* UBSAN array-index-out-of-bounds: cfg80211_scan_6ghz
@ 2024-12-28 11:21 John Rowley
2024-12-30 5:38 ` Nathan Chancellor
0 siblings, 1 reply; 4+ messages in thread
From: John Rowley @ 2024-12-28 11:21 UTC (permalink / raw)
To: johannes, linux-wireless; +Cc: stable
Hi, I'm experiencing UBSAN array-index-out-of-bounds errors while using
my Framework 13" AMD laptop with its Mediatek MT7922 wifi adapter
(mt7921e).
It seems to happen only once on boot, and occurs with both kernel
versions 6.12.7 and 6.13-rc4, both compiled from vanilla upstream kernel
sources on Fedora 41 using the kernel.org LLVM toolchain (19.1.6).
I can try some other kernel series if necessary, and also a bisect if I
find a working version, but that may take me a while.
I wasn't sure if I should mark this as a regression, as I'm not sure
which/if there is a working kernel version at this point.
Thanks.
----
[ 17.754417] UBSAN: array-index-out-of-bounds in /data/linux/net/wireless/scan.c:766:2
[ 17.754423] index 0 is out of range for type 'struct ieee80211_channel *[] __counted_by(n_channels)' (aka 'struct ieee80211_channel *[]')
[ 17.754427] CPU: 13 UID: 0 PID: 620 Comm: kworker/u64:10 Tainted: G T 6.13.0-rc4 #9
[ 17.754433] Tainted: [T]=RANDSTRUCT
[ 17.754435] Hardware name: Framework Laptop 13 (AMD Ryzen 7040Series)/FRANMDCP07, BIOS 03.05 03/29/2024
[ 17.754438] Workqueue: events_unbound cfg80211_wiphy_work
[ 17.754446] Call Trace:
[ 17.754449] <TASK>
[ 17.754452] dump_stack_lvl+0x82/0xc0
[ 17.754459] __ubsan_handle_out_of_bounds+0xe7/0x110
[ 17.754464] ? srso_alias_return_thunk+0x5/0xfbef5
[ 17.754470] ? __kmalloc_noprof+0x1a7/0x280
[ 17.754477] cfg80211_scan_6ghz+0x3bb/0xfd0
[ 17.754482] ? srso_alias_return_thunk+0x5/0xfbef5
[ 17.754486] ? try_to_wake_up+0x368/0x4c0
[ 17.754491] ? try_to_wake_up+0x1a9/0x4c0
[ 17.754496] ___cfg80211_scan_done+0xa9/0x1e0
[ 17.754500] cfg80211_wiphy_work+0xb7/0xe0
[ 17.754504] process_scheduled_works+0x205/0x3a0
[ 17.754509] worker_thread+0x24a/0x300
[ 17.754514] ? __cfi_worker_thread+0x10/0x10
[ 17.754519] kthread+0x158/0x180
[ 17.754524] ? __cfi_kthread+0x10/0x10
[ 17.754528] ret_from_fork+0x40/0x50
[ 17.754534] ? __cfi_kthread+0x10/0x10
[ 17.754538] ret_from_fork_asm+0x11/0x30
[ 17.754544] </TASK>
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: UBSAN array-index-out-of-bounds: cfg80211_scan_6ghz
2024-12-28 11:21 UBSAN array-index-out-of-bounds: cfg80211_scan_6ghz John Rowley
@ 2024-12-30 5:38 ` Nathan Chancellor
2024-12-30 18:35 ` Kees Cook
0 siblings, 1 reply; 4+ messages in thread
From: Nathan Chancellor @ 2024-12-30 5:38 UTC (permalink / raw)
To: John Rowley
Cc: johannes, linux-wireless, stable, kees, gustavoars,
linux-hardening
Hi John,
On Sat, Dec 28, 2024 at 11:21:27AM +0000, John Rowley wrote:
> Hi, I'm experiencing UBSAN array-index-out-of-bounds errors while using
> my Framework 13" AMD laptop with its Mediatek MT7922 wifi adapter
> (mt7921e).
>
> It seems to happen only once on boot, and occurs with both kernel
> versions 6.12.7 and 6.13-rc4, both compiled from vanilla upstream kernel
> sources on Fedora 41 using the kernel.org LLVM toolchain (19.1.6).
>
> I can try some other kernel series if necessary, and also a bisect if I
> find a working version, but that may take me a while.
This looks related to UBSAN_BOUNDS and the fact that version of clang
supports the __counted_by attribute. I do not have much time at the
moment to look at this but I have added Kees, Gustavo, and
linux-hardening for further analysis.
Cheers,
Nathan
> I wasn't sure if I should mark this as a regression, as I'm not sure
> which/if there is a working kernel version at this point.
>
> Thanks.
>
> ----
>
> [ 17.754417] UBSAN: array-index-out-of-bounds in /data/linux/net/wireless/scan.c:766:2
> [ 17.754423] index 0 is out of range for type 'struct ieee80211_channel *[] __counted_by(n_channels)' (aka 'struct ieee80211_channel *[]')
> [ 17.754427] CPU: 13 UID: 0 PID: 620 Comm: kworker/u64:10 Tainted: G T 6.13.0-rc4 #9
> [ 17.754433] Tainted: [T]=RANDSTRUCT
> [ 17.754435] Hardware name: Framework Laptop 13 (AMD Ryzen 7040Series)/FRANMDCP07, BIOS 03.05 03/29/2024
> [ 17.754438] Workqueue: events_unbound cfg80211_wiphy_work
> [ 17.754446] Call Trace:
> [ 17.754449] <TASK>
> [ 17.754452] dump_stack_lvl+0x82/0xc0
> [ 17.754459] __ubsan_handle_out_of_bounds+0xe7/0x110
> [ 17.754464] ? srso_alias_return_thunk+0x5/0xfbef5
> [ 17.754470] ? __kmalloc_noprof+0x1a7/0x280
> [ 17.754477] cfg80211_scan_6ghz+0x3bb/0xfd0
> [ 17.754482] ? srso_alias_return_thunk+0x5/0xfbef5
> [ 17.754486] ? try_to_wake_up+0x368/0x4c0
> [ 17.754491] ? try_to_wake_up+0x1a9/0x4c0
> [ 17.754496] ___cfg80211_scan_done+0xa9/0x1e0
> [ 17.754500] cfg80211_wiphy_work+0xb7/0xe0
> [ 17.754504] process_scheduled_works+0x205/0x3a0
> [ 17.754509] worker_thread+0x24a/0x300
> [ 17.754514] ? __cfi_worker_thread+0x10/0x10
> [ 17.754519] kthread+0x158/0x180
> [ 17.754524] ? __cfi_kthread+0x10/0x10
> [ 17.754528] ret_from_fork+0x40/0x50
> [ 17.754534] ? __cfi_kthread+0x10/0x10
> [ 17.754538] ret_from_fork_asm+0x11/0x30
> [ 17.754544] </TASK>
>
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: UBSAN array-index-out-of-bounds: cfg80211_scan_6ghz
2024-12-30 5:38 ` Nathan Chancellor
@ 2024-12-30 18:35 ` Kees Cook
2025-01-14 11:37 ` John Rowley
0 siblings, 1 reply; 4+ messages in thread
From: Kees Cook @ 2024-12-30 18:35 UTC (permalink / raw)
To: Nathan Chancellor
Cc: John Rowley, johannes, linux-wireless, stable, gustavoars,
linux-hardening
On Sun, Dec 29, 2024 at 10:38:06PM -0700, Nathan Chancellor wrote:
> Hi John,
>
> On Sat, Dec 28, 2024 at 11:21:27AM +0000, John Rowley wrote:
> > Hi, I'm experiencing UBSAN array-index-out-of-bounds errors while using
> > my Framework 13" AMD laptop with its Mediatek MT7922 wifi adapter
> > (mt7921e).
> >
> > It seems to happen only once on boot, and occurs with both kernel
> > versions 6.12.7 and 6.13-rc4, both compiled from vanilla upstream kernel
> > sources on Fedora 41 using the kernel.org LLVM toolchain (19.1.6).
> >
> > I can try some other kernel series if necessary, and also a bisect if I
> > find a working version, but that may take me a while.
>
> This looks related to UBSAN_BOUNDS and the fact that version of clang
> supports the __counted_by attribute. I do not have much time at the
> moment to look at this but I have added Kees, Gustavo, and
> linux-hardening for further analysis.
>
> Cheers,
> Nathan
>
> > I wasn't sure if I should mark this as a regression, as I'm not sure
> > which/if there is a working kernel version at this point.
> >
> > Thanks.
> >
> > ----
> >
> > [ 17.754417] UBSAN: array-index-out-of-bounds in /data/linux/net/wireless/scan.c:766:2
> > [ 17.754423] index 0 is out of range for type 'struct ieee80211_channel *[] __counted_by(n_channels)' (aka 'struct ieee80211_channel *[]')
This is this line:
request->channels[n_channels] = chan;
and later:
request->n_channels++;
Patch should be:
diff --git a/net/wireless/scan.c b/net/wireless/scan.c
index 1c6fd45aa809..ccdbeb604639 100644
--- a/net/wireless/scan.c
+++ b/net/wireless/scan.c
@@ -763,12 +763,11 @@ static void cfg80211_scan_req_add_chan(struct cfg80211_scan_request *request,
}
}
+ request->n_channels++;
request->channels[n_channels] = chan;
if (add_to_6ghz)
request->scan_6ghz_params[request->n_6ghz_params].channel_idx =
n_channels;
-
- request->n_channels++;
}
static bool cfg80211_find_ssid_match(struct cfg80211_colocated_ap *ap,
--
Kees Cook
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: UBSAN array-index-out-of-bounds: cfg80211_scan_6ghz
2024-12-30 18:35 ` Kees Cook
@ 2025-01-14 11:37 ` John Rowley
0 siblings, 0 replies; 4+ messages in thread
From: John Rowley @ 2025-01-14 11:37 UTC (permalink / raw)
To: Kees Cook
Cc: Nathan Chancellor, johannes, linux-wireless, stable, gustavoars,
linux-hardening
----------------------------------------
From: Kees Cook <kees@kernel.org>
To: Nathan Chancellor <nathan@kernel.org>
CC: John Rowley <lkml@johnrowley.me>; johannes@sipsolutions.net; linux-wireless@vger.kernel.org; stable@vger.kernel.org; gustavoars@kernel.org; linux-hardening@vger.kernel.org
Date: 30 Dec 2024 18:35:34
Subject: Re: UBSAN array-index-out-of-bounds: cfg80211_scan_6ghz
> On Sun, Dec 29, 2024 at 10:38:06PM -0700, Nathan Chancellor wrote:
>> Hi John,
>>
>> On Sat, Dec 28, 2024 at 11:21:27AM +0000, John Rowley wrote:
>>> Hi, I'm experiencing UBSAN array-index-out-of-bounds errors while using
>>> my Framework 13" AMD laptop with its Mediatek MT7922 wifi adapter
>>> (mt7921e).
>>>
>>> It seems to happen only once on boot, and occurs with both kernel
>>> versions 6.12.7 and 6.13-rc4, both compiled from vanilla upstream kernel
>>> sources on Fedora 41 using the kernel.org LLVM toolchain (19.1.6).
>>>
>>> I can try some other kernel series if necessary, and also a bisect if I
>>> find a working version, but that may take me a while.
>>
>> This looks related to UBSAN_BOUNDS and the fact that version of clang
>> supports the __counted_by attribute. I do not have much time at the
>> moment to look at this but I have added Kees, Gustavo, and
>> linux-hardening for further analysis.
>>
>> Cheers,
>> Nathan
>>
>>> I wasn't sure if I should mark this as a regression, as I'm not sure
>>> which/if there is a working kernel version at this point.
>>>
>>> Thanks.
>>>
>>> ----
>>>
>>> [ 17.754417] UBSAN: array-index-out-of-bounds in /data/linux/net/wireless/scan.c:766:2
>>> [ 17.754423] index 0 is out of range for type 'struct ieee80211_channel *[] __counted_by(n_channels)' (aka 'struct ieee80211_channel *[]')
>
> This is this line:
>
> request->channels[n_channels] = chan;
>
> and later:
>
> request->n_channels++;
>
> Patch should be:
>
> diff --git a/net/wireless/scan.c b/net/wireless/scan.c
> index 1c6fd45aa809..ccdbeb604639 100644
> --- a/net/wireless/scan.c
> +++ b/net/wireless/scan.c
> @@ -763,12 +763,11 @@ static void cfg80211_scan_req_add_chan(struct cfg80211_scan_request *request,
> }
> }
>
> + request->n_channels++;
> request->channels[n_channels] = chan;
> if (add_to_6ghz)
> request->scan_6ghz_params[request->n_6ghz_params].channel_idx =
> n_channels;
> -
> - request->n_channels++;
> }
>
> static bool cfg80211_find_ssid_match(struct cfg80211_colocated_ap *ap,
>
>
> --
> Kees Cook
Apologies for not replying sooner but the above patch works perfectly. Thanks!
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2025-01-14 11:49 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2024-12-28 11:21 UBSAN array-index-out-of-bounds: cfg80211_scan_6ghz John Rowley
2024-12-30 5:38 ` Nathan Chancellor
2024-12-30 18:35 ` Kees Cook
2025-01-14 11:37 ` John Rowley
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).