From: Bob Copeland <me@bobcopeland.com>
To: linux-wireless@vger.kernel.org
Subject: soft lockup in cfg80211 find_ie()
Date: Tue, 1 Sep 2009 08:17:28 -0400 [thread overview]
Message-ID: <20090901121728.GA15790@hash.localnet> (raw)
Hi,
My laptop was on all night and at some point got stuck in a loop.
Unfortunately I don't know exactly what happened since dmesg buffer
filled up and there was nothing incriminating in /var/log, but
here's my interpretation:
EIP points to line 146:
while (len > 2 && ies[0] != num) ...
ECX holds len, which is negative (unfortunately size_t is unsigned)
EDX holds ies, looks like a valid pointer
EBX holds num, which is 0.
This looks like this is a DoS-able bug if there are any malformed
packets, no? I think we should change 'len' to int here.
[38442.105007] BUG: soft lockup - CPU#0 stuck for 61s! [phy0:2230]
[38442.105007] Modules linked in: aes_i586 aes_generic fuse af_packet ipt_REJECT xt_tcpudp nf_conntrack_ipv4 nf_defrag_ipv4 xt_state iptable_filter ip_tables x_tables acpi_cpufreq binfmt_misc dm_mirror dm_region_hash dm_log dm_multipath dm_mod kvm_intel kvm uinput i915 arc4 ecb drm snd_hda_codec_idt ath5k snd_hda_intel hid_apple mac80211 usbhid appletouch snd_hda_codec snd_pcm ath cfg80211 snd_timer i2c_algo_bit ohci1394 video snd processor ieee1394 rfkill ehci_hcd sg sky2 backlight snd_page_alloc uhci_hcd joydev output ac thermal button battery sr_mod applesmc cdrom input_polldev evdev unix [last unloaded: scsi_wait_scan]
[38442.105007] irq event stamp: 2044208759
[38442.105007] hardirqs last enabled at (2044208758): [<c1002ffc>] restore_all_notrace+0x0/0x18
[38442.105007] hardirqs last disabled at (2044208759): [<c10038f4>] apic_timer_interrupt+0x28/0x34
[38442.105007] softirqs last enabled at (92950144): [<c103ab48>] __do_softirq+0x108/0x210
[38442.105007] softirqs last disabled at (92950274): [<c1348e74>] _spin_lock_bh+0x14/0x80
[38442.105007]
[38442.105007] Pid: 2230, comm: phy0 Tainted: G W (2.6.31-rc7-wl #8) MacBook1,1
[38442.105007] EIP: 0060:[<f8ea2d50>] EFLAGS: 00010292 CPU: 0
[38442.105007] EIP is at cmp_ies+0x30/0x180 [cfg80211]
[38442.105007] EAX: 00000082 EBX: 00000000 ECX: ffffffc1 EDX: d8efd014
[38442.105007] ESI: ffffff7c EDI: 0000004d EBP: eee2dc50 ESP: eee2dc3c
[38442.105007] DS: 007b ES: 007b FS: 00d8 GS: 0000 SS: 0068
[38442.105007] CR0: 8005003b CR2: d8efd014 CR3: 01694000 CR4: 000026d0
[38442.105007] DR0: 00000000 DR1: 00000000 DR2: 00000000 DR3: 00000000
[38442.105007] DR6: ffff0ff0 DR7: 00000400
[38442.105007] Call Trace:
[38442.105007] [<f8ea2f8d>] cmp_bss+0xed/0x100 [cfg80211]
[38442.105007] [<f8ea33e4>] cfg80211_bss_update+0x84/0x410 [cfg80211]
[38442.105007] [<f8ea3884>] cfg80211_inform_bss_frame+0x114/0x180 [cfg80211]
[38442.105007] [<f97255ff>] ieee80211_bss_info_update+0x4f/0x180 [mac80211]
[38442.105007] [<f972b118>] ieee80211_rx_bss_info+0x88/0xf0 [mac80211]
[38442.105007] [<f9739297>] ? ieee802_11_parse_elems+0x27/0x30 [mac80211]
[38442.105007] [<f972b224>] ieee80211_rx_mgmt_probe_resp+0xa4/0x1c0 [mac80211]
[38442.105007] [<f972bc59>] ieee80211_sta_rx_queued_mgmt+0x919/0xc50 [mac80211]
[38442.105007] [<c1009707>] ? sched_clock+0x27/0xa0
[38442.105007] [<c1009707>] ? sched_clock+0x27/0xa0
[38442.105007] [<c105ffd0>] ? mark_held_locks+0x60/0x80
[38442.105007] [<c1348be5>] ? _spin_unlock_irqrestore+0x55/0x70
[38442.105007] [<c134baa5>] ? sub_preempt_count+0x85/0xc0
[38442.105007] [<c1348bce>] ? _spin_unlock_irqrestore+0x3e/0x70
[38442.105007] [<c12c1c0f>] ? skb_dequeue+0x4f/0x70
[38442.105007] [<f972c021>] ieee80211_sta_work+0x91/0xb80 [mac80211]
[38442.105007] [<c1009707>] ? sched_clock+0x27/0xa0
[38442.105007] [<c134baa5>] ? sub_preempt_count+0x85/0xc0
[38442.105007] [<c10479af>] worker_thread+0x18f/0x320
[38442.105007] [<c104794e>] ? worker_thread+0x12e/0x320
[38442.105007] [<c1348be5>] ? _spin_unlock_irqrestore+0x55/0x70
[38442.105007] [<f972bf90>] ? ieee80211_sta_work+0x0/0xb80 [mac80211]
[38442.105007] [<c104cbb0>] ? autoremove_wake_function+0x0/0x50
[38442.105007] [<c1047820>] ? worker_thread+0x0/0x320
[38442.105007] [<c104c854>] kthread+0x84/0x90
[38442.105007] [<c104c7d0>] ? kthread+0x0/0x90
[38442.105007] [<c1003ab7>] kernel_thread_helper+0x7/0x10
[38507.604007] BUG: soft lockup - CPU#0 stuck for 61s! [phy0:2230]
[38507.604007] Modules linked in: aes_i586 aes_generic fuse af_packet ipt_REJECT xt_tcpudp nf_conntrack_ipv4 nf_defrag_ipv4 xt_state iptable_filter ip_tables x_tables acpi_cpufreq binfmt_misc dm_mirror dm_region_hash dm_log dm_multipath dm_mod kvm_intel kvm uinput i915 arc4 ecb drm snd_hda_codec_idt ath5k snd_hda_intel hid_apple mac80211 usbhid appletouch snd_hda_codec snd_pcm ath cfg80211 snd_timer i2c_algo_bit ohci1394 video snd processor ieee1394 rfkill ehci_hcd sg sky2 backlight snd_page_alloc uhci_hcd joydev output ac thermal button battery sr_mod applesmc cdrom input_polldev evdev unix [last unloaded: scsi_wait_scan]
[38507.604007] irq event stamp: 2295973181
[38507.604007] hardirqs last enabled at (2295973180): [<c1002ffc>] restore_all_notrace+0x0/0x18
[38507.604007] hardirqs last disabled at (2295973181): [<c10038f4>] apic_timer_interrupt+0x28/0x34
[38507.604007] softirqs last enabled at (92950144): [<c103ab48>] __do_softirq+0x108/0x210
[38507.604007] softirqs last disabled at (92950274): [<c1348e74>] _spin_lock_bh+0x14/0x80
[38507.604007]
[38507.604007] Pid: 2230, comm: phy0 Tainted: G W (2.6.31-rc7-wl #8) MacBook1,1
[38507.604007] EIP: 0060:[<f8ea2d50>] EFLAGS: 00010292 CPU: 0
[38507.604007] EIP is at cmp_ies+0x30/0x180 [cfg80211]
[38507.604007] EAX: 00000082 EBX: 00000000 ECX: ffffffc1 EDX: d8efd014
[38507.604007] ESI: ffffff7c EDI: 0000004d EBP: eee2dc50 ESP: eee2dc3c
[38507.604007] DS: 007b ES: 007b FS: 00d8 GS: 0000 SS: 0068
[38507.604007] CR0: 8005003b CR2: d8efd014 CR3: 01694000 CR4: 000026d0
[38507.604007] DR0: 00000000 DR1: 00000000 DR2: 00000000 DR3: 00000000
[38507.604007] DR6: ffff0ff0 DR7: 00000400
[38507.604007] Call Trace:
[38507.604007] [<f8ea2f8d>] cmp_bss+0xed/0x100 [cfg80211]
[38507.604007] [<f8ea33e4>] cfg80211_bss_update+0x84/0x410 [cfg80211]
[38507.604007] [<f8ea3884>] cfg80211_inform_bss_frame+0x114/0x180 [cfg80211]
[38507.604007] [<f97255ff>] ieee80211_bss_info_update+0x4f/0x180 [mac80211]
[38507.604007] [<f972b118>] ieee80211_rx_bss_info+0x88/0xf0 [mac80211]
[38507.604007] [<f9739297>] ? ieee802_11_parse_elems+0x27/0x30 [mac80211]
[38507.604007] [<f972b224>] ieee80211_rx_mgmt_probe_resp+0xa4/0x1c0 [mac80211]
[38507.604007] [<f972bc59>] ieee80211_sta_rx_queued_mgmt+0x919/0xc50 [mac80211]
[38507.604007] [<c1009707>] ? sched_clock+0x27/0xa0
[38507.604007] [<c1009707>] ? sched_clock+0x27/0xa0
[38507.604007] [<c105ffd0>] ? mark_held_locks+0x60/0x80
[38507.604007] [<c1348be5>] ? _spin_unlock_irqrestore+0x55/0x70
[38507.604007] [<c134baa5>] ? sub_preempt_count+0x85/0xc0
[38507.604007] [<c1348bce>] ? _spin_unlock_irqrestore+0x3e/0x70
[38507.604007] [<c12c1c0f>] ? skb_dequeue+0x4f/0x70
[38507.604007] [<f972c021>] ieee80211_sta_work+0x91/0xb80 [mac80211]
[38507.604007] [<c1009707>] ? sched_clock+0x27/0xa0
[38507.604007] [<c134baa5>] ? sub_preempt_count+0x85/0xc0
[38507.604007] [<c10479af>] worker_thread+0x18f/0x320
[38507.604007] [<c104794e>] ? worker_thread+0x12e/0x320
[38507.604007] [<c1348be5>] ? _spin_unlock_irqrestore+0x55/0x70
[38507.604007] [<f972bf90>] ? ieee80211_sta_work+0x0/0xb80 [mac80211]
[38507.604007] [<c104cbb0>] ? autoremove_wake_function+0x0/0x50
[38507.604007] [<c1047820>] ? worker_thread+0x0/0x320
[38507.604007] [<c104c854>] kthread+0x84/0x90
[38507.604007] [<c104c7d0>] ? kthread+0x0/0x90
[38507.604007] [<c1003ab7>] kernel_thread_helper+0x7/0x10
--
Bob Copeland %% www.bobcopeland.com
next reply other threads:[~2009-09-01 12:17 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2009-09-01 12:17 Bob Copeland [this message]
2009-09-01 15:33 ` soft lockup in cfg80211 find_ie() Johannes Berg
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20090901121728.GA15790@hash.localnet \
--to=me@bobcopeland.com \
--cc=linux-wireless@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).