[Bug 299248] iwlwifi: out-of-bounds access in iwl_mvm_ack_rates()

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=299248

--- Comment #2 from Mark Johnston <markj@FreeBSD.org> ---
(In reply to Bjoern A. Zeeb from comment #1)
(kgdb) bt
#0  __curthread () at
/usr/home/markj/sb/main/src/sys/amd64/include/pcpu_aux.h:57
#1  doadump (textdump=textdump@entry=1) at
/usr/home/markj/sb/main/src/sys/kern/kern_shutdown.c:399
#2  0xffffffff812c3038 in kern_reboot (howto=howto@entry=260) at
/usr/home/markj/sb/main/src/sys/kern/kern_shutdown.c:519
#3  0xffffffff812c3712 in vpanic (fmt=fmt@entry=0xffffffff81f440d7 "ASan:
Invalid access, %zu-byte %s at %#lx, %s(%x)", ap=ap@entry=0xfffffe01fbb325e0)
at /usr/home/markj/sb/main/src/sys/kern/kern_shutdown.c:974
#4  0xffffffff812c3465 in panic (fmt=0xffffffff81f440d7 "ASan: Invalid access,
%zu-byte %s at %#lx, %s(%x)") at
/usr/home/markj/sb/main/src/sys/kern/kern_shutdown.c:887
#5  0xffffffff8134da2f in kasan_report (addr=18446744071681318422, size=2,
write=false, pc=<optimized out>, code=<optimized out>) at
/usr/home/markj/sb/main/src/sys/kern/subr_asan.c:202
#6  0xffffffff8706237c in iwl_mvm_ack_rates (mvm=<optimized out>,
vif=<optimized out>, band=<optimized out>, cck_rates=<optimized out>,
ofdm_rates=<optimized out>) at
/usr/home/markj/sb/main/src/sys/contrib/dev/iwlwifi/mvm/mac-ctxt.c:341
#7  iwl_mvm_set_fw_basic_rates (mvm=mvm@entry=0xfffffe01ff581648,
vif=vif@entry=0xfffffe02002d00c0, link_info=link_info@entry=0xfffffe02002d0810,
cck_rates=cck_rates@entry=0xfffffe01fbb32824,
ofdm_rates=ofdm_rates@entry=0xfffffe01fbb32828) at
/usr/home/markj/sb/main/src/sys/contrib/dev/iwlwifi/mvm/mac-ctxt.c:423
#8  0xffffffff87060d9e in iwl_mvm_link_changed (mvm=0xfffffe01ff581648,
vif=vif@entry=0xfffffe02002d00c0, link_conf=link_conf@entry=0xfffffe02002d0130,
changes=changes@entry=0, active=false) at
/usr/home/markj/sb/main/src/sys/contrib/dev/iwlwifi/mvm/link.c:137
#9  0xffffffff87084274 in __iwl_mvm_mld_assign_vif_chanctx (mvm=<optimized
out>, mvm@entry=0xfffffe01ff581648, vif=vif@entry=0xfffffe02002d00c0,
link_conf=link_conf@entry=0xfffffe02002d0130, ctx=ctx@entry=0xfffffe0158986a40,
switching_chanctx=false)
    at
/usr/home/markj/sb/main/src/sys/contrib/dev/iwlwifi/mvm/mld-mac80211.c:214
#10 0xffffffff87082666 in iwl_mvm_mld_assign_vif_chanctx (hw=<optimized out>,
vif=0xfffffe02002d00c0, link_conf=0xfffffe02002d0130, ctx=0xfffffe0158986a40)
at /usr/home/markj/sb/main/src/sys/contrib/dev/iwlwifi/mvm/mld-mac80211.c:268
#11 0xffffffff817cdc2c in lkpi_80211_mo_assign_vif_chanctx
(hw=hw@entry=0xfffffe01ff581580, vif=vif@entry=0xfffffe02002d00c0,
conf=<optimized out>, conf@entry=0xfffffe02002d0130,
chanctx_conf=chanctx_conf@entry=0xfffffe0158986a40) at
/usr/home/markj/sb/main/src/sys/compat/linuxkpi/common/src/linux_80211_macops.c:484
#12 0xffffffff817c3f32 in lkpi_set_chanctx_conf
(hw=hw@entry=0xfffffe01ff581580, vif=vif@entry=0xfffffe02002d00c0,
chanctx_conf=chanctx_conf@entry=0xfffffe0158986a40, changed=changed@entry=13,
changed_set=true) at
/usr/home/markj/sb/main/src/sys/compat/linuxkpi/common/src/linux_80211.c:2656
#13 0xffffffff817ad7e5 in lkpi_sta_scan_to_auth (vap=0xfffffe02002cf010,
nstate=<optimized out>, arg=<optimized out>) at
/usr/home/markj/sb/main/src/sys/compat/linuxkpi/common/src/linux_80211.c:2890
#14 0xffffffff817c8bc7 in lkpi_iv_newstate (vap=0xfffffe02002cf010,
nstate=IEEE80211_S_AUTH, arg=192) at
/usr/home/markj/sb/main/src/sys/compat/linuxkpi/common/src/linux_80211.c:4043
#15 0xffffffff8161c2b3 in ieee80211_newstate_cb (xvap=0xfffffe02002cf010,
npending=npending@entry=1) at
/usr/home/markj/sb/main/src/sys/net80211/ieee80211_proto.c:2609
#16 0xffffffff813a400e in taskqueue_run_locked
(queue=queue@entry=0xfffffe01faaa1e00) at
/usr/home/markj/sb/main/src/sys/kern/subr_taskqueue.c:542
#17 0xffffffff813a5a28 in taskqueue_thread_loop
(arg=arg@entry=0xfffffe01ff585110) at
/usr/home/markj/sb/main/src/sys/kern/subr_taskqueue.c:870
#18 0xffffffff8123c843 in fork_exit (callout=0xffffffff813a58f0
<taskqueue_thread_loop>, arg=0xfffffe01ff585110, frame=0xfffffe01fbb32f40) at
/usr/home/markj/sb/main/src/sys/kern/kern_fork.c:1240
#19 <signal handler called>
#20 0x000033645676df9a in ?? ()
Backtrace stopped: Cannot access memory at address 0x33654db7deb8
(kgdb) frame 6
#6  0xffffffff8706237c in iwl_mvm_ack_rates (mvm=<optimized out>,
vif=<optimized out>, band=<optimized out>, cck_rates=<optimized out>,
ofdm_rates=<optimized out>) at
/usr/home/markj/sb/main/src/sys/contrib/dev/iwlwifi/mvm/mac-ctxt.c:341
341                     int hw = sband->bitrates[i].hw_value;
(kgdb) p i
$1 = 8
(kgdb) frame 7
#7  iwl_mvm_set_fw_basic_rates (mvm=mvm@entry=0xfffffe01ff581648,
vif=vif@entry=0xfffffe02002d00c0, link_info=link_info@entry=0xfffffe02002d0810,
cck_rates=cck_rates@entry=0xfffffe01fbb32824,
ofdm_rates=ofdm_rates@entry=0xfffffe01fbb32828) at
/usr/home/markj/sb/main/src/sys/contrib/dev/iwlwifi/mvm/mac-ctxt.c:423
423             iwl_mvm_ack_rates(mvm, vif, band, &cck_ack_rates,
&ofdm_ack_rates);
(kgdb) p vif->bss_conf.basic_rates
$2 = 351

-- 
You are receiving this mail because:
You are the assignee for the bug.