UBSAN: array-index-out-of-bounds in ieee80211_del_key (2)

Status: fixed on 2021/03/10 01:48
Subsystems: wireless
[Documentation on labels]
Reported-by: syzbot+49d4cab497c2142ee170@syzkaller.appspotmail.com
Fix commit: 2d9463083ce9 nl80211: validate key indexes for cfg80211_registered_device
First crash: 2071d, last: 2062d
Cause bisection: failed (error log, bisect log)
  
▶ ▼ Discussions (6)
Title Replies (including bot) Last reply
[PATCH 5.4 00/78] 5.4.125-rc1 review 86 (86) 2021/06/16 15:01
[PATCH 4.19 00/58] 4.19.194-rc1 review 69 (69) 2021/06/11 07:28
[PATCH 5.10 00/40] 5.10.3-rc1 review 60 (60) 2021/01/06 23:56
[PATCH] net: wireless: validate key indexes for cfg80211_registered_device 1 (1) 2020/12/04 21:58
[PATCH] net: mac80211: cfg: enforce sanity checks for key_index in ieee80211_del_key() 6 (6) 2020/12/01 12:56
UBSAN: array-index-out-of-bounds in ieee80211_del_key (2) 0 (1) 2020/11/30 16:20
▶ ▼ Similar bugs (1)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream UBSAN: array-index-out-of-bounds in ieee80211_del_key wireless 15 syz, C done 685 2094d 2138d 15/29 fixed on 2020/11/16 12:12
▶ ▼ Last patch testing requests (8)
Created Duration User Patch Repo Result
2020/12/04 21:26 17m anant.thazhemadam@gmail.com patch upstream OK
2020/12/04 19:51 18m anant.thazhemadam@gmail.com patch upstream OK
2020/12/04 07:41 29m anant.thazhemadam@gmail.com patch upstream report log
2020/12/01 11:11 17m anant.thazhemadam@gmail.com patch upstream OK
2020/12/01 11:11 17m anant.thazhemadam@gmail.com patch upstream OK
2020/12/01 09:18 17m anant.thazhemadam@gmail.com patch upstream OK
2020/12/01 01:56 17m anant.thazhemadam@gmail.com patch upstream OK
2020/12/01 01:36 17m anant.thazhemadam@gmail.com patch upstream OK

Sample crash report:
================================================================================
UBSAN: array-index-out-of-bounds in net/mac80211/cfg.c:520:10
index 5 is out of range for type 'ieee80211_key *[4]'
CPU: 1 PID: 8478 Comm: syz-executor490 Not tainted 5.10.0-rc6-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x107/0x163 lib/dump_stack.c:118
 ubsan_epilogue+0xb/0x5a lib/ubsan.c:148
 __ubsan_handle_out_of_bounds.cold+0x62/0x6c lib/ubsan.c:356
 ieee80211_del_key+0x3f6/0x440 net/mac80211/cfg.c:520
 rdev_del_key net/wireless/rdev-ops.h:107 [inline]
 nl80211_del_key+0x4b0/0x910 net/wireless/nl80211.c:4292
 genl_family_rcv_msg_doit+0x228/0x320 net/netlink/genetlink.c:739
 genl_family_rcv_msg net/netlink/genetlink.c:783 [inline]
 genl_rcv_msg+0x328/0x580 net/netlink/genetlink.c:800
 netlink_rcv_skb+0x153/0x420 net/netlink/af_netlink.c:2494
 genl_rcv+0x24/0x40 net/netlink/genetlink.c:811
 netlink_unicast_kernel net/netlink/af_netlink.c:1304 [inline]
 netlink_unicast+0x533/0x7d0 net/netlink/af_netlink.c:1330
 netlink_sendmsg+0x856/0xd90 net/netlink/af_netlink.c:1919
 sock_sendmsg_nosec net/socket.c:651 [inline]
 sock_sendmsg+0xcf/0x120 net/socket.c:671
 ____sys_sendmsg+0x6e8/0x810 net/socket.c:2353
 ___sys_sendmsg+0xf3/0x170 net/socket.c:2407
 __sys_sendmsg+0xe5/0x1b0 net/socket.c:2440
 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x449ee9
Code: e8 2c 13 03 00 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db 07 fc ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007ffc2ec54408 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000449ee9
RDX: 0000000000008800 RSI: 0000000020000100 RDI: 0000000000000003
RBP: 0000000000000032 R08: 0000002100000015 R09: 0000002100000015
R10: 0000002100000015 R11: 0000000000000246 R12: 0000000000000003
R13: 0000000000000000 R14: 0000000000000048 R15: 0000000000000004
================================================================================

Crashes (3):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2020/12/05 08:35 upstream e87297fa080a 20366b87 .config console log report syz C ci-upstream-kasan-gce
2020/11/30 00:05 upstream aae5ab854e38 a0092f9d .config console log report syz C ci-upstream-kasan-gce
2020/12/09 06:42 net-old 72d05c00d7ec 40cc414d .config console log report info ci-upstream-net-this-kasan-gce
* Struck through repros no longer work on HEAD.