From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=100.103.45.18 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1793212900; b=wugFjhHN2IAOPYe3eTBeLx3xi8vjRo2ljyhTlkXz0kaL6EP34eV77JDqz9L0P3y+2v7A 8FBxQg9W/Sp57K/9yuF4i+JZUXD5YCAvJntJjHfzLM7qBYgJKYSEcx95Noy9gOwU5FwB5 cnZzIDmF4yxIi7IczbQ5QDBMHRGsPu7ZahlpOjeGQPySQ9/KEGuUwjI9Zgf56qN2td5OC z8hPUVx6tj2ka+im0KQnTl+FLujZS3qfPuI8Brrgyu4vPUgPz9x3Fk6Gu93PRbBMeJzHg UOFqXxX7vJ0D4G+Ts/3RyKjVmXwgSLL+9yQyiK6cI9ogtAMEh0FgWGPNPy8KBXGrJiw== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1793212900; h=Received:DKIM-Signature:From:To:Cc:Subject:Date:Message-ID:X-Mailer: In-Reply-To:References:User-Agent:X-stable:X-Patchwork-Hint: MIME-Version:Content-Transfer-Encoding; bh=gauo+tqVY4tm2e6uLAzqpoBhZqjcDD1gitFDZs/YzGg=; b=0UXvm/O9rsb6CZiLdEePg8N7jhhY3SaSE4O75VSk2WgZDMGbdnGmW2jggM15jHzhpnOd U0pd/mUrKvZBcbScooMMdfaITW+orgtIr2osY/bP4xDT+cgba8d4rHYhJT1gL/5mkRu0Z bCj0OwIrsL4WsJgbnbH4/4m5yG8TRCV8hnG9xXGYpXb7DNIU3KkQ79WUstTf1cHAkJj7d SHWhmJvzFiCLfF/tm3irBIrMdnzrFgse5unLQwgxIZkbwfRatflkEOnPVTyW2HHhJPlu1 /sysq1RwuJLcqFvH0TiH4RyYBTD/X/+7uYVepl93rcQAiT2A/pNLsKNePHhVJHogRwA== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=QTxS29pP; arc=none smtp.remote-ip=100.103.45.18 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id F0695606A332; Wed, 28 Oct 2026 18:41:39 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key, unprotected) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=QTxS29pP Received: by smtp.kernel.org (Postfix) with ESMTPSA id 051461F01825; Wed, 28 Oct 2026 18:41:38 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1793212899; bh=gauo+tqVY4tm2e6uLAzqpoBhZqjcDD1gitFDZs/YzGg=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=QTxS29pPMbfZAQvyKFoTHP/JrgyA6vMQpBbJhpRWGkzGrAQigVThjuNnAH/A4m095 2kEsSInY1TqtOnGwkmNUq8l2pIWR4oeYTH3jqQpZReT7qrXg9j3mTKFJPo2ylQWyFZ DfV1Kc5zC/BA50CdtHmmxOjLZknOOtnkXNuPDk+s= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Vega , Yuqi Xu , Ren Wei , Johannes Berg Subject: [PATCH 6.1 0316/1887] wifi: mac80211: minstrel_ht: validate fixed rate index Date: Wed, 28 Oct 2026 17:40:12 +0100 Message-ID: <20261028170506.418144886@linuxfoundation.org> X-Mailer: git-send-email 2.56.0 In-Reply-To: <20261028170459.200466217@linuxfoundation.org> References: <20261028170459.200466217@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore X-Mailing-List: patches@lists.linux.dev List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.1-stable review patch. If anyone has any objections, please let me know. ------------------ From: Yuqi Xu commit 15fb9e3cea55fbc378261ce35a32b0f8828f0000 upstream. The fixed_rate_idx debugfs file is a plain u32 attribute, so any value can be written to it. minstrel_ht_update_stats() then copies the value into mi->max_tp_rate[] and mi->max_prob_rate, and minstrel_ht_set_rate() uses MI_RATE_GROUP()/MI_RATE_IDX() to index minstrel_mcs_groups[] (42 entries) and mi->groups[].rates[] (10 entries) with it. Writing e.g. 65535 selects group 4095 and rate index 15, far outside both arrays. The out-of-bounds entries are dereferenced and updated as struct minstrel_rate_stats (retry counts, etc.), so the invalid index corrupts adjacent kernel memory. With CONFIG_UBSAN_BOUNDS the access is reported as an array-index-out-of-bounds in minstrel_ht_set_rate(). Only a valid group/rate pair, or U32_MAX to disable fixed rate processing, can be used safely, so reject any other value when the debugfs file is written. The file is only reachable through a root-only debugfs mount, so this is not a privilege boundary. The out-of-bounds access is still a bug that must not be reachable through a writable debugfs attribute. Fixes: 24f7580e852b ("minstrel_ht: fixed rate mode through debugfs") Cc: stable@vger.kernel.org Reported-by: Vega Assisted-by: LLM Signed-off-by: Yuqi Xu Reviewed-by: Ren Wei Link: https://patch.msgid.link/288e6f6d30dc82ff40da502755e6666982f6b735.1789798000.git.xuyuqiabc@gmail.com Signed-off-by: Johannes Berg Signed-off-by: Greg Kroah-Hartman --- net/mac80211/rc80211_minstrel_ht.c | 30 ++++++++++++++++++++++++++++-- 1 file changed, 28 insertions(+), 2 deletions(-) --- a/net/mac80211/rc80211_minstrel_ht.c +++ b/net/mac80211/rc80211_minstrel_ht.c @@ -7,6 +7,7 @@ #include #include #include +#include #include #include #include @@ -1977,14 +1978,39 @@ minstrel_ht_alloc(struct ieee80211_hw *h } #ifdef CONFIG_MAC80211_DEBUGFS +static int minstrel_ht_fixed_rate_idx_get(void *data, u64 *val) +{ + *val = *(u32 *)data; + return 0; +} + +static int minstrel_ht_fixed_rate_idx_set(void *data, u64 val) +{ + u32 idx = val; + + /* U32_MAX is the default and keeps fixed rate processing disabled */ + if (val != U32_MAX && + (val > U16_MAX || + MI_RATE_GROUP(idx) >= ARRAY_SIZE(minstrel_mcs_groups) || + MI_RATE_IDX(idx) >= MCS_GROUP_RATES)) + return -EINVAL; + + *(u32 *)data = idx; + return 0; +} + +DEFINE_DEBUGFS_ATTRIBUTE(minstrel_ht_fixed_rate_idx_fops, + minstrel_ht_fixed_rate_idx_get, + minstrel_ht_fixed_rate_idx_set, "%llu\n"); + static void minstrel_ht_add_debugfs(struct ieee80211_hw *hw, void *priv, struct dentry *debugfsdir) { struct minstrel_priv *mp = priv; mp->fixed_rate_idx = (u32) -1; - debugfs_create_u32("fixed_rate_idx", S_IRUGO | S_IWUGO, debugfsdir, - &mp->fixed_rate_idx); + debugfs_create_file("fixed_rate_idx", S_IRUGO | S_IWUGO, debugfsdir, + &mp->fixed_rate_idx, &minstrel_ht_fixed_rate_idx_fops); } #endif