From patchwork Fri May 17 15:33:31 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Dmitry Antipov X-Patchwork-Id: 13667157 Received: from forward201c.mail.yandex.net (forward201c.mail.yandex.net [178.154.239.220]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 536E912F398; Fri, 17 May 2024 15:41:01 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=178.154.239.220 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1715960466; cv=none; b=DjPYO4oiT4ePQKmF/O3byrZ9lFi4ycCEL7Vhb9SjtQ3T2861H5QNavXh1FPrwe208mWAQk4KZLrblcAsNtgptXdSQA4CwTxxG2L7PuAOXCh/iHxMW++W4ZbKV8L9EmNcqBvvilZA70Zgm7buZLz7IUCOY3omlDJz6m5d3+wPywE= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1715960466; c=relaxed/simple; bh=0u2MHk2i9OZen3eMY5VE2Cb74f2yioPtycCuCasj6J8=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=h6UCTJE9oMxe4lKkn7TWE4bWgfhfxy9jGrM5g8XHp/upSM+iwN59QrmBS9Y/RsHrTy3oNQx2LbibmXGGq8Td4QQL2CAy+6jI9NC8ZqwETy1HCGLikQFw1r3oFhPfqw3lHuPFTqF1+UnvZT7gK8IHV5qaCN+yGtZcSFh4PjnNlF0= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=yandex.ru; spf=pass smtp.mailfrom=yandex.ru; dkim=pass (1024-bit key) header.d=yandex.ru header.i=@yandex.ru header.b=dKW9lrvO; arc=none smtp.client-ip=178.154.239.220 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=yandex.ru Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=yandex.ru Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=yandex.ru header.i=@yandex.ru header.b="dKW9lrvO" Received: from forward101b.mail.yandex.net (forward101b.mail.yandex.net [IPv6:2a02:6b8:c02:900:1:45:d181:d101]) by forward201c.mail.yandex.net (Yandex) with ESMTPS id 3F2B763FC0; Fri, 17 May 2024 18:33:46 +0300 (MSK) Received: from mail-nwsmtp-smtp-production-main-31.sas.yp-c.yandex.net (mail-nwsmtp-smtp-production-main-31.sas.yp-c.yandex.net [IPv6:2a02:6b8:c08:de2c:0:640:e39b:0]) by forward101b.mail.yandex.net (Yandex) with ESMTPS id E3D65608DE; Fri, 17 May 2024 18:33:37 +0300 (MSK) Received: by mail-nwsmtp-smtp-production-main-31.sas.yp-c.yandex.net (smtp/Yandex) with ESMTPSA id aXHWQ33Zu8c0-K37bRVuG; Fri, 17 May 2024 18:33:37 +0300 X-Yandex-Fwd: 1 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yandex.ru; s=mail; t=1715960017; bh=JzV/mk6KMC1LwaV1EcKob7gOE3lv1oBnCWZ0hjperVQ=; h=Message-ID:Date:Cc:Subject:To:From; b=dKW9lrvOtG0OM5bXZhLrxQYLKDmB5VKtw/mmIY85H9iZSNUKrg/wNcUmXVmRRSdjv KfsIWvfv0VBzgQJxMhWXRo/ZvA0itHohehslvNCvgtXA2cQ0LPz46N1A7K2CjmWpWF 7jWDHpTKeQDe1ddFRfxB8kij+knT8YAkkuI+2aiA= Authentication-Results: mail-nwsmtp-smtp-production-main-31.sas.yp-c.yandex.net; dkim=pass header.i=@yandex.ru From: Dmitry Antipov To: Johannes Berg , Kees Cook , linux-wireless@vger.kernel.org, linux-hardening@vger.kernel.org Cc: Dmitry Antipov Subject: [PATCH 1/2] wifi: cfg80211: use __counted_by where appropriate Date: Fri, 17 May 2024 18:33:31 +0300 Message-ID: <20240517153332.18271-1-dmantipov@yandex.ru> X-Mailer: git-send-email 2.45.0 Precedence: bulk X-Mailing-List: linux-hardening@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Annotate 'sub_specs' of 'struct cfg80211_sar_specs', 'channels' of 'struct cfg80211_sched_scan_request', 'channels' of 'struct cfg80211_wowlan_nd_match', and 'matches' of 'struct cfg80211_wowlan_nd_info' with '__counted_by' attribute. Briefly tested with clang 18.1.1 and CONFIG_UBSAN_BOUNDS running iwlwifi. Signed-off-by: Dmitry Antipov --- include/net/cfg80211.h | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h index cbf1664dc569..d79180bec7a1 100644 --- a/include/net/cfg80211.h +++ b/include/net/cfg80211.h @@ -2200,7 +2200,7 @@ struct cfg80211_sar_sub_specs { struct cfg80211_sar_specs { enum nl80211_sar_type type; u32 num_sub_specs; - struct cfg80211_sar_sub_specs sub_specs[]; + struct cfg80211_sar_sub_specs sub_specs[] __counted_by(num_sub_specs); }; @@ -2838,7 +2838,7 @@ struct cfg80211_sched_scan_request { struct list_head list; /* keep last */ - struct ieee80211_channel *channels[]; + struct ieee80211_channel *channels[] __counted_by(n_channels); }; /** @@ -3582,7 +3582,7 @@ struct cfg80211_coalesce { struct cfg80211_wowlan_nd_match { struct cfg80211_ssid ssid; int n_channels; - u32 channels[]; + u32 channels[] __counted_by(n_channels); }; /** @@ -3596,7 +3596,7 @@ struct cfg80211_wowlan_nd_match { */ struct cfg80211_wowlan_nd_info { int n_matches; - struct cfg80211_wowlan_nd_match *matches[]; + struct cfg80211_wowlan_nd_match *matches[] __counted_by(n_matches); }; /** From patchwork Fri May 17 15:33:32 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Dmitry Antipov X-Patchwork-Id: 13667153 Received: from forward100b.mail.yandex.net (forward100b.mail.yandex.net [178.154.239.147]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id AF38654673; Fri, 17 May 2024 15:33:46 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=178.154.239.147 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1715960032; cv=none; b=XfOMUYTEz453ZX8GQgS6tDZT5h1RfCHzTl1qxwXWUq/npViWF5oeVqQZ2nRvYQpBPF+hKgBZqwx2HqVhBNrbCo2MnqBbG/rznRSuLj2B3CAPXfxdDuJXB6FXewxJ2sHb4m4c5zq83B/Xigsr63gYQUwXFMvLc+k6TeLkKW6H8QQ= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1715960032; c=relaxed/simple; bh=DO0jPXx3Xa5gYc9xzYitx5U9CfWOMS2FByDGkugToec=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=TA5P1FBdXL+xWmq3MipXp9hJPTw+1KrkJsaSP5KEQNkUFU+7inalDU+gIAcffWk1lMAgXIgmT9+gWZYR7oXGbd0K7kIxIPCFcV30wVPtKglLW3ii7izcSvrQoUvBhZeNRJ1E5oy0UZzU0R4LSphSxFW9Yh5yJKT+yKjTVp2jukU= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=yandex.ru; spf=pass smtp.mailfrom=yandex.ru; dkim=pass (1024-bit key) header.d=yandex.ru header.i=@yandex.ru header.b=XAr7cU37; arc=none smtp.client-ip=178.154.239.147 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=yandex.ru Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=yandex.ru Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=yandex.ru header.i=@yandex.ru header.b="XAr7cU37" Received: from mail-nwsmtp-smtp-production-main-31.sas.yp-c.yandex.net (mail-nwsmtp-smtp-production-main-31.sas.yp-c.yandex.net [IPv6:2a02:6b8:c08:de2c:0:640:e39b:0]) by forward100b.mail.yandex.net (Yandex) with ESMTPS id 93DFF60ACA; Fri, 17 May 2024 18:33:38 +0300 (MSK) Received: by mail-nwsmtp-smtp-production-main-31.sas.yp-c.yandex.net (smtp/Yandex) with ESMTPSA id aXHWQ33Zu8c0-tBlIXqJa; Fri, 17 May 2024 18:33:38 +0300 X-Yandex-Fwd: 1 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yandex.ru; s=mail; t=1715960018; bh=IoGGzC4UPODFkDplsAMcg9yw1a+vUefTbBgLr2uPevo=; h=Message-ID:Date:In-Reply-To:Cc:Subject:References:To:From; b=XAr7cU37My2NdN5w4fnEPt1+Df9seakgQ8AK7BXM+RSee2PkVYjplqZ1rW5FQ3UVo da4LuibSFGR59lFzMHBhVCf/+K6wD1QuFmxihgX3DYzlf0J22biQ/QeqO4kKAbwTgJ tECdd7lLGBm5RWZJ9v/bY2qVW4cGUaNh+3CwzrF0= Authentication-Results: mail-nwsmtp-smtp-production-main-31.sas.yp-c.yandex.net; dkim=pass header.i=@yandex.ru From: Dmitry Antipov To: Johannes Berg , Kees Cook , linux-wireless@vger.kernel.org, linux-hardening@vger.kernel.org Cc: Dmitry Antipov Subject: [PATCH 2/2] wifi: mac80211: fix UBSAN noise in ieee80211_prep_hw_scan() Date: Fri, 17 May 2024 18:33:32 +0300 Message-ID: <20240517153332.18271-2-dmantipov@yandex.ru> X-Mailer: git-send-email 2.45.0 In-Reply-To: <20240517153332.18271-1-dmantipov@yandex.ru> References: <20240517153332.18271-1-dmantipov@yandex.ru> Precedence: bulk X-Mailing-List: linux-hardening@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 When testing the previous patch with CONFIG_UBSAN_BOUNDS, I've noticed the following: UBSAN: array-index-out-of-bounds in net/mac80211/scan.c:372:4 index 0 is out of range for type 'struct ieee80211_channel *[]' CPU: 0 PID: 1435 Comm: wpa_supplicant Not tainted 6.9.0+ #1 Hardware name: LENOVO 20UN005QRT/20UN005QRT <...BIOS details...> Call Trace: dump_stack_lvl+0x2d/0x90 __ubsan_handle_out_of_bounds+0xe7/0x140 ? timerqueue_add+0x98/0xb0 ieee80211_prep_hw_scan+0x2db/0x480 [mac80211] ? __kmalloc+0xe1/0x470 __ieee80211_start_scan+0x541/0x760 [mac80211] rdev_scan+0x1f/0xe0 [cfg80211] nl80211_trigger_scan+0x9b6/0xae0 [cfg80211] ... Since '__ieee80211_start_scan()' leaves 'hw_scan_req->req.n_channels' uninitialized, actual boundaries of 'hw_scan_req->req.channels' can't be checked in 'ieee80211_prep_hw_scan()'. Although an initialization of 'hw_scan_req->req.n_channels' introduces some confusion around allocated vs. used VLA members, this shouldn't be a problem since everything is correctly adjusted soon in 'ieee80211_prep_hw_scan()'. Cleanup 'kmalloc()' math in '__ieee80211_start_scan()' by using the convenient 'struct_size()' as well. Signed-off-by: Dmitry Antipov --- net/mac80211/scan.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/net/mac80211/scan.c b/net/mac80211/scan.c index 3da1c5c45035..ab2a11a02673 100644 --- a/net/mac80211/scan.c +++ b/net/mac80211/scan.c @@ -745,14 +745,19 @@ static int __ieee80211_start_scan(struct ieee80211_sub_if_data *sdata, } local->hw_scan_req = kmalloc( - sizeof(*local->hw_scan_req) + - req->n_channels * sizeof(req->channels[0]) + - local->hw_scan_ies_bufsize, GFP_KERNEL); + (struct_size(local->hw_scan_req, + req.channels, req->n_channels) + + local->hw_scan_ies_bufsize), GFP_KERNEL); if (!local->hw_scan_req) return -ENOMEM; local->hw_scan_req->req.ssids = req->ssids; local->hw_scan_req->req.n_ssids = req->n_ssids; + /* None of the channels are actually set + * up but let UBSAN know the boundaries. + */ + local->hw_scan_req->req.n_channels = req->n_channels; + ies = (u8 *)local->hw_scan_req + sizeof(*local->hw_scan_req) + req->n_channels * sizeof(req->channels[0]);