[Bug 299248] iwlwifi: out-of-bounds access in iwl_mvm_ack_rates()

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=299248

            Bug ID: 299248
           Summary: iwlwifi: out-of-bounds access in iwl_mvm_ack_rates()
           Product: Base System
           Version: CURRENT
          Hardware: Any
                OS: Any
            Status: New
          Severity: Affects Only Me
          Priority: ---
         Component: kern
          Assignee: bugs@FreeBSD.org
          Reporter: markj@FreeBSD.org
                CC: bz@FreeBSD.org

I booted a GENERIC-KASAN kernel on my laptop to try and debug a i915 problem
with drm-kmod 6.12.  The laptop occasionally panics due to an out-of-bounds
read:

panic: ASan: Invalid access, 2-byte read at 0xffffffff871b9e16,
GenericRedZone(fa)
cpuid = 0
time = 1791551840
KDB: stack backtrace:
db_trace_self_wrapper() at db_trace_self_wrapper+0xa5/frame 0xfffffe01fbb32270
kdb_backtrace() at kdb_backtrace+0xc6/frame 0xfffffe01fbb323d0
vpanic() at vpanic+0x214/frame 0xfffffe01fbb32570
panic() at panic+0xb5/frame 0xfffffe01fbb32640
kasan_report() at kasan_report+0xdf/frame 0xfffffe01fbb32710
iwl_mvm_set_fw_basic_rates() at iwl_mvm_set_fw_basic_rates+0x13c/frame
0xfffffe01fbb32770
iwl_mvm_link_changed() at iwl_mvm_link_changed+0x3ce/frame 0xfffffe01fbb32980
__iwl_mvm_mld_assign_vif_chanctx() at
__iwl_mvm_mld_assign_vif_chanctx+0x134/frame 0xfffffe01fbb329d0
iwl_mvm_mld_assign_vif_chanctx() at iwl_mvm_mld_assign_vif_chanctx+0x86/frame
0xfffffe01fbb32a10
lkpi_80211_mo_assign_vif_chanctx() at
lkpi_80211_mo_assign_vif_chanctx+0xfc/frame 0xfffffe01fbb32a60
lkpi_set_chanctx_conf() at lkpi_set_chanctx_conf+0x292/frame 0xfffffe01fbb32ad0
lkpi_sta_scan_to_auth() at lkpi_sta_scan_to_auth+0x7e5/frame 0xfffffe01fbb32c60
lkpi_iv_newstate() at lkpi_iv_newstate+0x477/frame 0xfffffe01fbb32cf0
ieee80211_newstate_cb() at ieee80211_newstate_cb+0x253/frame 0xfffffe01fbb32d50
taskqueue_run_locked() at taskqueue_run_locked+0x38e/frame 0xfffffe01fbb32eb0
taskqueue_thread_loop() at taskqueue_thread_loop+0x138/frame 0xfffffe01fbb32ef0
fork_exit() at fork_exit+0xa3/frame 0xfffffe01fbb32f30
fork_trampoline() at fork_trampoline+0xe/frame 0xfffffe01fbb32f30
--- trap 0xc, rip = 0x33645676df9a, rsp = 0x33654db7deb8, rbp = 0x33654db7ded0
---

From kgdb, the access occurs in iwl_mvm_ack_rates(), on line 341:

341        int hw = sband->bitrates[i].hw_value;

Happy to provide more debugging info.

-- 
You are receiving this mail because:
You are the assignee for the bug.