From: Siddh Raman Pant via Linux-kernel-mentees <linux-kernel-mentees@lists.linuxfoundation.org>
To: Siddh Raman Pant <code@siddh.me>
Cc: linux-wireless <linux-wireless@vger.kernel.org>,
linux-kernel <linux-kernel@vger.kernel.org>,
Eric Dumazet <edumazet@google.com>,
netdev <netdev@vger.kernel.org>, Jakub Kicinski <kuba@kernel.org>,
Johannes Berg <johannes@sipsolutions.net>,
Paolo Abeni <pabeni@redhat.com>,
linux-kernel-mentees
<linux-kernel-mentees@lists.linuxfoundation.org>,
"David S. Miller" <davem@davemloft.net>,
syzbot+b6c9fe29aefe68e4ad34@syzkaller.appspotmail.com
Subject: Re: [PATCH] wifi: mac80211: Don't finalize CSA in IBSS mode if state is disconnected
Date: Thu, 25 Aug 2022 01:41:36 +0530 [thread overview]
Message-ID: <20220824201136.182039-1-code@siddh.me> (raw)
In-Reply-To: <20220814151512.9985-1-code@siddh.me>
On Sun, 14 Aug 2022 20:45:12 +0530 Siddh Raman Pant wrote:
> When we are not connected to a channel, sending channel "switch"
> announcement doesn't make any sense.
>
> The BSS list is empty in that case. This causes the for loop in
> cfg80211_get_bss() to be bypassed, so the function returns NULL
> (check line 1424 of net/wireless/scan.c), causing the WARN_ON()
> in ieee80211_ibss_csa_beacon() to get triggered (check line 500
> of net/mac80211/ibss.c), which was consequently reported on the
> syzkaller dashboard.
>
> Thus, check if we have an existing connection before generating
> the CSA beacon in ieee80211_ibss_finish_csa().
>
> Fixes: cd7760e62c2a ("mac80211: add support for CSA in IBSS mode")
> Bug report: https://syzkaller.appspot.com/bug?id=05603ef4ae8926761b678d2939a3b2ad28ab9ca6
> Reported-by: syzbot+b6c9fe29aefe68e4ad34@syzkaller.appspotmail.com
> Cc: stable@vger.kernel.org
Tested-by: syzbot+b6c9fe29aefe68e4ad34@syzkaller.appspotmail.com
Syzbot is now booting properly and the test ran successfully.
Thanks,
Siddh
> Signed-off-by: Siddh Raman Pant <code@siddh.me>
> ---
> The fixes commit is old, and syzkaller shows the problem exists for
> 4.19 and 4.14 as well, so CC'd stable list.
>
> net/mac80211/ibss.c | 4 ++++
> 1 file changed, 4 insertions(+)
>
> diff --git a/net/mac80211/ibss.c b/net/mac80211/ibss.c
> index d56890e3fabb..9b283bbc7bb4 100644
> --- a/net/mac80211/ibss.c
> +++ b/net/mac80211/ibss.c
> @@ -530,6 +530,10 @@ int ieee80211_ibss_finish_csa(struct ieee80211_sub_if_data *sdata)
>
> sdata_assert_lock(sdata);
>
> + /* When not connected/joined, sending CSA doesn't make sense. */
> + if (ifibss->state != IEEE80211_IBSS_MLME_JOINED)
> + return -ENOLINK;
> +
> /* update cfg80211 bss information with the new channel */
> if (!is_zero_ether_addr(ifibss->bssid)) {
> cbss = cfg80211_get_bss(sdata->local->hw.wiphy,
> --
> 2.35.1
_______________________________________________
Linux-kernel-mentees mailing list
Linux-kernel-mentees@lists.linuxfoundation.org
https://lists.linuxfoundation.org/mailman/listinfo/linux-kernel-mentees
WARNING: multiple messages have this Message-ID (diff)
From: Siddh Raman Pant <code@siddh.me>
To: Siddh Raman Pant <code@siddh.me>
Cc: Greg KH <gregkh@linuxfoundation.org>,
Johannes Berg <johannes@sipsolutions.net>,
"David S. Miller" <davem@davemloft.net>,
Eric Dumazet <edumazet@google.com>,
Jakub Kicinski <kuba@kernel.org>, Paolo Abeni <pabeni@redhat.com>,
linux-wireless <linux-wireless@vger.kernel.org>,
netdev <netdev@vger.kernel.org>,
linux-kernel <linux-kernel@vger.kernel.org>,
linux-kernel-mentees
<linux-kernel-mentees@lists.linuxfoundation.org>,
syzbot+b6c9fe29aefe68e4ad34@syzkaller.appspotmail.com
Subject: Re: [PATCH] wifi: mac80211: Don't finalize CSA in IBSS mode if state is disconnected
Date: Thu, 25 Aug 2022 01:41:36 +0530 [thread overview]
Message-ID: <20220824201136.182039-1-code@siddh.me> (raw)
In-Reply-To: <20220814151512.9985-1-code@siddh.me>
On Sun, 14 Aug 2022 20:45:12 +0530 Siddh Raman Pant wrote:
> When we are not connected to a channel, sending channel "switch"
> announcement doesn't make any sense.
>
> The BSS list is empty in that case. This causes the for loop in
> cfg80211_get_bss() to be bypassed, so the function returns NULL
> (check line 1424 of net/wireless/scan.c), causing the WARN_ON()
> in ieee80211_ibss_csa_beacon() to get triggered (check line 500
> of net/mac80211/ibss.c), which was consequently reported on the
> syzkaller dashboard.
>
> Thus, check if we have an existing connection before generating
> the CSA beacon in ieee80211_ibss_finish_csa().
>
> Fixes: cd7760e62c2a ("mac80211: add support for CSA in IBSS mode")
> Bug report: https://syzkaller.appspot.com/bug?id=05603ef4ae8926761b678d2939a3b2ad28ab9ca6
> Reported-by: syzbot+b6c9fe29aefe68e4ad34@syzkaller.appspotmail.com
> Cc: stable@vger.kernel.org
Tested-by: syzbot+b6c9fe29aefe68e4ad34@syzkaller.appspotmail.com
Syzbot is now booting properly and the test ran successfully.
Thanks,
Siddh
> Signed-off-by: Siddh Raman Pant <code@siddh.me>
> ---
> The fixes commit is old, and syzkaller shows the problem exists for
> 4.19 and 4.14 as well, so CC'd stable list.
>
> net/mac80211/ibss.c | 4 ++++
> 1 file changed, 4 insertions(+)
>
> diff --git a/net/mac80211/ibss.c b/net/mac80211/ibss.c
> index d56890e3fabb..9b283bbc7bb4 100644
> --- a/net/mac80211/ibss.c
> +++ b/net/mac80211/ibss.c
> @@ -530,6 +530,10 @@ int ieee80211_ibss_finish_csa(struct ieee80211_sub_if_data *sdata)
>
> sdata_assert_lock(sdata);
>
> + /* When not connected/joined, sending CSA doesn't make sense. */
> + if (ifibss->state != IEEE80211_IBSS_MLME_JOINED)
> + return -ENOLINK;
> +
> /* update cfg80211 bss information with the new channel */
> if (!is_zero_ether_addr(ifibss->bssid)) {
> cbss = cfg80211_get_bss(sdata->local->hw.wiphy,
> --
> 2.35.1
next prev parent reply other threads:[~2022-08-24 20:12 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-08-14 15:15 [PATCH] wifi: mac80211: Don't finalize CSA in IBSS mode if state is disconnected Siddh Raman Pant via Linux-kernel-mentees
2022-08-14 15:15 ` Siddh Raman Pant
2022-08-15 7:00 ` Greg KH
2022-08-15 7:00 ` Greg KH
2022-08-15 7:24 ` Siddh Raman Pant via Linux-kernel-mentees
2022-08-15 7:24 ` Siddh Raman Pant
2022-08-24 20:11 ` Siddh Raman Pant via Linux-kernel-mentees [this message]
2022-08-24 20:11 ` Siddh Raman Pant
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20220824201136.182039-1-code@siddh.me \
--to=linux-kernel-mentees@lists.linuxfoundation.org \
--cc=code@siddh.me \
--cc=davem@davemloft.net \
--cc=edumazet@google.com \
--cc=johannes@sipsolutions.net \
--cc=kuba@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-wireless@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=pabeni@redhat.com \
--cc=syzbot+b6c9fe29aefe68e4ad34@syzkaller.appspotmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.