From: "Toke Høiland-Jørgensen" <toke@toke.dk>
To: Lorenzo Bianconi <lorenzo@kernel.org>, linux-wireless@vger.kernel.org
Cc: bjlockie@lockie.ca, johannes@sipsolutions.net, nbd@nbd.name,
lorenzo.bianconi@redhat.com
Subject: Re: [PATCH v2 wireless] wifi: mac8021: fix possible oob access in ieee80211_get_rate_duration
Date: Tue, 08 Nov 2022 16:40:01 +0100 [thread overview]
Message-ID: <87y1slzc8e.fsf@toke.dk> (raw)
In-Reply-To: <8d0116580f2c5eafaea29acb2cbbc348ff853f5b.1667920478.git.lorenzo@kernel.org>
Lorenzo Bianconi <lorenzo@kernel.org> writes:
> Fix possible out-of-bound access in ieee80211_get_rate_duration routine
> as reported by the following UBSAN report:
>
> UBSAN: array-index-out-of-bounds in net/mac80211/airtime.c:455:47
> index 15 is out of range for type 'u16 [12]'
> CPU: 2 PID: 217 Comm: kworker/u32:10 Not tainted 6.1.0-060100rc3-generic
> Hardware name: Acer Aspire TC-281/Aspire TC-281, BIOS R01-A2 07/18/2017
> Workqueue: mt76 mt76u_tx_status_data [mt76_usb]
> Call Trace:
> <TASK>
> show_stack+0x4e/0x61
> dump_stack_lvl+0x4a/0x6f
> dump_stack+0x10/0x18
> ubsan_epilogue+0x9/0x43
> __ubsan_handle_out_of_bounds.cold+0x42/0x47
> ieee80211_get_rate_duration.constprop.0+0x22f/0x2a0 [mac80211]
> ? ieee80211_tx_status_ext+0x32e/0x640 [mac80211]
> ieee80211_calc_rx_airtime+0xda/0x120 [mac80211]
> ieee80211_calc_tx_airtime+0xb4/0x100 [mac80211]
> mt76x02_send_tx_status+0x266/0x480 [mt76x02_lib]
> mt76x02_tx_status_data+0x52/0x80 [mt76x02_lib]
> mt76u_tx_status_data+0x67/0xd0 [mt76_usb]
> process_one_work+0x225/0x400
> worker_thread+0x50/0x3e0
> ? process_one_work+0x400/0x400
> kthread+0xe9/0x110
> ? kthread_complete_and_exit+0x20/0x20
> ret_from_fork+0x22/0x30
>
> Fixes: db3e1c40cf2f ("mac80211: Import airtime calculation code from mt76")
> Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Acked-by: Toke Høiland-Jørgensen <toke@toke.dk>
prev parent reply other threads:[~2022-11-08 15:40 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-11-08 15:19 [PATCH v2 wireless] wifi: mac8021: fix possible oob access in ieee80211_get_rate_duration Lorenzo Bianconi
2022-11-08 15:40 ` Toke Høiland-Jørgensen [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=87y1slzc8e.fsf@toke.dk \
--to=toke@toke.dk \
--cc=bjlockie@lockie.ca \
--cc=johannes@sipsolutions.net \
--cc=linux-wireless@vger.kernel.org \
--cc=lorenzo.bianconi@redhat.com \
--cc=lorenzo@kernel.org \
--cc=nbd@nbd.name \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).