From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A40411A4F23; Tue, 18 Jun 2024 12:40:59 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1718714459; cv=none; b=XhxQ7rOpme8PrGljIjsPFWmLRnioNed1kTHtZpzodmMUl0JAJeJATfNYMnyLG/bN9JFaRQ4v19bpZuQRf/7eaLiRu/WjQYy4XYzjz+e3IMrPvJZty3uZk6uVqJ82s5VHzB5bbrFQW/9PvWwxUm1k+e4rU+HcjahHXPLidwghwC8= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1718714459; c=relaxed/simple; bh=Eo3V4jSPlpaQPRt1kZP3S1ORy65YI2GBpz+FaCrKQGY=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=Mh7E4joRZdMJtAUH065E7v96Zh+W7m+iviCM2vkU0VWcnOOLf+00qYqj9gMV+g1MSQ0dLBzp0z4KluFexv1TQmlybveunOf7Wdgf/BqzTovYdk8X/SfvW0csHixqF+GNYvSWGaKKHqxtczZPzJelGd4MjNKClEODE2s0i6ff+BA= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=nwLpf/Sv; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="nwLpf/Sv" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 01B73C4AF49; Tue, 18 Jun 2024 12:40:57 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1718714459; bh=Eo3V4jSPlpaQPRt1kZP3S1ORy65YI2GBpz+FaCrKQGY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=nwLpf/SvEcJQ2jfODcuuTAIGnVpSChHJ8mYjkWsTV2aPp68k7zoyDUQa2V2x0jCns SjynVIrwdPFvf4Pswsf2MGAOWveHOdw3H+5e7zzn0K6eL7eSRVfk8yQ6iXBJpLvVRm y/r5YRRqA/5aR5S3h3nkByMWEVitWyJcCtjul7t/QOTUYUQFYk6lna5p98iyz88Zjh u4aKaoU3xrY8TQY0OhF06Si5sKP3eZLX7nzEAdnt3nGQV1bEXtyIRX1AVpintCOLnY 5kVEIo3ZGAfkmGHej21f/OKkTn9xj7HWj9cXpxSGlrwg0IlygEplw0+AXFXDYZfwyW YywDKMpViyLPg== From: Sasha Levin To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Dmitry Antipov , Johannes Berg , Sasha Levin , johannes@sipsolutions.net, davem@davemloft.net, edumazet@google.com, kuba@kernel.org, pabeni@redhat.com, linux-wireless@vger.kernel.org, netdev@vger.kernel.org Subject: [PATCH AUTOSEL 6.1 19/29] wifi: mac80211: fix UBSAN noise in ieee80211_prep_hw_scan() Date: Tue, 18 Jun 2024 08:39:45 -0400 Message-ID: <20240618124018.3303162-19-sashal@kernel.org> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20240618124018.3303162-1-sashal@kernel.org> References: <20240618124018.3303162-1-sashal@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-stable: review X-Patchwork-Hint: Ignore X-stable-base: Linux 6.1.94 Content-Transfer-Encoding: 8bit From: Dmitry Antipov [ Upstream commit 92ecbb3ac6f3fe8ae9edf3226c76aa17b6800699 ] When testing the previous patch with CONFIG_UBSAN_BOUNDS, I've noticed the following: UBSAN: array-index-out-of-bounds in net/mac80211/scan.c:372:4 index 0 is out of range for type 'struct ieee80211_channel *[]' CPU: 0 PID: 1435 Comm: wpa_supplicant Not tainted 6.9.0+ #1 Hardware name: LENOVO 20UN005QRT/20UN005QRT <...BIOS details...> Call Trace: dump_stack_lvl+0x2d/0x90 __ubsan_handle_out_of_bounds+0xe7/0x140 ? timerqueue_add+0x98/0xb0 ieee80211_prep_hw_scan+0x2db/0x480 [mac80211] ? __kmalloc+0xe1/0x470 __ieee80211_start_scan+0x541/0x760 [mac80211] rdev_scan+0x1f/0xe0 [cfg80211] nl80211_trigger_scan+0x9b6/0xae0 [cfg80211] ... Since '__ieee80211_start_scan()' leaves 'hw_scan_req->req.n_channels' uninitialized, actual boundaries of 'hw_scan_req->req.channels' can't be checked in 'ieee80211_prep_hw_scan()'. Although an initialization of 'hw_scan_req->req.n_channels' introduces some confusion around allocated vs. used VLA members, this shouldn't be a problem since everything is correctly adjusted soon in 'ieee80211_prep_hw_scan()'. Cleanup 'kmalloc()' math in '__ieee80211_start_scan()' by using the convenient 'struct_size()' as well. Signed-off-by: Dmitry Antipov Link: https://msgid.link/20240517153332.18271-2-dmantipov@yandex.ru [improve (imho) indentation a bit] Signed-off-by: Johannes Berg Signed-off-by: Sasha Levin --- net/mac80211/scan.c | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) diff --git a/net/mac80211/scan.c b/net/mac80211/scan.c index 933d02d7c1284..62c22ff329ad4 100644 --- a/net/mac80211/scan.c +++ b/net/mac80211/scan.c @@ -733,15 +733,21 @@ static int __ieee80211_start_scan(struct ieee80211_sub_if_data *sdata, local->hw_scan_ies_bufsize *= n_bands; } - local->hw_scan_req = kmalloc( - sizeof(*local->hw_scan_req) + - req->n_channels * sizeof(req->channels[0]) + - local->hw_scan_ies_bufsize, GFP_KERNEL); + local->hw_scan_req = kmalloc(struct_size(local->hw_scan_req, + req.channels, + req->n_channels) + + local->hw_scan_ies_bufsize, + GFP_KERNEL); if (!local->hw_scan_req) return -ENOMEM; local->hw_scan_req->req.ssids = req->ssids; local->hw_scan_req->req.n_ssids = req->n_ssids; + /* None of the channels are actually set + * up but let UBSAN know the boundaries. + */ + local->hw_scan_req->req.n_channels = req->n_channels; + ies = (u8 *)local->hw_scan_req + sizeof(*local->hw_scan_req) + req->n_channels * sizeof(req->channels[0]); -- 2.43.0