From: Luxiao Xu In TRACE_EVENT(cfg80211_get_bss), the ssid payload is declared as a dynamic array sized by ssid_len: __dynamic_array(u8, ssid, ssid_len) However, TP_printk unconditionally reads the first byte of ssid: ((u8 *)__get_dynamic_array(ssid))[0] User space requests such as nl80211_authenticate() determine ssid_len directly from netlink attribute length via nla_len(). When user space passes a zero-length NL80211_ATTR_SSID, cfg80211_get_bss() is called with ssid_len == 0. In this case, the dynamic array has a length of 0 bytes, but TP_printk still attempts to read index 0 when reading from trace_pipe, triggering a KASAN slab-out-of-bounds read. Check __get_dynamic_array_len(ssid) before accessing the array, returning 0 if the SSID length is zero. Fixes: 4ee3e063f10a ("cfg80211: add cfg80211 exported function tracing") Cc: stable@vger.kernel.org Reported-by: Xin Liu Signed-off-by: Luxiao Xu Signed-off-by: Ren Wei --- net/wireless/trace.h | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/net/wireless/trace.h b/net/wireless/trace.h index 31000ffebe43..5eabd3b9823c 100644 --- a/net/wireless/trace.h +++ b/net/wireless/trace.h @@ -3971,7 +3971,9 @@ TRACE_EVENT(cfg80211_get_bss, TP_printk(WIPHY_PR_FMT ", " CHAN_PR_FMT ", %pM" ", buf: %#.2x, bss_type: %d, privacy: %d", WIPHY_PR_ARG, CHAN_PR_ARG, __entry->bssid, - ((u8 *)__get_dynamic_array(ssid))[0], __entry->bss_type, + __get_dynamic_array_len(ssid) ? + ((u8 *)__get_dynamic_array(ssid))[0] : 0, + __entry->bss_type, __entry->privacy) ); -- 2.43.0