Commit 4cbb9a66 authored by Kenton Groombridge's avatar Kenton Groombridge Committed by Dong Chenchen
Browse files

wifi: mac80211: Avoid address calculations via out of bounds array indexing 

mainline inclusion
from mainline-v6.10-rc5
commit 2663d0462eb32ae7c9b035300ab6b1523886c718
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAGEKT
CVE: CVE-2024-41071

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=2663d0462eb32ae7c9b035300ab6b1523886c718

--------------------------------

req->n_channels must be set before req->channels[] can be used.

This patch fixes one of the issues encountered in [1].

[   83.964255] UBSAN: array-index-out-of-bounds in net/mac80211/scan.c:364:4
[   83.964258] index 0 is out of range for type 'struct ieee80211_channel *[]'
[...]
[   83.964264] Call Trace:
[   83.964267]  <TASK>
[   83.964269]  dump_stack_lvl+0x3f/0xc0
[   83.964274]  __ubsan_handle_out_of_bounds+0xec/0x110
[   83.964278]  ieee80211_prep_hw_scan+0x2db/0x4b0
[   83.964281]  __ieee80211_start_scan+0x601/0x990
[   83.964291]  nl80211_trigger_scan+0x874/0x980
[   83.964295]  genl_family_rcv_msg_doit+0xe8/0x160
[   83.964298]  genl_rcv_msg+0x240/0x270
[...]

[1] https://bugzilla.kernel.org/show_bug.cgi?id=218810



Co-authored-by: default avatarKees Cook <keescook@chromium.org>
Signed-off-by: default avatarKees Cook <kees@kernel.org>
Signed-off-by: default avatarKenton Groombridge <concord@gentoo.org>
Link: https://msgid.link/20240605152218.236061-1-concord@gentoo.org


Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
Conflicts:
	net/mac80211/scan.c
[commit 5add321c329b remove scan_width support, which not merged
lead to conflicts.]
Signed-off-by: default avatarDong Chenchen <dongchenchen2@huawei.com>
parent 3bc2433e

net/mac80211/scan.c

+9 −8
Original line number Diff line number Diff line
@@ -346,7 +346,8 @@ static bool ieee80211_prep_hw_scan(struct ieee80211_sub_if_data *sdata) 
	struct cfg80211_scan_request *req;

	struct cfg80211_chan_def chandef;

	u8 bands_used = 0;

	int i, ielen, n_chans;

	int i, ielen;

	u32 *n_chans;

	u32 flags = 0;



	req = rcu_dereference_protected(local->scan_req,
@@ -356,34 +357,34 @@ static bool ieee80211_prep_hw_scan(struct ieee80211_sub_if_data *sdata) 
		return false;



	if (ieee80211_hw_check(&local->hw, SINGLE_SCAN_ON_ALL_BANDS)) {

		local->hw_scan_req->req.n_channels = req->n_channels;



		for (i = 0; i < req->n_channels; i++) {

			local->hw_scan_req->req.channels[i] = req->channels[i];

			bands_used |= BIT(req->channels[i]->band);

		}



		n_chans = req->n_channels;

	} else {

		do {

			if (local->hw_scan_band == NUM_NL80211_BANDS)

				return false;



			n_chans = 0;

			n_chans = &local->hw_scan_req->req.n_channels;

			*n_chans = 0;



			for (i = 0; i < req->n_channels; i++) {

				if (req->channels[i]->band !=

				    local->hw_scan_band)

					continue;

				local->hw_scan_req->req.channels[n_chans] =

				local->hw_scan_req->req.channels[(*n_chans)++] =

							req->channels[i];

				n_chans++;



				bands_used |= BIT(req->channels[i]->band);

			}



			local->hw_scan_band++;

		} while (!n_chans);

		} while (!*n_chans);

	}



	local->hw_scan_req->req.n_channels = n_chans;

	ieee80211_prepare_scan_chandef(&chandef, req->scan_width);



	if (req->flags & NL80211_SCAN_FLAG_MIN_PREQ_CONTENT)