[syzbot] [wireless?] UBSAN: array-index-out-of-bounds in ieee80211_request_ibss_scan

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: 5bc1018675ec Merge tag 'pci-v6.15-fixes-3' of git://git.ke..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=17ca0374580000
kernel config: https://syzkaller.appspot.com/x/.config?x=90837c100b88a636
dashboard link: https://syzkaller.appspot.com/bug?extid=4bcdddd48bb6f0be0da1
compiler: Debian clang version 20.1.2 (++20250402124445+58df0ef89dd6-1~exp1~20250402004600.97), Debian LLD 20.1.2
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=11a39d74580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=106fa270580000

Downloadable assets:
disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/7feb34a89c2a/non_bootable_disk-5bc10186.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/3a2f39285e07/vmlinux-5bc10186.xz
kernel image: https://storage.googleapis.com/syzbot-assets/2a37a55f34fb/bzImage-5bc10186.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/cc5918853785/mount_4.gz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+4bcddd...@syzkaller.appspotmail.com

wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
wlan1: Trigger new scan to find an IBSS to join
------------[ cut here ]------------
UBSAN: array-index-out-of-bounds in net/mac80211/scan.c:1208:5
index 0 is out of range for type 'struct ieee80211_channel *[] __counted_by(n_channels)' (aka 'struct ieee80211_channel *[]')
CPU: 0 UID: 0 PID: 131 Comm: kworker/u4:5 Not tainted 6.15.0-rc3-syzkaller-00342-g5bc1018675ec #0 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Workqueue: events_unbound cfg80211_wiphy_work
Call Trace:
<TASK>
dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120
ubsan_epilogue+0xa/0x40 lib/ubsan.c:231
__ubsan_handle_out_of_bounds+0xe9/0xf0 lib/ubsan.c:453
ieee80211_request_ibss_scan+0x600/0x8b0 net/mac80211/scan.c:1208
ieee80211_sta_find_ibss net/mac80211/ibss.c:-1 [inline]
ieee80211_ibss_work+0xde7/0x1060 net/mac80211/ibss.c:1670
cfg80211_wiphy_work+0x2dc/0x460 net/wireless/core.c:435
process_one_work kernel/workqueue.c:3238 [inline]
process_scheduled_works+0xadb/0x17a0 kernel/workqueue.c:3319
worker_thread+0x8a0/0xda0 kernel/workqueue.c:3400
kthread+0x70e/0x8a0 kernel/kthread.c:464
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:153
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
</TASK>
---[ end trace ]---
Kernel panic - not syncing: UBSAN: panic_on_warn set ...
CPU: 0 UID: 0 PID: 131 Comm: kworker/u4:5 Not tainted 6.15.0-rc3-syzkaller-00342-g5bc1018675ec #0 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Workqueue: events_unbound cfg80211_wiphy_work
Call Trace:
<TASK>
dump_stack_lvl+0x99/0x250 lib/dump_stack.c:120
panic+0x2db/0x790 kernel/panic.c:354
check_panic_on_warn+0x89/0xb0 kernel/panic.c:243
__ubsan_handle_out_of_bounds+0xe9/0xf0 lib/ubsan.c:453
ieee80211_request_ibss_scan+0x600/0x8b0 net/mac80211/scan.c:1208
ieee80211_sta_find_ibss net/mac80211/ibss.c:-1 [inline]
ieee80211_ibss_work+0xde7/0x1060 net/mac80211/ibss.c:1670
cfg80211_wiphy_work+0x2dc/0x460 net/wireless/core.c:435
process_one_work kernel/workqueue.c:3238 [inline]
process_scheduled_works+0xadb/0x17a0 kernel/workqueue.c:3319
worker_thread+0x8a0/0xda0 kernel/workqueue.c:3400
kthread+0x70e/0x8a0 kernel/kthread.c:464
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:153
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
</TASK>
Kernel Offset: disabled
Rebooting in 86400 seconds..


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

[Edward Adam Davis]

#syz test

diff --git a/net/mac80211/scan.c b/net/mac80211/scan.c
index cb7079071885..e73cd9eb164e 100644
--- a/net/mac80211/scan.c
+++ b/net/mac80211/scan.c
@@ -1194,7 +1194,9 @@ int ieee80211_request_ibss_scan(struct ieee80211_sub_if_data *sdata,
band == NL80211_BAND_6GHZ)
continue;

- max_n = local->hw.wiphy->bands[band]->n_channels;
+ max_n = min_t(int,
+ local->hw.wiphy->bands[band]->n_channels,
+ local->int_scan_req->n_channels);
for (i = 0; i < max_n; i++) {
struct ieee80211_channel *tmp_ch =
&local->hw.wiphy->bands[band]->channels[i];

[syzbot]

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
WARNING in ieee80211_request_ibss_scan

wlan1: Trigger new scan to find an IBSS to join
------------[ cut here ]------------

WARNING: CPU: 0 PID: 42 at net/mac80211/scan.c:1215 ieee80211_request_ibss_scan+0x83f/0x8c0 net/mac80211/scan.c:1215
Modules linked in:
CPU: 0 UID: 0 PID: 42 Comm: kworker/u4:3 Not tainted 6.15.0-rc4-syzkaller-gca91b9500108-dirty #0 PREEMPT(full)

Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Workqueue: events_unbound cfg80211_wiphy_work

RIP: 0010:ieee80211_request_ibss_scan+0x83f/0x8c0 net/mac80211/scan.c:1215
Code: e8 16 68 f7 f6 eb 05 e8 0f 68 f7 f6 b8 ea ff ff ff e9 ea f8 ff ff e8 00 68 f7 f6 90 0f 0b 90 e9 aa f8 ff ff e8 f2 67 f7 f6 90 <0f> 0b 90 eb dd 48 c7 c1 50 f8 7e 8f 80 e1 07 80 c1 03 38 c1 0f 8c
RSP: 0000:ffffc900005df8a0 EFLAGS: 00010293
RAX: ffffffff8ac856de RBX: 0000000000000000 RCX: ffff88801d0cc880
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000033 R08: 0000000000000000 R09: 1ffff920000bbec4
R10: dffffc0000000000 R11: fffff520000bbec5 R12: ffff88803e1ca9a8
R13: dffffc0000000000 R14: 0000000000000000 R15: ffff88803e1c8e80
FS: 0000000000000000(0000) GS:ffff88808d6cc000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f4a7adaf8e5 CR3: 0000000058672000 CR4: 0000000000352ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>

ieee80211_sta_find_ibss net/mac80211/ibss.c:-1 [inline]
ieee80211_ibss_work+0xde7/0x1060 net/mac80211/ibss.c:1670
cfg80211_wiphy_work+0x2dc/0x460 net/wireless/core.c:435
process_one_work kernel/workqueue.c:3238 [inline]
process_scheduled_works+0xadb/0x17a0 kernel/workqueue.c:3319
worker_thread+0x8a0/0xda0 kernel/workqueue.c:3400
kthread+0x70e/0x8a0 kernel/kthread.c:464
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:153
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
</TASK>

Tested on:

commit: ca91b950 Merge tag 'v6.15-rc4-ksmbd-server-fixes' of g..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=1059d374580000
kernel config: https://syzkaller.appspot.com/x/.config?x=714654674710be70

dashboard link: https://syzkaller.appspot.com/bug?extid=4bcdddd48bb6f0be0da1
compiler: Debian clang version 20.1.2 (++20250402124445+58df0ef89dd6-1~exp1~20250402004600.97), Debian LLD 20.1.2

patch: https://syzkaller.appspot.com/x/patch.diff?x=14a01374580000

[Edward Adam Davis]

#syz test

diff --git a/net/mac80211/main.c b/net/mac80211/main.c
index 741e6c7edcb7..6842c3011a99 100644
--- a/net/mac80211/main.c
+++ b/net/mac80211/main.c
@@ -1353,6 +1353,8 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
hw->wiphy->interface_modes |= BIT(NL80211_IFTYPE_MONITOR);
hw->wiphy->software_iftypes |= BIT(NL80211_IFTYPE_MONITOR);

+ if (!channels)
+ return -EINVAL;

local->int_scan_req = kzalloc(sizeof(*local->int_scan_req) +
sizeof(void *) * channels, GFP_KERNEL);

[syzbot]

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:

UBSAN: array-index-out-of-bounds in ieee80211_request_ibss_scan

wlan1: Trigger new scan to find an IBSS to join
------------[ cut here ]------------

UBSAN: array-index-out-of-bounds in net/mac80211/scan.c:1208:5
index 0 is out of range for type 'struct ieee80211_channel *[] __counted_by(n_channels)' (aka 'struct ieee80211_channel *[]')

CPU: 0 UID: 0 PID: 1038 Comm: kworker/u4:7 Not tainted 6.15.0-rc4-syzkaller-gca91b9500108-dirty #0 PREEMPT(full)

Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Workqueue: events_unbound cfg80211_wiphy_work

Call Trace:
<TASK>
dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120
ubsan_epilogue+0xa/0x40 lib/ubsan.c:231
__ubsan_handle_out_of_bounds+0xe9/0xf0 lib/ubsan.c:453
ieee80211_request_ibss_scan+0x600/0x8b0 net/mac80211/scan.c:1208

ieee80211_sta_find_ibss net/mac80211/ibss.c:-1 [inline]
ieee80211_ibss_work+0xde7/0x1060 net/mac80211/ibss.c:1670
cfg80211_wiphy_work+0x2dc/0x460 net/wireless/core.c:435
process_one_work kernel/workqueue.c:3238 [inline]
process_scheduled_works+0xadb/0x17a0 kernel/workqueue.c:3319
worker_thread+0x8a0/0xda0 kernel/workqueue.c:3400
kthread+0x70e/0x8a0 kernel/kthread.c:464
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:153
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
</TASK>

---[ end trace ]---
Kernel panic - not syncing: UBSAN: panic_on_warn set ...

CPU: 0 UID: 0 PID: 1038 Comm: kworker/u4:7 Not tainted 6.15.0-rc4-syzkaller-gca91b9500108-dirty #0 PREEMPT(full)

Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Workqueue: events_unbound cfg80211_wiphy_work

Call Trace:
<TASK>
dump_stack_lvl+0x99/0x250 lib/dump_stack.c:120
panic+0x2db/0x790 kernel/panic.c:354
check_panic_on_warn+0x89/0xb0 kernel/panic.c:243
__ubsan_handle_out_of_bounds+0xe9/0xf0 lib/ubsan.c:453
ieee80211_request_ibss_scan+0x600/0x8b0 net/mac80211/scan.c:1208

ieee80211_sta_find_ibss net/mac80211/ibss.c:-1 [inline]
ieee80211_ibss_work+0xde7/0x1060 net/mac80211/ibss.c:1670
cfg80211_wiphy_work+0x2dc/0x460 net/wireless/core.c:435
process_one_work kernel/workqueue.c:3238 [inline]
process_scheduled_works+0xadb/0x17a0 kernel/workqueue.c:3319
worker_thread+0x8a0/0xda0 kernel/workqueue.c:3400
kthread+0x70e/0x8a0 kernel/kthread.c:464
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:153
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
</TASK>

Kernel Offset: disabled
Rebooting in 86400 seconds..

Tested on:

commit: ca91b950 Merge tag 'v6.15-rc4-ksmbd-server-fixes' of g..
git tree: upstream

console output: https://syzkaller.appspot.com/x/log.txt?x=12847374580000

kernel config: https://syzkaller.appspot.com/x/.config?x=714654674710be70
dashboard link: https://syzkaller.appspot.com/bug?extid=4bcdddd48bb6f0be0da1
compiler: Debian clang version 20.1.2 (++20250402124445+58df0ef89dd6-1~exp1~20250402004600.97), Debian LLD 20.1.2

patch: https://syzkaller.appspot.com/x/patch.diff?x=10911374580000

[Edward Adam Davis]

#syz test

diff --git a/net/mac80211/ibss.c b/net/mac80211/ibss.c
index 4246d168374f..b709864c7ceb 100644
--- a/net/mac80211/ibss.c
+++ b/net/mac80211/ibss.c
@@ -1818,6 +1818,12 @@ int ieee80211_ibss_join(struct ieee80211_sub_if_data *sdata,
sdata->deflink.needed_rx_chains = local->rx_chains;
sdata->control_port_over_nl80211 = params->control_port_over_nl80211;

+ struct ieee80211_local *local = sdata->local;
+ if (local && local->int_scan_req) {
+ printk("sd: %p, l: %p, nch: %d, %s\n", sdata, local, local->int_scan_req->n_channels, __func__);
+ if (!local->int_scan_req->n_channels)
+ return -EINVAL;
+ }
wiphy_work_queue(local->hw.wiphy, &sdata->work);

return 0;

[syzbot]

Hello,

syzbot tried to test the proposed patch but the build/boot failed:

net/mac80211/ibss.c:1821:26: error: redefinition of 'local'

Tested on:

commit: ca91b950 Merge tag 'v6.15-rc4-ksmbd-server-fixes' of g..
git tree: upstream

kernel config: https://syzkaller.appspot.com/x/.config?x=90837c100b88a636

dashboard link: https://syzkaller.appspot.com/bug?extid=4bcdddd48bb6f0be0da1
compiler: Debian clang version 20.1.2 (++20250402124445+58df0ef89dd6-1~exp1~20250402004600.97), Debian LLD 20.1.2

patch: https://syzkaller.appspot.com/x/patch.diff?x=15e87270580000

[Edward Adam Davis]

#syz test

diff --git a/net/mac80211/ibss.c b/net/mac80211/ibss.c

index 4246d168374f..94eb2fb80aaf 100644
--- a/net/mac80211/ibss.c
+++ b/net/mac80211/ibss.c
@@ -1818,6 +1818,11 @@ int ieee80211_ibss_join(struct ieee80211_sub_if_data *sdata,

sdata->deflink.needed_rx_chains = local->rx_chains;
sdata->control_port_over_nl80211 = params->control_port_over_nl80211;

[syzbot]

Hello,

syzbot has tested the proposed patch and the reproducer did not trigger any issue:

Reported-by: syzbot+4bcddd...@syzkaller.appspotmail.com
Tested-by: syzbot+4bcddd...@syzkaller.appspotmail.com

Tested on:

commit: ca91b950 Merge tag 'v6.15-rc4-ksmbd-server-fixes' of g..
git tree: upstream

console output: https://syzkaller.appspot.com/x/log.txt?x=108e08d4580000
kernel config: https://syzkaller.appspot.com/x/.config?x=714654674710be70

dashboard link: https://syzkaller.appspot.com/bug?extid=4bcdddd48bb6f0be0da1
compiler: Debian clang version 20.1.2 (++20250402124445+58df0ef89dd6-1~exp1~20250402004600.97), Debian LLD 20.1.2

patch: https://syzkaller.appspot.com/x/patch.diff?x=13993374580000

Note: testing is done by a robot and is best-effort only.

[Edward Adam Davis]

#syz test

diff --git a/net/mac80211/ibss.c b/net/mac80211/ibss.c

index 4246d168374f..1048a05fec5e 100644
--- a/net/mac80211/ibss.c
+++ b/net/mac80211/ibss.c
@@ -1732,6 +1732,9 @@ int ieee80211_ibss_join(struct ieee80211_sub_if_data *sdata,
return -EOPNOTSUPP;
}

+ if (local->int_scan_req && !local->int_scan_req->n_channels)
+ return -EINVAL;
+
ret = cfg80211_chandef_dfs_required(local->hw.wiphy,
&params->chandef,
sdata->wdev.iftype);

[syzbot]

Hello,

syzbot has tested the proposed patch and the reproducer did not trigger any issue:

Reported-by: syzbot+4bcddd...@syzkaller.appspotmail.com
Tested-by: syzbot+4bcddd...@syzkaller.appspotmail.com

Tested on:

commit: b6ea1680 Merge tag 'v6.15-p6' of git://git.kernel.org/..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=16ba68d4580000

kernel config: https://syzkaller.appspot.com/x/.config?x=714654674710be70
dashboard link: https://syzkaller.appspot.com/bug?extid=4bcdddd48bb6f0be0da1
compiler: Debian clang version 20.1.2 (++20250402124445+58df0ef89dd6-1~exp1~20250402004600.97), Debian LLD 20.1.2

patch: https://syzkaller.appspot.com/x/patch.diff?x=126a68d4580000

[Edward Adam Davis]

[syzbot]

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
UBSAN: array-index-out-of-bounds in ieee80211_request_ibss_scan

wlan1: Trigger new scan to find an IBSS to join
------------[ cut here ]------------
UBSAN: array-index-out-of-bounds in net/mac80211/scan.c:1208:5
index 0 is out of range for type 'struct ieee80211_channel *[] __counted_by(n_channels)' (aka 'struct ieee80211_channel *[]')

CPU: 0 UID: 0 PID: 3017 Comm: kworker/u4:10 Not tainted 6.15.0-rc5-syzkaller-00032-g0d8d44db295c-dirty #0 PREEMPT(full)

Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Workqueue: events_unbound cfg80211_wiphy_work
Call Trace:
<TASK>
dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120
ubsan_epilogue+0xa/0x40 lib/ubsan.c:231
__ubsan_handle_out_of_bounds+0xe9/0xf0 lib/ubsan.c:453
ieee80211_request_ibss_scan+0x600/0x8b0 net/mac80211/scan.c:1208
ieee80211_sta_find_ibss net/mac80211/ibss.c:-1 [inline]
ieee80211_ibss_work+0xde7/0x1060 net/mac80211/ibss.c:1670
cfg80211_wiphy_work+0x2dc/0x460 net/wireless/core.c:435
process_one_work kernel/workqueue.c:3238 [inline]
process_scheduled_works+0xadb/0x17a0 kernel/workqueue.c:3319
worker_thread+0x8a0/0xda0 kernel/workqueue.c:3400
kthread+0x70e/0x8a0 kernel/kthread.c:464
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:153
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
</TASK>
---[ end trace ]---
Kernel panic - not syncing: UBSAN: panic_on_warn set ...

CPU: 0 UID: 0 PID: 3017 Comm: kworker/u4:10 Not tainted 6.15.0-rc5-syzkaller-00032-g0d8d44db295c-dirty #0 PREEMPT(full)

Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Workqueue: events_unbound cfg80211_wiphy_work
Call Trace:
<TASK>
dump_stack_lvl+0x99/0x250 lib/dump_stack.c:120
panic+0x2db/0x790 kernel/panic.c:354
check_panic_on_warn+0x89/0xb0 kernel/panic.c:243
__ubsan_handle_out_of_bounds+0xe9/0xf0 lib/ubsan.c:453
ieee80211_request_ibss_scan+0x600/0x8b0 net/mac80211/scan.c:1208
ieee80211_sta_find_ibss net/mac80211/ibss.c:-1 [inline]
ieee80211_ibss_work+0xde7/0x1060 net/mac80211/ibss.c:1670
cfg80211_wiphy_work+0x2dc/0x460 net/wireless/core.c:435
process_one_work kernel/workqueue.c:3238 [inline]
process_scheduled_works+0xadb/0x17a0 kernel/workqueue.c:3319
worker_thread+0x8a0/0xda0 kernel/workqueue.c:3400
kthread+0x70e/0x8a0 kernel/kthread.c:464
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:153
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
</TASK>
Kernel Offset: disabled
Rebooting in 86400 seconds..


Tested on:

commit: 0d8d44db Merge tag 'for-6.15-rc5-tag' of git://git.ker..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=153684d4580000
kernel config: https://syzkaller.appspot.com/x/.config?x=923d9ad0afad47e5

dashboard link: https://syzkaller.appspot.com/bug?extid=4bcdddd48bb6f0be0da1
compiler: Debian clang version 20.1.2 (++20250402124445+58df0ef89dd6-1~exp1~20250402004600.97), Debian LLD 20.1.2

patch: https://syzkaller.appspot.com/x/patch.diff?x=122571cc580000

[Edward Adam Davis]

#syz test

diff --git a/net/mac80211/scan.c b/net/mac80211/scan.c

index cb7079071885..88ee1ce44e8e 100644
--- a/net/mac80211/scan.c
+++ b/net/mac80211/scan.c
@@ -369,6 +369,9 @@ static bool ieee80211_prep_hw_scan(struct ieee80211_sub_if_data *sdata)
return false;

if (ieee80211_hw_check(&local->hw, SINGLE_SCAN_ON_ALL_BANDS)) {
+ if (WARN_ON_ONCE(req->n_channels == 0))
+ return -EINVAL;
+
local->hw_scan_req->req.n_channels = req->n_channels;

for (i = 0; i < req->n_channels; i++) {
@@ -760,6 +763,9 @@ static int __ieee80211_start_scan(struct ieee80211_sub_if_data *sdata,
/* None of the channels are actually set
* up but let UBSAN know the boundaries.
*/
+ if (WARN_ON_ONCE(req->n_channels == 0))
+ return -EINVAL;
+
local->hw_scan_req->req.n_channels = req->n_channels;

ies = (u8 *)local->hw_scan_req +

[syzbot]

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
UBSAN: array-index-out-of-bounds in ieee80211_request_ibss_scan

wlan1: Trigger new scan to find an IBSS to join
------------[ cut here ]------------

UBSAN: array-index-out-of-bounds in net/mac80211/scan.c:1214:5

index 0 is out of range for type 'struct ieee80211_channel *[] __counted_by(n_channels)' (aka 'struct ieee80211_channel *[]')

CPU: 0 UID: 0 PID: 47 Comm: kworker/u4:3 Not tainted 6.15.0-rc5-syzkaller-00032-g0d8d44db295c-dirty #0 PREEMPT(full)

Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Workqueue: events_unbound cfg80211_wiphy_work
Call Trace:
<TASK>
dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120
ubsan_epilogue+0xa/0x40 lib/ubsan.c:231
__ubsan_handle_out_of_bounds+0xe9/0xf0 lib/ubsan.c:453

ieee80211_request_ibss_scan+0x600/0x8b0 net/mac80211/scan.c:1214

ieee80211_sta_find_ibss net/mac80211/ibss.c:-1 [inline]
ieee80211_ibss_work+0xde7/0x1060 net/mac80211/ibss.c:1670
cfg80211_wiphy_work+0x2dc/0x460 net/wireless/core.c:435
process_one_work kernel/workqueue.c:3238 [inline]
process_scheduled_works+0xadb/0x17a0 kernel/workqueue.c:3319
worker_thread+0x8a0/0xda0 kernel/workqueue.c:3400
kthread+0x70e/0x8a0 kernel/kthread.c:464
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:153
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
</TASK>
---[ end trace ]---
Kernel panic - not syncing: UBSAN: panic_on_warn set ...

CPU: 0 UID: 0 PID: 47 Comm: kworker/u4:3 Not tainted 6.15.0-rc5-syzkaller-00032-g0d8d44db295c-dirty #0 PREEMPT(full)

Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Workqueue: events_unbound cfg80211_wiphy_work
Call Trace:
<TASK>
dump_stack_lvl+0x99/0x250 lib/dump_stack.c:120
panic+0x2db/0x790 kernel/panic.c:354
check_panic_on_warn+0x89/0xb0 kernel/panic.c:243
__ubsan_handle_out_of_bounds+0xe9/0xf0 lib/ubsan.c:453

ieee80211_request_ibss_scan+0x600/0x8b0 net/mac80211/scan.c:1214

ieee80211_sta_find_ibss net/mac80211/ibss.c:-1 [inline]
ieee80211_ibss_work+0xde7/0x1060 net/mac80211/ibss.c:1670
cfg80211_wiphy_work+0x2dc/0x460 net/wireless/core.c:435
process_one_work kernel/workqueue.c:3238 [inline]
process_scheduled_works+0xadb/0x17a0 kernel/workqueue.c:3319
worker_thread+0x8a0/0xda0 kernel/workqueue.c:3400
kthread+0x70e/0x8a0 kernel/kthread.c:464
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:153
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
</TASK>
Kernel Offset: disabled
Rebooting in 86400 seconds..


Tested on:

commit: 0d8d44db Merge tag 'for-6.15-rc5-tag' of git://git.ker..
git tree: upstream

console output: https://syzkaller.appspot.com/x/log.txt?x=1177282f980000

kernel config: https://syzkaller.appspot.com/x/.config?x=923d9ad0afad47e5
dashboard link: https://syzkaller.appspot.com/bug?extid=4bcdddd48bb6f0be0da1
compiler: Debian clang version 20.1.2 (++20250402124445+58df0ef89dd6-1~exp1~20250402004600.97), Debian LLD 20.1.2

patch: https://syzkaller.appspot.com/x/patch.diff?x=14f918f4580000

[Kees Cook]

This looks like another case of using the array before specifying the
valid entries:

...
local->int_scan_req->channels[n_ch] = tmp_ch;
n_ch++;
}
}
...
local->int_scan_req->n_channels = n_ch;

n_channels controls what array array entries are valid.

-Kees

--
Kees Cook