Re: UBSAN: Undefined behaviour in net/wireless/nl80211.c:718:4: -1665903437 * 100 cannot be represented in type 'int'

From: Paul Menzel
Date: Wed Jan 17 2018 - 07:22:55 EST

Dear Johannes,


On 01/04/18 16:08, Johannes Berg wrote:
Hi,

Can you reproduce this?

[ 54.426491] UBSAN: Undefined behaviour in net/wireless/nl80211.c:718:4
[ 54.426492] signed integer overflow:
[ 54.426493] -1665903437 * 100 cannot be represented in type 'int'

Obviously.

However, it looks like the real reason is that there's some garbage (-
1665903437) in chan->max_power, which is just stack memory being leaked
out...

This should help?

diff --git a/net/wireless/reg.c b/net/wireless/reg.c
index 78e71b0390be..7b42f0bacfd8 100644
--- a/net/wireless/reg.c
+++ b/net/wireless/reg.c
@@ -1769,8 +1769,7 @@ static void handle_reg_beacon(struct wiphy *wiphy, unsigned int chan_idx,
if (wiphy->regulatory_flags & REGULATORY_DISABLE_BEACON_HINTS)
return;
- chan_before.center_freq = chan->center_freq;
- chan_before.flags = chan->flags;
+ chan_before = *chan;
if (chan->flags & IEEE80211_CHAN_NO_IR) {
chan->flags &= ~IEEE80211_CHAN_NO_IR;

Yes it does. Thank you. Rebuilding Linux 4.15-rc8+ with this patch applied, the UBSAN doesnât report this issue anymore.


Kind regards,

Paul

Attachment: smime.p7s
Description: S/MIME Cryptographic Signature