mbox series

[0/1,SRU,Unstable,Oracular,Noble] UBSAN: array-index-out-of-bounds in module mt76

Message ID 20240927103606.2831505-1-vicamo.yang@canonical.com
Headers show
Series UBSAN: array-index-out-of-bounds in module mt76 | expand

Message

You-Sheng Yang Sept. 27, 2024, 10:36 a.m. UTC
BugLink: https://bugs.launchpad.net/bugs/2081785

[Impact]

UBSAN warnings in dmesg:
```
UBSAN: array-index-out-of-bounds in /home/kernel/COD/linux/drivers/net/wireless/mediatek/mt76/mac80211.c:1532:34
index 3 is out of range for type 'mt76_phy *[3]'
```

[Fix]

Proposed fix commit
https://github.com/torvalds/linux/commit/9679ca7326e52282cc923c4d71d81c999cb6cd55
("wifi: mt76: mt7925: fix a potential array-index-out-of-bounds issue for clc"),
which fixes commit
https://github.com/torvalds/linux/commit/c948b5da6bbec742b433138e3e3f9537a85af2e5
("wifi: mt76: mt7925: add Mediatek Wi-Fi7 driver for mt7925 chips") landed in
v6.7.

[Test Case]

UBSAN warning should go away.

[Where problems could occur]

No. This bails out early when error occurs.

[Other Info]

While the affected commit was first introduced in v6.7, nominating all kernels
since then: unstable, oracular, oem-6.11, noble, and oem-6.8.

Ming Yen Hsieh (1):
  wifi: mt76: mt7925: fix a potential array-index-out-of-bounds issue
    for clc

 drivers/net/wireless/mediatek/mt76/mt7925/mcu.c | 3 +++
 1 file changed, 3 insertions(+)

Comments

Mehmet Basaran Sept. 30, 2024, 2:12 p.m. UTC | #1
Acked-by: Mehmet Basaran <mehmet.basaran@canonical.com>
You-Sheng Yang <vicamo.yang@canonical.com> writes:

> BugLink: https://bugs.launchpad.net/bugs/2081785
>
> [Impact]
>
> UBSAN warnings in dmesg:
> ```
> UBSAN: array-index-out-of-bounds in /home/kernel/COD/linux/drivers/net/wireless/mediatek/mt76/mac80211.c:1532:34
> index 3 is out of range for type 'mt76_phy *[3]'
> ```
>
> [Fix]
>
> Proposed fix commit
> https://github.com/torvalds/linux/commit/9679ca7326e52282cc923c4d71d81c999cb6cd55
> ("wifi: mt76: mt7925: fix a potential array-index-out-of-bounds issue for clc"),
> which fixes commit
> https://github.com/torvalds/linux/commit/c948b5da6bbec742b433138e3e3f9537a85af2e5
> ("wifi: mt76: mt7925: add Mediatek Wi-Fi7 driver for mt7925 chips") landed in
> v6.7.
>
> [Test Case]
>
> UBSAN warning should go away.
>
> [Where problems could occur]
>
> No. This bails out early when error occurs.
>
> [Other Info]
>
> While the affected commit was first introduced in v6.7, nominating all kernels
> since then: unstable, oracular, oem-6.11, noble, and oem-6.8.
>
> Ming Yen Hsieh (1):
>   wifi: mt76: mt7925: fix a potential array-index-out-of-bounds issue
>     for clc
>
>  drivers/net/wireless/mediatek/mt76/mt7925/mcu.c | 3 +++
>  1 file changed, 3 insertions(+)
>
> -- 
> 2.45.2
>
>
> -- 
> kernel-team mailing list
> kernel-team@lists.ubuntu.com
> https://lists.ubuntu.com/mailman/listinfo/kernel-team
ivanhu Oct. 1, 2024, 1:09 a.m. UTC | #2
Acked-by: Ivan Hu <ivan.hu@canonical.com>

On 9/27/24 18:36, You-Sheng Yang wrote:
> BugLink: https://bugs.launchpad.net/bugs/2081785
> 
> [Impact]
> 
> UBSAN warnings in dmesg:
> ```
> UBSAN: array-index-out-of-bounds in /home/kernel/COD/linux/drivers/net/wireless/mediatek/mt76/mac80211.c:1532:34
> index 3 is out of range for type 'mt76_phy *[3]'
> ```
> 
> [Fix]
> 
> Proposed fix commit
> https://github.com/torvalds/linux/commit/9679ca7326e52282cc923c4d71d81c999cb6cd55
> ("wifi: mt76: mt7925: fix a potential array-index-out-of-bounds issue for clc"),
> which fixes commit
> https://github.com/torvalds/linux/commit/c948b5da6bbec742b433138e3e3f9537a85af2e5
> ("wifi: mt76: mt7925: add Mediatek Wi-Fi7 driver for mt7925 chips") landed in
> v6.7.
> 
> [Test Case]
> 
> UBSAN warning should go away.
> 
> [Where problems could occur]
> 
> No. This bails out early when error occurs.
> 
> [Other Info]
> 
> While the affected commit was first introduced in v6.7, nominating all kernels
> since then: unstable, oracular, oem-6.11, noble, and oem-6.8.
> 
> Ming Yen Hsieh (1):
>    wifi: mt76: mt7925: fix a potential array-index-out-of-bounds issue
>      for clc
> 
>   drivers/net/wireless/mediatek/mt76/mt7925/mcu.c | 3 +++
>   1 file changed, 3 insertions(+)
>
Timo Aaltonen Oct. 2, 2024, 8:15 a.m. UTC | #3
You-Sheng Yang kirjoitti 27.9.2024 klo 13.36:
> BugLink: https://bugs.launchpad.net/bugs/2081785
> 
> [Impact]
> 
> UBSAN warnings in dmesg:
> ```
> UBSAN: array-index-out-of-bounds in /home/kernel/COD/linux/drivers/net/wireless/mediatek/mt76/mac80211.c:1532:34
> index 3 is out of range for type 'mt76_phy *[3]'
> ```
> 
> [Fix]
> 
> Proposed fix commit
> https://github.com/torvalds/linux/commit/9679ca7326e52282cc923c4d71d81c999cb6cd55
> ("wifi: mt76: mt7925: fix a potential array-index-out-of-bounds issue for clc"),
> which fixes commit
> https://github.com/torvalds/linux/commit/c948b5da6bbec742b433138e3e3f9537a85af2e5
> ("wifi: mt76: mt7925: add Mediatek Wi-Fi7 driver for mt7925 chips") landed in
> v6.7.
> 
> [Test Case]
> 
> UBSAN warning should go away.
> 
> [Where problems could occur]
> 
> No. This bails out early when error occurs.
> 
> [Other Info]
> 
> While the affected commit was first introduced in v6.7, nominating all kernels
> since then: unstable, oracular, oem-6.11, noble, and oem-6.8.
> 
> Ming Yen Hsieh (1):
>    wifi: mt76: mt7925: fix a potential array-index-out-of-bounds issue
>      for clc
> 
>   drivers/net/wireless/mediatek/mt76/mt7925/mcu.c | 3 +++
>   1 file changed, 3 insertions(+)
> 

applied to oracular, thanks