Hi, I'm experiencing UBSAN array-index-out-of-bounds errors while using my Framework 13" AMD laptop with its Mediatek MT7922 wifi adapter (mt7921e).
It seems to happen only once on boot, and occurs with both kernel versions 6.12.7 and 6.13-rc4, both compiled from vanilla upstream kernel sources on Fedora 41 using the kernel.org LLVM toolchain (19.1.6).
I can try some other kernel series if necessary, and also a bisect if I find a working version, but that may take me a while.
I wasn't sure if I should mark this as a regression, as I'm not sure which/if there is a working kernel version at this point.
Thanks.
----
[ 17.754417] UBSAN: array-index-out-of-bounds in /data/linux/net/wireless/scan.c:766:2 [ 17.754423] index 0 is out of range for type 'struct ieee80211_channel *[] __counted_by(n_channels)' (aka 'struct ieee80211_channel *[]') [ 17.754427] CPU: 13 UID: 0 PID: 620 Comm: kworker/u64:10 Tainted: G T 6.13.0-rc4 #9 [ 17.754433] Tainted: [T]=RANDSTRUCT [ 17.754435] Hardware name: Framework Laptop 13 (AMD Ryzen 7040Series)/FRANMDCP07, BIOS 03.05 03/29/2024 [ 17.754438] Workqueue: events_unbound cfg80211_wiphy_work [ 17.754446] Call Trace: [ 17.754449] <TASK> [ 17.754452] dump_stack_lvl+0x82/0xc0 [ 17.754459] __ubsan_handle_out_of_bounds+0xe7/0x110 [ 17.754464] ? srso_alias_return_thunk+0x5/0xfbef5 [ 17.754470] ? __kmalloc_noprof+0x1a7/0x280 [ 17.754477] cfg80211_scan_6ghz+0x3bb/0xfd0 [ 17.754482] ? srso_alias_return_thunk+0x5/0xfbef5 [ 17.754486] ? try_to_wake_up+0x368/0x4c0 [ 17.754491] ? try_to_wake_up+0x1a9/0x4c0 [ 17.754496] ___cfg80211_scan_done+0xa9/0x1e0 [ 17.754500] cfg80211_wiphy_work+0xb7/0xe0 [ 17.754504] process_scheduled_works+0x205/0x3a0 [ 17.754509] worker_thread+0x24a/0x300 [ 17.754514] ? __cfi_worker_thread+0x10/0x10 [ 17.754519] kthread+0x158/0x180 [ 17.754524] ? __cfi_kthread+0x10/0x10 [ 17.754528] ret_from_fork+0x40/0x50 [ 17.754534] ? __cfi_kthread+0x10/0x10 [ 17.754538] ret_from_fork_asm+0x11/0x30 [ 17.754544] </TASK>
Hi John,
On Sat, Dec 28, 2024 at 11:21:27AM +0000, John Rowley wrote:
Hi, I'm experiencing UBSAN array-index-out-of-bounds errors while using my Framework 13" AMD laptop with its Mediatek MT7922 wifi adapter (mt7921e).
It seems to happen only once on boot, and occurs with both kernel versions 6.12.7 and 6.13-rc4, both compiled from vanilla upstream kernel sources on Fedora 41 using the kernel.org LLVM toolchain (19.1.6).
I can try some other kernel series if necessary, and also a bisect if I find a working version, but that may take me a while.
This looks related to UBSAN_BOUNDS and the fact that version of clang supports the __counted_by attribute. I do not have much time at the moment to look at this but I have added Kees, Gustavo, and linux-hardening for further analysis.
Cheers, Nathan
I wasn't sure if I should mark this as a regression, as I'm not sure which/if there is a working kernel version at this point.
Thanks.
[ 17.754417] UBSAN: array-index-out-of-bounds in /data/linux/net/wireless/scan.c:766:2 [ 17.754423] index 0 is out of range for type 'struct ieee80211_channel *[] __counted_by(n_channels)' (aka 'struct ieee80211_channel *[]') [ 17.754427] CPU: 13 UID: 0 PID: 620 Comm: kworker/u64:10 Tainted: G T 6.13.0-rc4 #9 [ 17.754433] Tainted: [T]=RANDSTRUCT [ 17.754435] Hardware name: Framework Laptop 13 (AMD Ryzen 7040Series)/FRANMDCP07, BIOS 03.05 03/29/2024 [ 17.754438] Workqueue: events_unbound cfg80211_wiphy_work [ 17.754446] Call Trace: [ 17.754449] <TASK> [ 17.754452] dump_stack_lvl+0x82/0xc0 [ 17.754459] __ubsan_handle_out_of_bounds+0xe7/0x110 [ 17.754464] ? srso_alias_return_thunk+0x5/0xfbef5 [ 17.754470] ? __kmalloc_noprof+0x1a7/0x280 [ 17.754477] cfg80211_scan_6ghz+0x3bb/0xfd0 [ 17.754482] ? srso_alias_return_thunk+0x5/0xfbef5 [ 17.754486] ? try_to_wake_up+0x368/0x4c0 [ 17.754491] ? try_to_wake_up+0x1a9/0x4c0 [ 17.754496] ___cfg80211_scan_done+0xa9/0x1e0 [ 17.754500] cfg80211_wiphy_work+0xb7/0xe0 [ 17.754504] process_scheduled_works+0x205/0x3a0 [ 17.754509] worker_thread+0x24a/0x300 [ 17.754514] ? __cfi_worker_thread+0x10/0x10 [ 17.754519] kthread+0x158/0x180 [ 17.754524] ? __cfi_kthread+0x10/0x10 [ 17.754528] ret_from_fork+0x40/0x50 [ 17.754534] ? __cfi_kthread+0x10/0x10 [ 17.754538] ret_from_fork_asm+0x11/0x30 [ 17.754544] </TASK>
On Sun, Dec 29, 2024 at 10:38:06PM -0700, Nathan Chancellor wrote:
Hi John,
On Sat, Dec 28, 2024 at 11:21:27AM +0000, John Rowley wrote:
Hi, I'm experiencing UBSAN array-index-out-of-bounds errors while using my Framework 13" AMD laptop with its Mediatek MT7922 wifi adapter (mt7921e).
It seems to happen only once on boot, and occurs with both kernel versions 6.12.7 and 6.13-rc4, both compiled from vanilla upstream kernel sources on Fedora 41 using the kernel.org LLVM toolchain (19.1.6).
I can try some other kernel series if necessary, and also a bisect if I find a working version, but that may take me a while.
This looks related to UBSAN_BOUNDS and the fact that version of clang supports the __counted_by attribute. I do not have much time at the moment to look at this but I have added Kees, Gustavo, and linux-hardening for further analysis.
Cheers, Nathan
I wasn't sure if I should mark this as a regression, as I'm not sure which/if there is a working kernel version at this point.
Thanks.
[ 17.754417] UBSAN: array-index-out-of-bounds in /data/linux/net/wireless/scan.c:766:2 [ 17.754423] index 0 is out of range for type 'struct ieee80211_channel *[] __counted_by(n_channels)' (aka 'struct ieee80211_channel *[]')
This is this line:
request->channels[n_channels] = chan;
and later:
request->n_channels++;
Patch should be:
diff --git a/net/wireless/scan.c b/net/wireless/scan.c index 1c6fd45aa809..ccdbeb604639 100644 --- a/net/wireless/scan.c +++ b/net/wireless/scan.c @@ -763,12 +763,11 @@ static void cfg80211_scan_req_add_chan(struct cfg80211_scan_request *request, } }
+ request->n_channels++; request->channels[n_channels] = chan; if (add_to_6ghz) request->scan_6ghz_params[request->n_6ghz_params].channel_idx = n_channels; - - request->n_channels++; }
static bool cfg80211_find_ssid_match(struct cfg80211_colocated_ap *ap,
----------------------------------------
From: Kees Cook kees@kernel.org To: Nathan Chancellor nathan@kernel.org CC: John Rowley lkml@johnrowley.me; johannes@sipsolutions.net; linux-wireless@vger.kernel.org; stable@vger.kernel.org; gustavoars@kernel.org; linux-hardening@vger.kernel.org Date: 30 Dec 2024 18:35:34 Subject: Re: UBSAN array-index-out-of-bounds: cfg80211_scan_6ghz
On Sun, Dec 29, 2024 at 10:38:06PM -0700, Nathan Chancellor wrote:
Hi John,
On Sat, Dec 28, 2024 at 11:21:27AM +0000, John Rowley wrote:
Hi, I'm experiencing UBSAN array-index-out-of-bounds errors while using my Framework 13" AMD laptop with its Mediatek MT7922 wifi adapter (mt7921e).
It seems to happen only once on boot, and occurs with both kernel versions 6.12.7 and 6.13-rc4, both compiled from vanilla upstream kernel sources on Fedora 41 using the kernel.org LLVM toolchain (19.1.6).
I can try some other kernel series if necessary, and also a bisect if I find a working version, but that may take me a while.
This looks related to UBSAN_BOUNDS and the fact that version of clang supports the __counted_by attribute. I do not have much time at the moment to look at this but I have added Kees, Gustavo, and linux-hardening for further analysis.
Cheers, Nathan
I wasn't sure if I should mark this as a regression, as I'm not sure which/if there is a working kernel version at this point.
Thanks.
[ 17.754417] UBSAN: array-index-out-of-bounds in /data/linux/net/wireless/scan.c:766:2 [ 17.754423] index 0 is out of range for type 'struct ieee80211_channel *[] __counted_by(n_channels)' (aka 'struct ieee80211_channel *[]')
This is this line:
request->channels[n_channels] = chan;
and later:
request->n_channels++;
Patch should be:
diff --git a/net/wireless/scan.c b/net/wireless/scan.c index 1c6fd45aa809..ccdbeb604639 100644 --- a/net/wireless/scan.c +++ b/net/wireless/scan.c @@ -763,12 +763,11 @@ static void cfg80211_scan_req_add_chan(struct cfg80211_scan_request *request, } }
+ request->n_channels++; request->channels[n_channels] = chan; if (add_to_6ghz) request->scan_6ghz_params[request->n_6ghz_params].channel_idx = n_channels;
- request->n_channels++; }
static bool cfg80211_find_ssid_match(struct cfg80211_colocated_ap *ap,
-- Kees Cook
Apologies for not replying sooner but the above patch works perfectly. Thanks!
linux-stable-mirror@lists.linaro.org
-
John Rowley -
Kees Cook -
Nathan Chancellor