wifi: mac80211: fix UBSAN noise in ieee80211_prep_hw_scan()

When testing the previous patch with CONFIG_UBSAN_BOUNDS, I've
noticed the following:

UBSAN: array-index-out-of-bounds in net/mac80211/scan.c:372:4
index 0 is out of range for type 'struct ieee80211_channel *[]'
CPU: 0 PID: 1435 Comm: wpa_supplicant Not tainted 6.9.0+ #1
Hardware name: LENOVO 20UN005QRT/20UN005QRT <...BIOS details...>
Call Trace:
 <TASK>
 dump_stack_lvl+0x2d/0x90
 __ubsan_handle_out_of_bounds+0xe7/0x140
 ? timerqueue_add+0x98/0xb0
 ieee80211_prep_hw_scan+0x2db/0x480 [mac80211]
 ? __kmalloc+0xe1/0x470
 __ieee80211_start_scan+0x541/0x760 [mac80211]
 rdev_scan+0x1f/0xe0 [cfg80211]
 nl80211_trigger_scan+0x9b6/0xae0 [cfg80211]
 ...<the rest is not too useful...>

Since '__ieee80211_start_scan()' leaves 'hw_scan_req->req.n_channels'
uninitialized, actual boundaries of 'hw_scan_req->req.channels' can't
be checked in 'ieee80211_prep_hw_scan()'. Although an initialization
of 'hw_scan_req->req.n_channels' introduces some confusion around
allocated vs. used VLA members, this shouldn't be a problem since
everything is correctly adjusted soon in 'ieee80211_prep_hw_scan()'.

Cleanup 'kmalloc()' math in '__ieee80211_start_scan()' by using the
convenient 'struct_size()' as well.

Signed-off-by: Dmitry Antipov <[email protected]>
Link: https://msgid.link/[email protected]
[improve (imho) indentation a bit]
Signed-off-by: Johannes Berg <[email protected]>

diff --git a/net/mac80211/scan.c b/net/mac80211/scan.c
index 3da1c5c450358cb77422d48b9e9a0dd5542a7508..8ecc4b710b0e64449c2a03339b3d3093ec939b7b 100644 (file)
--- a/net/mac80211/scan.c
+++ b/net/mac80211/scan.c
@@ -744,15 +744,21 @@ static int __ieee80211_start_scan(struct ieee80211_sub_if_data *sdata,
                        local->hw_scan_ies_bufsize *= n_bands;
                }
 
-               local->hw_scan_req = kmalloc(
-                               sizeof(*local->hw_scan_req) +
-                               req->n_channels * sizeof(req->channels[0]) +
-                               local->hw_scan_ies_bufsize, GFP_KERNEL);
+               local->hw_scan_req = kmalloc(struct_size(local->hw_scan_req,
+                                                        req.channels,
+                                                        req->n_channels) +
+                                            local->hw_scan_ies_bufsize,
+                                            GFP_KERNEL);
                if (!local->hw_scan_req)
                        return -ENOMEM;
 
                local->hw_scan_req->req.ssids = req->ssids;
                local->hw_scan_req->req.n_ssids = req->n_ssids;
+               /* None of the channels are actually set
+                * up but let UBSAN know the boundaries.
+                */
+               local->hw_scan_req->req.n_channels = req->n_channels;
+
                ies = (u8 *)local->hw_scan_req +
                        sizeof(*local->hw_scan_req) +
                        req->n_channels * sizeof(req->channels[0]);