UBSAN: array-index-out-of-bounds in ieee80211_del

Title	Replies (including bot)	Last reply
[PATCH 5.4 00/78] 5.4.125-rc1 review	86 (86)	2021/06/16 15:01
[PATCH 4.19 00/58] 4.19.194-rc1 review	69 (69)	2021/06/11 07:28
[PATCH 5.10 00/40] 5.10.3-rc1 review	60 (60)	2021/01/06 23:56
[PATCH] net: wireless: validate key indexes for cfg80211_registered_device	1 (1)	2020/12/04 21:58
[PATCH] net: mac80211: cfg: enforce sanity checks for key_index in ieee80211_del_key()	6 (6)	2020/12/01 12:56
UBSAN: array-index-out-of-bounds in ieee80211_del_key (2)	0 (1)	2020/11/30 16:20

Title

Replies (including bot)

Last reply

[PATCH 5.4 00/78] 5.4.125-rc1 review

86 (86)

2021/06/16 15:01

[PATCH 4.19 00/58] 4.19.194-rc1 review

69 (69)

2021/06/11 07:28

[PATCH 5.10 00/40] 5.10.3-rc1 review

60 (60)

2021/01/06 23:56

[PATCH] net: wireless: validate key indexes for cfg80211_registered_device

1 (1)

2020/12/04 21:58

[PATCH] net: mac80211: cfg: enforce sanity checks for key_index in ieee80211_del_key()

6 (6)

2020/12/01 12:56

UBSAN: array-index-out-of-bounds in ieee80211_del_key (2)

0 (1)

2020/11/30 16:20

Kernel	Title	Repro	Cause bisect	Fix bisect	Count	Last	Reported	Patched	Status
upstream	UBSAN: array-index-out-of-bounds in ieee80211_del_key wireless	C	done		685	1537d	1581d	15/28	fixed on 2020/11/16 12:12

upstream

UBSAN: array-index-out-of-bounds in ieee80211_del_key wireless

done

685

1537d

1581d

15/28

fixed on 2020/11/16 12:12


Created	Duration	User	Patch	Repo	Result
2020/12/04 21:26	17m	anant.thazhemadam@gmail.com	patch	upstream	OK
2020/12/04 19:51	18m	anant.thazhemadam@gmail.com	patch	upstream	OK
2020/12/04 07:41	29m	anant.thazhemadam@gmail.com	patch	upstream	report log
2020/12/01 11:11	17m	anant.thazhemadam@gmail.com	patch	upstream	OK
2020/12/01 11:11	17m	anant.thazhemadam@gmail.com	patch	upstream	OK
2020/12/01 09:18	17m	anant.thazhemadam@gmail.com	patch	upstream	OK
2020/12/01 01:56	17m	anant.thazhemadam@gmail.com	patch	upstream	OK
2020/12/01 01:36	17m	anant.thazhemadam@gmail.com	patch	upstream	OK

================================================================================ UBSAN: array-index-out-of-bounds in net/mac80211/cfg.c:520:10 index 5 is out of range for type 'ieee80211_key *[4]' CPU: 1 PID: 8478 Comm: syz-executor490 Not tainted 5.10.0-rc6-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x107/0x163 lib/dump_stack.c:118 ubsan_epilogue+0xb/0x5a lib/ubsan.c:148 __ubsan_handle_out_of_bounds.cold+0x62/0x6c lib/ubsan.c:356 ieee80211_del_key+0x3f6/0x440 net/mac80211/cfg.c:520 rdev_del_key net/wireless/rdev-ops.h:107 [inline] nl80211_del_key+0x4b0/0x910 net/wireless/nl80211.c:4292 genl_family_rcv_msg_doit+0x228/0x320 net/netlink/genetlink.c:739 genl_family_rcv_msg net/netlink/genetlink.c:783 [inline] genl_rcv_msg+0x328/0x580 net/netlink/genetlink.c:800 netlink_rcv_skb+0x153/0x420 net/netlink/af_netlink.c:2494 genl_rcv+0x24/0x40 net/netlink/genetlink.c:811 netlink_unicast_kernel net/netlink/af_netlink.c:1304 [inline] netlink_unicast+0x533/0x7d0 net/netlink/af_netlink.c:1330 netlink_sendmsg+0x856/0xd90 net/netlink/af_netlink.c:1919 sock_sendmsg_nosec net/socket.c:651 [inline] sock_sendmsg+0xcf/0x120 net/socket.c:671 ____sys_sendmsg+0x6e8/0x810 net/socket.c:2353 ___sys_sendmsg+0xf3/0x170 net/socket.c:2407 __sys_sendmsg+0xe5/0x1b0 net/socket.c:2440 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x44/0xa9 RIP: 0033:0x449ee9 Code: e8 2c 13 03 00 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db 07 fc ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007ffc2ec54408 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000449ee9 RDX: 0000000000008800 RSI: 0000000020000100 RDI: 0000000000000003 RBP: 0000000000000032 R08: 0000002100000015 R09: 0000002100000015 R10: 0000002100000015 R11: 0000000000000246 R12: 0000000000000003 R13: 0000000000000000 R14: 0000000000000048 R15: 0000000000000004 ================================================================================

Crashes (3):
Time	Kernel	Commit	Syzkaller	Config	Log	Report	Syz repro	C repro	VM info	Manager
2020/12/05 08:35	upstream	e87297fa080a	20366b87	.config	console log	report	syz	C		ci-upstream-kasan-gce
2020/11/30 00:05	upstream	aae5ab854e38	a0092f9d	.config	console log	report	syz	C		ci-upstream-kasan-gce
2020/12/09 06:42	net-old	72d05c00d7ec	40cc414d	.config	console log	report			info	ci-upstream-net-this-kasan-gce

Crashes (3):

Assets (help?)