Bug#1119093: UBSAN array-index-out-of-bounds in ath5k driver

[Vincent Danjean <vdanjean@debian.org>]

Le 03/11/2025 à 08:04, Jiri Slaby a écrit :
> This™:
> --- a/drivers/net/wireless/ath/ath5k/base.c
> +++ b/drivers/net/wireless/ath/ath5k/base.c
> @@ -1738,7 +1738,8 @@ ath5k_tx_frame_completed(struct ath5k_hw *ah, struct sk_buff *skb,
>          }
>
>          info->status.rates[ts->ts_final_idx].count = ts->ts_final_retry;
> -       info->status.rates[ts->ts_final_idx + 1].idx = -1;
> +       if (ts->ts_final_idx + 1 < IEEE80211_TX_MAX_RATES)
> +               info->status.rates[ts->ts_final_idx + 1].idx = -1;
>
>          if (unlikely(ts->ts_status)) {
>                  ah->stats.ack_fail++;
>
> Vincent, can you test this?

It is not easy for me: the computer with this wifi card is in my parent's home.
I won't go back there until Christmas.

I will see if I can test remotely.

  Regards,
    Vincent

> > FWIW, the effect of the UB is it just overwrites the next member of info->status, i.e. ack_signal.
> >
> > thanks,