* UBSAN array-index-out-of-bounds: cfg80211_scan_6ghz @ 2024-12-28 11:21 John Rowley 2024-12-30 5:38 ` Nathan Chancellor 0 siblings, 1 reply; 4+ messages in thread From: John Rowley @ 2024-12-28 11:21 UTC (permalink / raw) To: johannes, linux-wireless; +Cc: stable Hi, I'm experiencing UBSAN array-index-out-of-bounds errors while using my Framework 13" AMD laptop with its Mediatek MT7922 wifi adapter (mt7921e). It seems to happen only once on boot, and occurs with both kernel versions 6.12.7 and 6.13-rc4, both compiled from vanilla upstream kernel sources on Fedora 41 using the kernel.org LLVM toolchain (19.1.6). I can try some other kernel series if necessary, and also a bisect if I find a working version, but that may take me a while. I wasn't sure if I should mark this as a regression, as I'm not sure which/if there is a working kernel version at this point. Thanks. ---- [ 17.754417] UBSAN: array-index-out-of-bounds in /data/linux/net/wireless/scan.c:766:2 [ 17.754423] index 0 is out of range for type 'struct ieee80211_channel *[] __counted_by(n_channels)' (aka 'struct ieee80211_channel *[]') [ 17.754427] CPU: 13 UID: 0 PID: 620 Comm: kworker/u64:10 Tainted: G T 6.13.0-rc4 #9 [ 17.754433] Tainted: [T]=RANDSTRUCT [ 17.754435] Hardware name: Framework Laptop 13 (AMD Ryzen 7040Series)/FRANMDCP07, BIOS 03.05 03/29/2024 [ 17.754438] Workqueue: events_unbound cfg80211_wiphy_work [ 17.754446] Call Trace: [ 17.754449] <TASK> [ 17.754452] dump_stack_lvl+0x82/0xc0 [ 17.754459] __ubsan_handle_out_of_bounds+0xe7/0x110 [ 17.754464] ? srso_alias_return_thunk+0x5/0xfbef5 [ 17.754470] ? __kmalloc_noprof+0x1a7/0x280 [ 17.754477] cfg80211_scan_6ghz+0x3bb/0xfd0 [ 17.754482] ? srso_alias_return_thunk+0x5/0xfbef5 [ 17.754486] ? try_to_wake_up+0x368/0x4c0 [ 17.754491] ? try_to_wake_up+0x1a9/0x4c0 [ 17.754496] ___cfg80211_scan_done+0xa9/0x1e0 [ 17.754500] cfg80211_wiphy_work+0xb7/0xe0 [ 17.754504] process_scheduled_works+0x205/0x3a0 [ 17.754509] worker_thread+0x24a/0x300 [ 17.754514] ? __cfi_worker_thread+0x10/0x10 [ 17.754519] kthread+0x158/0x180 [ 17.754524] ? __cfi_kthread+0x10/0x10 [ 17.754528] ret_from_fork+0x40/0x50 [ 17.754534] ? __cfi_kthread+0x10/0x10 [ 17.754538] ret_from_fork_asm+0x11/0x30 [ 17.754544] </TASK> ^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: UBSAN array-index-out-of-bounds: cfg80211_scan_6ghz 2024-12-28 11:21 UBSAN array-index-out-of-bounds: cfg80211_scan_6ghz John Rowley @ 2024-12-30 5:38 ` Nathan Chancellor 2024-12-30 18:35 ` Kees Cook 0 siblings, 1 reply; 4+ messages in thread From: Nathan Chancellor @ 2024-12-30 5:38 UTC (permalink / raw) To: John Rowley Cc: johannes, linux-wireless, stable, kees, gustavoars, linux-hardening Hi John, On Sat, Dec 28, 2024 at 11:21:27AM +0000, John Rowley wrote: > Hi, I'm experiencing UBSAN array-index-out-of-bounds errors while using > my Framework 13" AMD laptop with its Mediatek MT7922 wifi adapter > (mt7921e). > > It seems to happen only once on boot, and occurs with both kernel > versions 6.12.7 and 6.13-rc4, both compiled from vanilla upstream kernel > sources on Fedora 41 using the kernel.org LLVM toolchain (19.1.6). > > I can try some other kernel series if necessary, and also a bisect if I > find a working version, but that may take me a while. This looks related to UBSAN_BOUNDS and the fact that version of clang supports the __counted_by attribute. I do not have much time at the moment to look at this but I have added Kees, Gustavo, and linux-hardening for further analysis. Cheers, Nathan > I wasn't sure if I should mark this as a regression, as I'm not sure > which/if there is a working kernel version at this point. > > Thanks. > > ---- > > [ 17.754417] UBSAN: array-index-out-of-bounds in /data/linux/net/wireless/scan.c:766:2 > [ 17.754423] index 0 is out of range for type 'struct ieee80211_channel *[] __counted_by(n_channels)' (aka 'struct ieee80211_channel *[]') > [ 17.754427] CPU: 13 UID: 0 PID: 620 Comm: kworker/u64:10 Tainted: G T 6.13.0-rc4 #9 > [ 17.754433] Tainted: [T]=RANDSTRUCT > [ 17.754435] Hardware name: Framework Laptop 13 (AMD Ryzen 7040Series)/FRANMDCP07, BIOS 03.05 03/29/2024 > [ 17.754438] Workqueue: events_unbound cfg80211_wiphy_work > [ 17.754446] Call Trace: > [ 17.754449] <TASK> > [ 17.754452] dump_stack_lvl+0x82/0xc0 > [ 17.754459] __ubsan_handle_out_of_bounds+0xe7/0x110 > [ 17.754464] ? srso_alias_return_thunk+0x5/0xfbef5 > [ 17.754470] ? __kmalloc_noprof+0x1a7/0x280 > [ 17.754477] cfg80211_scan_6ghz+0x3bb/0xfd0 > [ 17.754482] ? srso_alias_return_thunk+0x5/0xfbef5 > [ 17.754486] ? try_to_wake_up+0x368/0x4c0 > [ 17.754491] ? try_to_wake_up+0x1a9/0x4c0 > [ 17.754496] ___cfg80211_scan_done+0xa9/0x1e0 > [ 17.754500] cfg80211_wiphy_work+0xb7/0xe0 > [ 17.754504] process_scheduled_works+0x205/0x3a0 > [ 17.754509] worker_thread+0x24a/0x300 > [ 17.754514] ? __cfi_worker_thread+0x10/0x10 > [ 17.754519] kthread+0x158/0x180 > [ 17.754524] ? __cfi_kthread+0x10/0x10 > [ 17.754528] ret_from_fork+0x40/0x50 > [ 17.754534] ? __cfi_kthread+0x10/0x10 > [ 17.754538] ret_from_fork_asm+0x11/0x30 > [ 17.754544] </TASK> > ^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: UBSAN array-index-out-of-bounds: cfg80211_scan_6ghz 2024-12-30 5:38 ` Nathan Chancellor @ 2024-12-30 18:35 ` Kees Cook 2025-01-14 11:37 ` John Rowley 0 siblings, 1 reply; 4+ messages in thread From: Kees Cook @ 2024-12-30 18:35 UTC (permalink / raw) To: Nathan Chancellor Cc: John Rowley, johannes, linux-wireless, stable, gustavoars, linux-hardening On Sun, Dec 29, 2024 at 10:38:06PM -0700, Nathan Chancellor wrote: > Hi John, > > On Sat, Dec 28, 2024 at 11:21:27AM +0000, John Rowley wrote: > > Hi, I'm experiencing UBSAN array-index-out-of-bounds errors while using > > my Framework 13" AMD laptop with its Mediatek MT7922 wifi adapter > > (mt7921e). > > > > It seems to happen only once on boot, and occurs with both kernel > > versions 6.12.7 and 6.13-rc4, both compiled from vanilla upstream kernel > > sources on Fedora 41 using the kernel.org LLVM toolchain (19.1.6). > > > > I can try some other kernel series if necessary, and also a bisect if I > > find a working version, but that may take me a while. > > This looks related to UBSAN_BOUNDS and the fact that version of clang > supports the __counted_by attribute. I do not have much time at the > moment to look at this but I have added Kees, Gustavo, and > linux-hardening for further analysis. > > Cheers, > Nathan > > > I wasn't sure if I should mark this as a regression, as I'm not sure > > which/if there is a working kernel version at this point. > > > > Thanks. > > > > ---- > > > > [ 17.754417] UBSAN: array-index-out-of-bounds in /data/linux/net/wireless/scan.c:766:2 > > [ 17.754423] index 0 is out of range for type 'struct ieee80211_channel *[] __counted_by(n_channels)' (aka 'struct ieee80211_channel *[]') This is this line: request->channels[n_channels] = chan; and later: request->n_channels++; Patch should be: diff --git a/net/wireless/scan.c b/net/wireless/scan.c index 1c6fd45aa809..ccdbeb604639 100644 --- a/net/wireless/scan.c +++ b/net/wireless/scan.c @@ -763,12 +763,11 @@ static void cfg80211_scan_req_add_chan(struct cfg80211_scan_request *request, } } + request->n_channels++; request->channels[n_channels] = chan; if (add_to_6ghz) request->scan_6ghz_params[request->n_6ghz_params].channel_idx = n_channels; - - request->n_channels++; } static bool cfg80211_find_ssid_match(struct cfg80211_colocated_ap *ap, -- Kees Cook ^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: UBSAN array-index-out-of-bounds: cfg80211_scan_6ghz 2024-12-30 18:35 ` Kees Cook @ 2025-01-14 11:37 ` John Rowley 0 siblings, 0 replies; 4+ messages in thread From: John Rowley @ 2025-01-14 11:37 UTC (permalink / raw) To: Kees Cook Cc: Nathan Chancellor, johannes, linux-wireless, stable, gustavoars, linux-hardening ---------------------------------------- From: Kees Cook <kees@kernel.org> To: Nathan Chancellor <nathan@kernel.org> CC: John Rowley <lkml@johnrowley.me>; johannes@sipsolutions.net; linux-wireless@vger.kernel.org; stable@vger.kernel.org; gustavoars@kernel.org; linux-hardening@vger.kernel.org Date: 30 Dec 2024 18:35:34 Subject: Re: UBSAN array-index-out-of-bounds: cfg80211_scan_6ghz > On Sun, Dec 29, 2024 at 10:38:06PM -0700, Nathan Chancellor wrote: >> Hi John, >> >> On Sat, Dec 28, 2024 at 11:21:27AM +0000, John Rowley wrote: >>> Hi, I'm experiencing UBSAN array-index-out-of-bounds errors while using >>> my Framework 13" AMD laptop with its Mediatek MT7922 wifi adapter >>> (mt7921e). >>> >>> It seems to happen only once on boot, and occurs with both kernel >>> versions 6.12.7 and 6.13-rc4, both compiled from vanilla upstream kernel >>> sources on Fedora 41 using the kernel.org LLVM toolchain (19.1.6). >>> >>> I can try some other kernel series if necessary, and also a bisect if I >>> find a working version, but that may take me a while. >> >> This looks related to UBSAN_BOUNDS and the fact that version of clang >> supports the __counted_by attribute. I do not have much time at the >> moment to look at this but I have added Kees, Gustavo, and >> linux-hardening for further analysis. >> >> Cheers, >> Nathan >> >>> I wasn't sure if I should mark this as a regression, as I'm not sure >>> which/if there is a working kernel version at this point. >>> >>> Thanks. >>> >>> ---- >>> >>> [ 17.754417] UBSAN: array-index-out-of-bounds in /data/linux/net/wireless/scan.c:766:2 >>> [ 17.754423] index 0 is out of range for type 'struct ieee80211_channel *[] __counted_by(n_channels)' (aka 'struct ieee80211_channel *[]') > > This is this line: > > request->channels[n_channels] = chan; > > and later: > > request->n_channels++; > > Patch should be: > > diff --git a/net/wireless/scan.c b/net/wireless/scan.c > index 1c6fd45aa809..ccdbeb604639 100644 > --- a/net/wireless/scan.c > +++ b/net/wireless/scan.c > @@ -763,12 +763,11 @@ static void cfg80211_scan_req_add_chan(struct cfg80211_scan_request *request, > } > } > > + request->n_channels++; > request->channels[n_channels] = chan; > if (add_to_6ghz) > request->scan_6ghz_params[request->n_6ghz_params].channel_idx = > n_channels; > - > - request->n_channels++; > } > > static bool cfg80211_find_ssid_match(struct cfg80211_colocated_ap *ap, > > > -- > Kees Cook Apologies for not replying sooner but the above patch works perfectly. Thanks! ^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2025-01-14 11:49 UTC | newest] Thread overview: 4+ messages (download: mbox.gz follow: Atom feed -- links below jump to the message on this page -- 2024-12-28 11:21 UBSAN array-index-out-of-bounds: cfg80211_scan_6ghz John Rowley 2024-12-30 5:38 ` Nathan Chancellor 2024-12-30 18:35 ` Kees Cook 2025-01-14 11:37 ` John Rowley
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox