From: Ben Greear <greearb@candelatech.com>
To: "linux-wireless@vger.kernel.org" <linux-wireless@vger.kernel.org>
Subject: mac80211 kasan splat, hacked 4.4.6+, ath10k with modified 10.4.3 fw
Date: Fri, 1 Apr 2016 08:56:00 -0700 [thread overview]
Message-ID: <56FE9A10.1060908@candelatech.com> (raw)
I saw this splat yesterday evening... Any ideas on what this could be?
I'll add some bounds checking on the rate->idx in case that is the issue...
(gdb) l *(sta_set_rate_info_tx+0x1b3)
0x38dcc is in sta_set_rate_info_tx (/home/greearb/git/linux-4.4.dev.y/net/mac80211/cfg.c:457).
452 u16 brate;
453
454 sband = sta->local->hw.wiphy->bands[
455 ieee80211_get_sdata_band(sta->sdata)];
456 brate = sband->bitrates[rate->idx].bitrate;
457 rinfo->legacy = DIV_ROUND_UP(brate, 1 << shift);
458 }
459 if (rate->flags & IEEE80211_TX_RC_40_MHZ_WIDTH)
460 rinfo->bw = RATE_INFO_BW_40;
461 else if (rate->flags & IEEE80211_TX_RC_80_MHZ_WIDTH)
(gdb)
==================================================================
BUG: KASAN: global-out-of-bounds in sta_set_rate_info_tx+0x1b3/0x262 [mac80211] at addr ffffffffa18a3c0c
Read of size 2 by task cat/19440
Address belongs to variable ath10k_rates+0xac/0xfffffffffffd04c7 [ath10k_core]
CPU: 3 PID: 19440 Comm: cat Tainted: G W O 4.4.6+ #22
Hardware name: To be filled by O.E.M. To be filled by O.E.M./HURONRIVER, BIOS 4.6.5 05/02/2012
0000000000000000 ffff8800a392f878 ffffffff8154ce6c 1ffffffff4314781
fffffbfff4314781 ffff8800a392f8f0 ffffffff812db48c ffffffffa1158da8
0000000000000246 0000000000000246 ffff8801d50287c8 0000000400000003
Call Trace:
[<ffffffff8154ce6c>] dump_stack+0x81/0xb6
[<ffffffff812db48c>] kasan_report+0x347/0x48b
[<ffffffffa1158da8>] ? sta_set_rate_info_tx+0x1b3/0x262 [mac80211]
[<ffffffff812da625>] __asan_load2+0x23/0x68
[<ffffffffa1158da8>] sta_set_rate_info_tx+0x1b3/0x262 [mac80211]
[<ffffffffa112de90>] sta_set_sinfo+0x633/0x11e5 [mac80211]
[<ffffffffa114f92c>] ieee80211_get_station+0x63/0x77 [mac80211]
[<ffffffffa09f8c64>] rdev_get_station+0x131/0x31f [cfg80211]
[<ffffffff81b3424f>] ? __mutex_unlock_slowpath+0x17b/0x196
[<ffffffffa09fcc2c>] cfg80211_wireless_stats+0x13d/0x235 [cfg80211]
[<ffffffffa09fcaef>] ? cfg80211_wext_giwrate+0x1b2/0x1b2 [cfg80211]
[<ffffffff811625b7>] ? ___might_sleep+0xfa/0x223
[<ffffffff81b12736>] get_wireless_stats+0x96/0x9b
[<ffffffff81b12f2d>] wireless_dev_seq_show+0x53/0x1f1
[<ffffffff81321392>] seq_read+0x5c6/0x791
[<ffffffff81320dcc>] ? seq_hlist_start_percpu+0xcb/0xcb
[<ffffffff8118fb86>] ? __lock_is_held+0x29/0x64
[<ffffffff81381db4>] proc_reg_read+0x81/0x9b
[<ffffffff812f1589>] __vfs_read+0xca/0x1da
[<ffffffff812f14bf>] ? fdget_pos+0x19/0x19
[<ffffffff81194d96>] ? lock_release+0x249/0x4ec
[<ffffffff81194a81>] ? lock_acquire+0x167/0x233
[<ffffffff81192a73>] ? mark_held_locks+0x2d/0x90
[<ffffffff811cc983>] ? read_seqcount_begin.constprop.23+0x6b/0x87
[<ffffffff813447bd>] ? __fsnotify_parent+0x31/0x100
[<ffffffff814659e9>] ? fsnotify_perm+0x88/0x95
[<ffffffff81466fcf>] ? security_file_permission+0x4d/0x54
[<ffffffff812f2349>] ? rw_verify_area+0xd7/0x12e
[<ffffffff812f2443>] vfs_read+0xa3/0x100
[<ffffffff812f3176>] SyS_read+0xb5/0x10f
[<ffffffff812f30c1>] ? do_sendfile+0x3d5/0x3d5
[<ffffffff81192cdf>] ? trace_hardirqs_on_caller+0x209/0x250
[<ffffffff81004017>] ? trace_hardirqs_on_thunk+0x17/0x19
[<ffffffff81b36d76>] entry_SYSCALL_64_fastpath+0x16/0x7a
Memory state around the buggy address:
ffffffffa18a3b00: fa fa fa fa 04 fa fa fa fa fa fa fa 00 00 00 00
ffffffffa18a3b80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fa fa
>ffffffffa18a3c00: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 00
^
ffffffffa18a3c80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffffffffa18a3d00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================
Disabling lock debugging due to kernel taint
==================================================================
--
Ben Greear <greearb@candelatech.com>
Candela Technologies Inc http://www.candelatech.com
next reply other threads:[~2016-04-01 15:56 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-04-01 15:56 Ben Greear [this message]
2016-04-04 8:24 ` mac80211 kasan splat, hacked 4.4.6+, ath10k with modified 10.4.3 fw Michal Kazior
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=56FE9A10.1060908@candelatech.com \
--to=greearb@candelatech.com \
--cc=linux-wireless@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.