Re: UBSAN array-index-out-of-bounds: cfg80211_scan_6ghz

[Kees Cook <kees@kernel.org>]

On Sun, Dec 29, 2024 at 10:38:06PM -0700, Nathan Chancellor wrote:
> Hi John,
> 
> On Sat, Dec 28, 2024 at 11:21:27AM +0000, John Rowley wrote:
> > Hi, I'm experiencing UBSAN array-index-out-of-bounds errors while using
> > my Framework 13" AMD laptop with its Mediatek MT7922 wifi adapter
> > (mt7921e).
> > 
> > It seems to happen only once on boot, and occurs with both kernel
> > versions 6.12.7 and 6.13-rc4, both compiled from vanilla upstream kernel 
> > sources on Fedora 41 using the kernel.org LLVM toolchain (19.1.6).
> > 
> > I can try some other kernel series if necessary, and also a bisect if I
> > find a working version, but that may take me a while.
> 
> This looks related to UBSAN_BOUNDS and the fact that version of clang
> supports the __counted_by attribute. I do not have much time at the
> moment to look at this but I have added Kees, Gustavo, and
> linux-hardening for further analysis.
> 
> Cheers,
> Nathan
> 
> > I wasn't sure if I should mark this as a regression, as I'm not sure
> > which/if there is a working kernel version at this point.
> > 
> > Thanks.
> > 
> > ----
> > 
> > [   17.754417] UBSAN: array-index-out-of-bounds in /data/linux/net/wireless/scan.c:766:2
> > [   17.754423] index 0 is out of range for type 'struct ieee80211_channel *[] __counted_by(n_channels)' (aka 'struct ieee80211_channel *[]')

This is this line:

        request->channels[n_channels] = chan;

and later:

        request->n_channels++;

Patch should be:

diff --git a/net/wireless/scan.c b/net/wireless/scan.c
index 1c6fd45aa809..ccdbeb604639 100644
--- a/net/wireless/scan.c
+++ b/net/wireless/scan.c
@@ -763,12 +763,11 @@ static  void cfg80211_scan_req_add_chan(struct cfg80211_scan_request *request,
 		}
 	}
 
+	request->n_channels++;
 	request->channels[n_channels] = chan;
 	if (add_to_6ghz)
 		request->scan_6ghz_params[request->n_6ghz_params].channel_idx =
 			n_channels;
-
-	request->n_channels++;
 }
 
 static bool cfg80211_find_ssid_match(struct cfg80211_colocated_ap *ap,


-- 
Kees Cook