diff options
| author | Dmitry Antipov <[email protected]> | 2024-09-05 15:04:00 +0000 |
|---|---|---|
| committer | Johannes Berg <[email protected]> | 2024-09-06 10:54:57 +0000 |
| commit | a26a5107bc52922cf5f67361e307ad66547b51c7 (patch) | |
| tree | 508333d55763bb0107f127a1d553d40ddeebfa49 /drivers/net/wireless/intel/iwlwifi/mvm/ops.c | |
| parent | Merge tag 'wireless-next-2024-09-04' of git://git.kernel.org/pub/scm/linux/ke... (diff) | |
| download | kernel-a26a5107bc52922cf5f67361e307ad66547b51c7.tar.gz kernel-a26a5107bc52922cf5f67361e307ad66547b51c7.zip | |
wifi: cfg80211: fix UBSAN noise in cfg80211_wext_siwscan()
Looking at https://syzkaller.appspot.com/bug?extid=1a3986bbd3169c307819
and running reproducer with CONFIG_UBSAN_BOUNDS, I've noticed the
following:
[ T4985] UBSAN: array-index-out-of-bounds in net/wireless/scan.c:3479:25
[ T4985] index 164 is out of range for type 'struct ieee80211_channel *[]'
<...skipped...>
[ T4985] Call Trace:
[ T4985] <TASK>
[ T4985] dump_stack_lvl+0x1c2/0x2a0
[ T4985] ? __pfx_dump_stack_lvl+0x10/0x10
[ T4985] ? __pfx__printk+0x10/0x10
[ T4985] __ubsan_handle_out_of_bounds+0x127/0x150
[ T4985] cfg80211_wext_siwscan+0x11a4/0x1260
<...the rest is not too useful...>
Even if we do 'creq->n_channels = n_channels' before 'creq->ssids =
(void *)&creq->channels[n_channels]', UBSAN treats the latter as
off-by-one error. Fix this by using pointer arithmetic rather than
an expression with explicit array indexing and use convenient
'struct_size()' to simplify the math here and in 'kzalloc()' above.
Fixes: 5ba63533bbf6 ("cfg80211: fix alignment problem in scan request")
Signed-off-by: Dmitry Antipov <[email protected]>
Reviewed-by: Kees Cook <[email protected]>
Link: https://patch.msgid.link/[email protected]
[fix coding style for multi-line calculation]
Signed-off-by: Johannes Berg <[email protected]>
Diffstat (limited to 'drivers/net/wireless/intel/iwlwifi/mvm/ops.c')
0 files changed, 0 insertions, 0 deletions