Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit cd3212a9 authored by Dmitry Antipov's avatar Dmitry Antipov Committed by Greg Kroah-Hartman
Browse files

wifi: mac80211: fix UBSAN noise in ieee80211_prep_hw_scan() 



[ Upstream commit 92ecbb3ac6f3fe8ae9edf3226c76aa17b6800699 ]

When testing the previous patch with CONFIG_UBSAN_BOUNDS, I've
noticed the following:

UBSAN: array-index-out-of-bounds in net/mac80211/scan.c:372:4
index 0 is out of range for type 'struct ieee80211_channel *[]'
CPU: 0 PID: 1435 Comm: wpa_supplicant Not tainted 6.9.0+ #1
Hardware name: LENOVO 20UN005QRT/20UN005QRT <...BIOS details...>
Call Trace:
 <TASK>
 dump_stack_lvl+0x2d/0x90
 __ubsan_handle_out_of_bounds+0xe7/0x140
 ? timerqueue_add+0x98/0xb0
 ieee80211_prep_hw_scan+0x2db/0x480 [mac80211]
 ? __kmalloc+0xe1/0x470
 __ieee80211_start_scan+0x541/0x760 [mac80211]
 rdev_scan+0x1f/0xe0 [cfg80211]
 nl80211_trigger_scan+0x9b6/0xae0 [cfg80211]
 ...<the rest is not too useful...>

Since '__ieee80211_start_scan()' leaves 'hw_scan_req->req.n_channels'
uninitialized, actual boundaries of 'hw_scan_req->req.channels' can't
be checked in 'ieee80211_prep_hw_scan()'. Although an initialization
of 'hw_scan_req->req.n_channels' introduces some confusion around
allocated vs. used VLA members, this shouldn't be a problem since
everything is correctly adjusted soon in 'ieee80211_prep_hw_scan()'.

Cleanup 'kmalloc()' math in '__ieee80211_start_scan()' by using the
convenient 'struct_size()' as well.

Signed-off-by: default avatarDmitry Antipov <dmantipov@yandex.ru>
Link: https://msgid.link/20240517153332.18271-2-dmantipov@yandex.ru


[improve (imho) indentation a bit]
Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
parent 46487275

net/mac80211/scan.c

+10 −4
Original line number Original line Diff line number Diff line
@@ -652,15 +652,21 @@ static int __ieee80211_start_scan(struct ieee80211_sub_if_data *sdata, 
			local->hw_scan_ies_bufsize *= n_bands;

			local->hw_scan_ies_bufsize *= n_bands;

		}

		}





		local->hw_scan_req = kmalloc(

		local->hw_scan_req = kmalloc(struct_size(local->hw_scan_req,

				sizeof(*local->hw_scan_req) +

							 req.channels,

				req->n_channels * sizeof(req->channels[0]) +

							 req->n_channels) +

				local->hw_scan_ies_bufsize, GFP_KERNEL);

					     local->hw_scan_ies_bufsize,

					     GFP_KERNEL);

		if (!local->hw_scan_req)

		if (!local->hw_scan_req)

			return -ENOMEM;

			return -ENOMEM;





		local->hw_scan_req->req.ssids = req->ssids;

		local->hw_scan_req->req.ssids = req->ssids;

		local->hw_scan_req->req.n_ssids = req->n_ssids;

		local->hw_scan_req->req.n_ssids = req->n_ssids;

		/* None of the channels are actually set

		 * up but let UBSAN know the boundaries.

		 */

		local->hw_scan_req->req.n_channels = req->n_channels;



		ies = (u8 *)local->hw_scan_req +

		ies = (u8 *)local->hw_scan_req +

			sizeof(*local->hw_scan_req) +

			sizeof(*local->hw_scan_req) +

			req->n_channels * sizeof(req->channels[0]);

			req->n_channels * sizeof(req->channels[0]);