scan_6ghz

[Nathan Chancellor]

Hi John,

On Sat, Dec 28, 2024 at 11:21:27AM +0000, John Rowley wrote:
> Hi, I'm experiencing UBSAN array-index-out-of-bounds errors while using
> my Framework 13" AMD laptop with its Mediatek MT7922 wifi adapter
> (mt7921e).
> 
> It seems to happen only once on boot, and occurs with both kernel
> versions 6.12.7 and 6.13-rc4, both compiled from vanilla upstream kernel 
> sources on Fedora 41 using the kernel.org LLVM toolchain (19.1.6).
> 
> I can try some other kernel series if necessary, and also a bisect if I
> find a working version, but that may take me a while.

This looks related to UBSAN_BOUNDS and the fact that version of clang
supports the __counted_by attribute. I do not have much time at the
moment to look at this but I have added Kees, Gustavo, and
linux-hardening for further analysis.

Cheers,
Nathan

> I wasn't sure if I should mark this as a regression, as I'm not sure
> which/if there is a working kernel version at this point.
> 
> Thanks.
> 
> ----
> 
> [   17.754417] UBSAN: array-index-out-of-bounds in /data/linux/net/wireless/scan.c:766:2
> [   17.754423] index 0 is out of range for type 'struct ieee80211_channel *[] __counted_by(n_channels)' (aka 'struct ieee80211_channel *[]')
> [   17.754427] CPU: 13 UID: 0 PID: 620 Comm: kworker/u64:10 Tainted: G                T  6.13.0-rc4 #9
> [   17.754433] Tainted: [T]=RANDSTRUCT
> [   17.754435] Hardware name: Framework Laptop 13 (AMD Ryzen 7040Series)/FRANMDCP07, BIOS 03.05 03/29/2024
> [   17.754438] Workqueue: events_unbound cfg80211_wiphy_work
> [   17.754446] Call Trace:
> [   17.754449]  <TASK>
> [   17.754452]  dump_stack_lvl+0x82/0xc0
> [   17.754459]  __ubsan_handle_out_of_bounds+0xe7/0x110
> [   17.754464]  ? srso_alias_return_thunk+0x5/0xfbef5
> [   17.754470]  ? __kmalloc_noprof+0x1a7/0x280
> [   17.754477]  cfg80211_scan_6ghz+0x3bb/0xfd0
> [   17.754482]  ? srso_alias_return_thunk+0x5/0xfbef5
> [   17.754486]  ? try_to_wake_up+0x368/0x4c0
> [   17.754491]  ? try_to_wake_up+0x1a9/0x4c0
> [   17.754496]  ___cfg80211_scan_done+0xa9/0x1e0
> [   17.754500]  cfg80211_wiphy_work+0xb7/0xe0
> [   17.754504]  process_scheduled_works+0x205/0x3a0
> [   17.754509]  worker_thread+0x24a/0x300
> [   17.754514]  ? __cfi_worker_thread+0x10/0x10
> [   17.754519]  kthread+0x158/0x180
> [   17.754524]  ? __cfi_kthread+0x10/0x10
> [   17.754528]  ret_from_fork+0x40/0x50
> [   17.754534]  ? __cfi_kthread+0x10/0x10
> [   17.754538]  ret_from_fork_asm+0x11/0x30
> [   17.754544]  </TASK>
> 

Re: UBSAN array-index-out-of-bounds: cfg80211_scan_6ghz

[Kees Cook]

On Sun, Dec 29, 2024 at 10:38:06PM -0700, Nathan Chancellor wrote:
> Hi John,
> 
> On Sat, Dec 28, 2024 at 11:21:27AM +0000, John Rowley wrote:
> > Hi, I'm experiencing UBSAN array-index-out-of-bounds errors while using
> > my Framework 13" AMD laptop with its Mediatek MT7922 wifi adapter
> > (mt7921e).
> > 
> > It seems to happen only once on boot, and occurs with both kernel
> > versions 6.12.7 and 6.13-rc4, both compiled from vanilla upstream kernel 
> > sources on Fedora 41 using the kernel.org LLVM toolchain (19.1.6).
> > 
> > I can try some other kernel series if necessary, and also a bisect if I
> > find a working version, but that may take me a while.
> 
> This looks related to UBSAN_BOUNDS and the fact that version of clang
> supports the __counted_by attribute. I do not have much time at the
> moment to look at this but I have added Kees, Gustavo, and
> linux-hardening for further analysis.
> 
> Cheers,
> Nathan
> 
> > I wasn't sure if I should mark this as a regression, as I'm not sure
> > which/if there is a working kernel version at this point.
> > 
> > Thanks.
> > 
> > ----
> > 
> > [   17.754417] UBSAN: array-index-out-of-bounds in /data/linux/net/wireless/scan.c:766:2
> > [   17.754423] index 0 is out of range for type 'struct ieee80211_channel *[] __counted_by(n_channels)' (aka 'struct ieee80211_channel *[]')

This is this line:

        request->channels[n_channels] = chan;

and later:

        request->n_channels++;

Patch should be:

diff --git a/net/wireless/scan.c b/net/wireless/scan.c
index 1c6fd45aa809..ccdbeb604639 100644
--- a/net/wireless/scan.c
+++ b/net/wireless/scan.c
@@ -763,12 +763,11 @@ static  void cfg80211_scan_req_add_chan(struct cfg80211_scan_request *request,
 		}
 	}
 
+	request->n_channels++;
 	request->channels[n_channels] = chan;
 	if (add_to_6ghz)
 		request->scan_6ghz_params[request->n_6ghz_params].channel_idx =
 			n_channels;
-
-	request->n_channels++;
 }
 
 static bool cfg80211_find_ssid_match(struct cfg80211_colocated_ap *ap,


-- 
Kees Cook

Re: UBSAN array-index-out-of-bounds: cfg80211_scan_6ghz

[John Rowley]

----------------------------------------

From: Kees Cook <kees@kernel.org>
To: Nathan Chancellor <nathan@kernel.org>
CC: John Rowley <lkml@johnrowley.me>; johannes@sipsolutions.net; linux-wireless@vger.kernel.org; stable@vger.kernel.org; gustavoars@kernel.org; linux-hardening@vger.kernel.org
Date: 30 Dec 2024 18:35:34
Subject: Re: UBSAN array-index-out-of-bounds: cfg80211_scan_6ghz

> On Sun, Dec 29, 2024 at 10:38:06PM -0700, Nathan Chancellor wrote:
>> Hi John,
>> 
>> On Sat, Dec 28, 2024 at 11:21:27AM +0000, John Rowley wrote:
>>> Hi, I'm experiencing UBSAN array-index-out-of-bounds errors while using
>>> my Framework 13" AMD laptop with its Mediatek MT7922 wifi adapter
>>> (mt7921e).
>>> 
>>> It seems to happen only once on boot, and occurs with both kernel
>>> versions 6.12.7 and 6.13-rc4, both compiled from vanilla upstream kernel
>>> sources on Fedora 41 using the kernel.org LLVM toolchain (19.1.6).
>>> 
>>> I can try some other kernel series if necessary, and also a bisect if I
>>> find a working version, but that may take me a while.
>> 
>> This looks related to UBSAN_BOUNDS and the fact that version of clang
>> supports the __counted_by attribute. I do not have much time at the
>> moment to look at this but I have added Kees, Gustavo, and
>> linux-hardening for further analysis.
>> 
>> Cheers,
>> Nathan
>> 
>>> I wasn't sure if I should mark this as a regression, as I'm not sure
>>> which/if there is a working kernel version at this point.
>>> 
>>> Thanks.
>>> 
>>> ----
>>> 
>>> [   17.754417] UBSAN: array-index-out-of-bounds in /data/linux/net/wireless/scan.c:766:2
>>> [   17.754423] index 0 is out of range for type 'struct ieee80211_channel *[] __counted_by(n_channels)' (aka 'struct ieee80211_channel *[]')
> 
> This is this line:
> 
>         request->channels[n_channels] = chan;
> 
> and later:
> 
>         request->n_channels++;
> 
> Patch should be:
> 
> diff --git a/net/wireless/scan.c b/net/wireless/scan.c
> index 1c6fd45aa809..ccdbeb604639 100644
> --- a/net/wireless/scan.c
> +++ b/net/wireless/scan.c
> @@ -763,12 +763,11 @@ static  void cfg80211_scan_req_add_chan(struct cfg80211_scan_request *request,
>         }
>     }
> 
> +   request->n_channels++;
>     request->channels[n_channels] = chan;
>     if (add_to_6ghz)
>         request->scan_6ghz_params[request->n_6ghz_params].channel_idx =
>             n_channels;
> -
> -   request->n_channels++;
> }
> 
> static bool cfg80211_find_ssid_match(struct cfg80211_colocated_ap *ap,
> 
> 
> -- 
> Kees Cook
Apologies for not replying sooner but the above patch works perfectly. Thanks!