lwfinger / rtl8192ee

Alternate (vendor) driver for RTL8192EE
MIT License
68 stars 12 forks source link

Shift out-of-bounds in phydm_phystatus.c #36

Open agoncharuk opened 4 months ago

agoncharuk commented 4 months ago

Hello folks,

While trying to resolve some instabilities with my wifi card, I found the following report in dmesg:

[   18.028269] ================================================================================
[   19.130673] rfkill: input handler disabled
[   19.464558] ================================================================================
[   19.464561] UBSAN: shift-out-of-bounds in /mnt/ssd/projects/rtl8192ee/hal/phydm/phydm_phystatus.c:1704:73
[   19.464563] shift exponent 63 is too large for 32-bit type 'int'
[   19.464565] CPU: 7 PID: 0 Comm: swapper/7 Tainted: G           OE      6.5.0-27-generic #28~22.04.1-Ubuntu
[   19.464566] Hardware name: Gigabyte Technology Co., Ltd. Z490 UD/Z490 UD, BIOS F20d 03/11/2021
[   19.464567] Call Trace:
[   19.464568]  <IRQ>
[   19.464570]  dump_stack_lvl+0x48/0x70
[   19.464574]  dump_stack+0x10/0x20
[   19.464575]  __ubsan_handle_shift_out_of_bounds+0x1ac/0x360
[   19.464579]  mpt_ProQueryCalTxPower+0x1804/0x2940 [8192ee]
[   19.464605]  odm_phy_status_query+0x4f/0x60 [8192ee]
[   19.464636]  rx_query_phy_status+0x161/0x410 [8192ee]
[   19.464676]  pre_recv_entry+0x3b/0x140 [8192ee]
[   19.464714]  rtl8192ee_recv_tasklet+0x1a9/0x5c0 [8192ee]
[   19.464748]  tasklet_action_common.constprop.0+0xfa/0x1e0
[   19.464750]  tasklet_hi_action+0x1f/0x30
[   19.464751]  __do_softirq+0xd9/0x349
[   19.464754]  ? handle_irq_event+0x52/0x80
[   19.464756]  ? handle_edge_irq+0xda/0x250
[   19.464757]  __irq_exit_rcu+0x75/0xa0
[   19.464759]  irq_exit_rcu+0xe/0x20
[   19.464760]  common_interrupt+0xa4/0xb0
[   19.464762]  </IRQ>
[   19.464762]  <TASK>
[   19.464763]  asm_common_interrupt+0x27/0x40
[   19.464765] RIP: 0010:cpuidle_enter_state+0xda/0x720
[   19.464767] Code: 16 06 ff e8 a8 f5 ff ff 8b 53 04 49 89 c7 0f 1f 44 00 00 31 ff e8 16 c2 04 ff 80 7d d0 00 0f 85 61 02 00 00 fb 0f 1f 44 00 00 <45> 85 f6 0f 88 f7 01 00 00 4d 63 ee 49 83 fd 09 0f 87 19 05 00 00
[   19.464768] RSP: 0018:ffffb93e0016be18 EFLAGS: 00000246
[   19.464769] RAX: 0000000000000000 RBX: ffffd93dffdc0400 RCX: 0000000000000000
[   19.464770] RDX: 0000000000000007 RSI: 0000000000000000 RDI: 0000000000000000
[   19.464771] RBP: ffffb93e0016be68 R08: 0000000000000000 R09: 0000000000000000
[   19.464771] R10: 0000000000000000 R11: 0000000000000000 R12: ffffffff87ed1d60
[   19.464781] R13: 0000000000000002 R14: 0000000000000002 R15: 00000004882d55ea
[   19.464782]  ? cpuidle_enter_state+0xca/0x720
[   19.464783]  ? finish_task_switch.isra.0+0x85/0x2a0
[   19.464785]  cpuidle_enter+0x2e/0x50
[   19.464787]  call_cpuidle+0x23/0x60
[   19.464789]  cpuidle_idle_call+0x11d/0x190
[   19.464790]  do_idle+0x82/0xf0
[   19.464791]  cpu_startup_entry+0x2a/0x30
[   19.464792]  start_secondary+0x129/0x160
[   19.464794]  secondary_startup_64_no_verify+0x190/0x19b
[   19.464797]  </TASK>
[   19.464804] ================================================================================

This seems legit since packet_map is u8 but it is attempted to be shifted by 63. I am not familiar with the code and cannot reason what was the intened behavior, but I'm wondering if this may be causing any stability-related issues with the card?