[PATCH 1/2] wifi: cfg80211: annotate struct cfg80211_mgmt_registration with __counted_by()

[PATCH 1/2] wifi: cfg80211: annotate struct cfg80211_mgmt_registration with __counted_by()

[Dmitry Antipov]

Add the '__counted_by()' compiler attribute to the flexible array member
'match[]' to improve access bounds-checking via CONFIG_UBSAN_BOUNDS and
CONFIG_FORTIFY_SOURCE, adjust 'cfg80211_mlme_register_mgmt()' accordingly.

Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru>
---
 net/wireless/mlme.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/net/wireless/mlme.c b/net/wireless/mlme.c
index 9d577523462d..4790136758d5 100644
--- a/net/wireless/mlme.c
+++ b/net/wireless/mlme.c
@@ -575,7 +575,7 @@ struct cfg80211_mgmt_registration {
 
 	bool multicast_rx;
 
-	u8 match[];
+	u8 match[] __counted_by(match_len);
 };
 
 static void cfg80211_mgmt_registrations_update(struct wireless_dev *wdev)
@@ -710,8 +710,8 @@ int cfg80211_mlme_register_mgmt(struct wireless_dev *wdev, u32 snd_portid,
 	if (update_multicast) {
 		kfree(nreg);
 	} else {
-		memcpy(nreg->match, match_data, match_len);
 		nreg->match_len = match_len;
+		memcpy(nreg->match, match_data, match_len);
 		nreg->nlportid = snd_portid;
 		nreg->frame_type = cpu_to_le16(frame_type);
 		nreg->wdev = wdev;
-- 
2.47.1

[PATCH 2/2] wifi: cfg80211: simplify cfg80211_mlme_register_mgmt()

[Dmitry Antipov]

Simplify 'cfg80211_mlme_register_mgmt()' to allocate an instance of
'struct cfg80211_mgmt_registration' only if the latter is really
needed (i.e. when the list of registrations should be updated)
and prefer 'kmalloc()' over 'kzalloc()' since all of the members
are explicitly initialized.

Fixes: 9dba48a6ece7 ("cfg80211: support multicast RX registration")
Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru>
---
 net/wireless/mlme.c | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/net/wireless/mlme.c b/net/wireless/mlme.c
index 4790136758d5..c7d913c76966 100644
--- a/net/wireless/mlme.c
+++ b/net/wireless/mlme.c
@@ -639,7 +639,7 @@ int cfg80211_mlme_register_mgmt(struct wireless_dev *wdev, u32 snd_portid,
 				struct netlink_ext_ack *extack)
 {
 	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
-	struct cfg80211_mgmt_registration *reg, *nreg;
+	struct cfg80211_mgmt_registration *reg;
 	int err = 0;
 	u16 mgmt_type;
 	bool update_multicast = false;
@@ -680,10 +680,6 @@ int cfg80211_mlme_register_mgmt(struct wireless_dev *wdev, u32 snd_portid,
 		return -EINVAL;
 	}
 
-	nreg = kzalloc(sizeof(*reg) + match_len, GFP_KERNEL);
-	if (!nreg)
-		return -ENOMEM;
-
 	spin_lock_bh(&rdev->mgmt_registrations_lock);
 
 	list_for_each_entry(reg, &wdev->mgmt_registrations, list) {
@@ -707,9 +703,14 @@ int cfg80211_mlme_register_mgmt(struct wireless_dev *wdev, u32 snd_portid,
 	if (err)
 		goto out;
 
-	if (update_multicast) {
-		kfree(nreg);
-	} else {
+	if (!update_multicast) {
+		struct cfg80211_mgmt_registration *nreg =
+			kmalloc(sizeof(*reg) + match_len, GFP_KERNEL);
+
+		if (!nreg) {
+			err = -ENOMEM;
+			goto out;
+		}
 		nreg->match_len = match_len;
 		memcpy(nreg->match, match_data, match_len);
 		nreg->nlportid = snd_portid;
@@ -726,7 +727,6 @@ int cfg80211_mlme_register_mgmt(struct wireless_dev *wdev, u32 snd_portid,
 	return 0;
 
  out:
-	kfree(nreg);
 	spin_unlock_bh(&rdev->mgmt_registrations_lock);
 
 	return err;
-- 
2.47.1

Re: [PATCH 1/2] wifi: cfg80211: annotate struct cfg80211_mgmt_registration with __counted_by()

[Johannes Berg]

On Tue, 2024-12-10 at 17:39 +0300, Dmitry Antipov wrote:
> Add the '__counted_by()' compiler attribute to the flexible array member
> 'match[]' to improve access bounds-checking via CONFIG_UBSAN_BOUNDS and
> CONFIG_FORTIFY_SOURCE, adjust 'cfg80211_mlme_register_mgmt()' accordingly.

Haha. No.

We _just_ discussed how much pain this causes.

johannes

Re: [PATCH 2/2] wifi: cfg80211: simplify cfg80211_mlme_register_mgmt()

[Johannes Berg]

On Tue, 2024-12-10 at 17:39 +0300, Dmitry Antipov wrote:
> Simplify 'cfg80211_mlme_register_mgmt()' to allocate an instance of
> 'struct cfg80211_mgmt_registration' only if the latter is really
> needed 

This part is very much broken, and I don't see that it's actually useful
to add a new "goto" just for the (unlikely) case of not needing the
allocation.

> (i.e. when the list of registrations should be updated)
> and prefer 'kmalloc()' over 'kzalloc()' since all of the members
> are explicitly initialized.

This part I disagree with, who knows what we might add. This isn't a
path where we might possibly care about the cost of zeroing, vs. the
added maintenance requirement.

johannes

Re: [PATCH 2/2] wifi: cfg80211: simplify cfg80211_mlme_register_mgmt()

[kernel test robot]

Hello,

kernel test robot noticed "BUG:sleeping_function_called_from_invalid_context_at_include/linux/sched/mm.h" on:

commit: f3ec4051049a8cc013993b615303b283770c6482 ("[PATCH 2/2] wifi: cfg80211: simplify cfg80211_mlme_register_mgmt()")
url: https://github.com/intel-lab-lkp/linux/commits/Dmitry-Antipov/wifi-cfg80211-simplify-cfg80211_mlme_register_mgmt/20241210-225049
base: https://git.kernel.org/cgit/linux/kernel/git/wireless/wireless-next.git main
patch link: https://lore.kernel.org/all/20241210143951.5685-2-dmantipov@yandex.ru/
patch subject: [PATCH 2/2] wifi: cfg80211: simplify cfg80211_mlme_register_mgmt()

in testcase: hwsim
version: hwsim-x86_64-4ea2c336d-1_20241103
with following parameters:

	test: group-24



config: x86_64-rhel-9.4-func
compiler: gcc-12
test machine: 8 threads 1 sockets Intel(R) Core(TM) i7-4790 v3 @ 3.60GHz (Haswell) with 6G memory

(please refer to attached dmesg/kmsg for entire log/backtrace)



If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <oliver.sang@intel.com>
| Closes: https://lore.kernel.org/oe-lkp/202412311225.52d0fafe-lkp@intel.com


[   86.645507][ T5533] BUG: sleeping function called from invalid context at include/linux/sched/mm.h:321
[   86.653092][ T5537] ieee80211 phy1: mac80211_hwsim_start
[   86.654820][ T5533] in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 5533, name: wpa_supplicant
[   86.660121][ T5537] ieee80211 phy1: mac80211_hwsim_add_interface (type=2 mac_addr=02:00:00:00:01:00)
[   86.660169][ T5537] ieee80211 phy1: mac80211_hwsim_link_info_changed(changed=0xe vif->addr=02:00:00:00:01:00, link id 0)
[   86.669338][ T5533] preempt_count: 201, expected: 0
[   86.669350][ T5533] RCU nest depth: 0, expected: 0
[   86.669353][ T5533] CPU: 5 UID: 0 PID: 5533 Comm: wpa_supplicant Tainted: G S                 6.13.0-rc1-00077-gf3ec4051049a #1
[   86.678470][ T5537] ieee80211 phy1:   ERP_CTS_PROT: 0
[   86.689309][ T5533] Tainted: [S]=CPU_OUT_OF_SPEC
[   86.689311][ T5533] Hardware name: Dell Inc. OptiPlex 9020/03CPWF, BIOS A11 04/01/2015
[   86.689312][ T5533] Call Trace:
[   86.689314][ T5533]  <TASK>
[ 86.689326][ T5533] dump_stack_lvl (lib/dump_stack.c:123 (discriminator 1))
[   86.694193][ T5537] ieee80211 phy1:   ERP_PREAMBLE: 0
[ 86.698967][ T5533] __might_resched (kernel/sched/core.c:8759)
[ 86.698984][ T5533] __kmalloc_noprof (include/linux/kernel.h:73 include/linux/sched/mm.h:321 include/linux/sched/mm.h:316 mm/slub.c:4055 mm/slub.c:4133 mm/slub.c:4282 mm/slub.c:4295)
[   86.710436][ T5537] ieee80211 phy1:   ERP_SLOT: 0
[ 86.715468][ T5533] ? __pfx__raw_spin_lock_bh (kernel/locking/spinlock.c:177)
[ 86.715473][ T5533] ? cfg80211_mlme_register_mgmt (include/linux/slab.h:905 net/wireless/mlme.c:708) cfg80211
[   86.720106][ T5537] ieee80211 phy1: mac80211_hwsim_conf_tx (queue=0 txop=0 cw_min=15 cw_max=1023 aifs=2)
[ 86.727993][ T5533] ? cfg80211_mlme_register_mgmt (include/linux/slab.h:905 net/wireless/mlme.c:708) cfg80211
[   86.731138][ T5537] ieee80211 phy1: mac80211_hwsim_conf_tx (queue=1 txop=0 cw_min=15 cw_max=1023 aifs=2)
[ 86.733922][ T5533] cfg80211_mlme_register_mgmt (include/linux/slab.h:905 net/wireless/mlme.c:708) cfg80211
[   86.738276][ T5537] ieee80211 phy1: mac80211_hwsim_conf_tx (queue=2 txop=0 cw_min=15 cw_max=1023 aifs=2)
[ 86.743313][ T5533] nl80211_register_mgmt (net/wireless/nl80211.c:12697) cfg80211
[   86.747938][ T5537] ieee80211 phy1: mac80211_hwsim_conf_tx (queue=3 txop=0 cw_min=15 cw_max=1023 aifs=2)
[ 86.752614][ T5533] ? nl80211_pre_doit (net/wireless/nl80211.c:16626) cfg80211
[   86.757317][ T5537] ieee80211 phy1: mac80211_hwsim_link_info_changed(changed=0x2000 vif->addr=02:00:00:00:01:00, link id 0)
[ 86.762609][ T5533] genl_family_rcv_msg_doit (net/netlink/genetlink.c:1117)
[   86.769392][ T5537] ieee80211 phy1: mac80211_hwsim_config (freq=2412(2412 - 0)/noht idle=1 ps=0 smps=static)
[ 86.778848][ T5533] ? __pfx_genl_family_rcv_msg_doit (net/netlink/genetlink.c:1088)
[   86.785649][   T11] ieee80211 phy1: mac80211_hwsim_configure_filter
[ 86.795082][ T5533] ? security_capable (security/security.c:1142)
[ 86.795090][ T5533] genl_family_rcv_msg (net/netlink/genetlink.c:1195)
[   86.801696][   T11] ieee80211 phy1: mac80211_hwsim_configure_filter
[ 86.811153][ T5533] ? __sys_sendmsg (net/socket.c:2654)
[ 86.811174][ T5533] ? __pfx_genl_family_rcv_msg (net/netlink/genetlink.c:1160)
[ 86.897075][ T5533] ? netlink_sendmsg (net/netlink/af_netlink.c:1866)
[ 86.901865][ T5533] ? ____sys_sendmsg (net/socket.c:711 net/socket.c:726 net/socket.c:2583)
[ 86.906664][ T5533] ? ___sys_sendmsg (net/socket.c:2639)
[ 86.911279][ T5533] ? __pfx_nl80211_pre_doit (net/wireless/nl80211.c:16536) cfg80211
[ 86.917589][ T5533] ? __pfx_nl80211_register_mgmt (net/wireless/nl80211.c:12655) cfg80211
[ 86.924312][ T5533] ? __pfx_nl80211_post_doit (net/wireless/nl80211.c:16638) cfg80211
[ 86.930688][ T5533] ? is_bpf_text_address (kernel/bpf/core.c:769)
[ 86.935653][ T5533] genl_rcv_msg (net/netlink/genetlink.c:65 net/netlink/genetlink.c:1211)
[ 86.939928][ T5533] netlink_rcv_skb (net/netlink/af_netlink.c:2542)
[ 86.944544][ T5533] ? __pfx_genl_rcv_msg (net/netlink/genetlink.c:1201)
[ 86.949418][ T5533] ? __pfx_netlink_rcv_skb (net/netlink/af_netlink.c:2519)
[ 86.954555][ T5533] ? __pfx_down_read (kernel/locking/rwsem.c:1522)
[ 86.959169][ T5533] ? __pfx_netlink_lookup (net/netlink/af_netlink.c:514)
[ 86.964214][ T5533] ? _copy_from_iter (arch/x86/include/asm/uaccess_64.h:126 arch/x86/include/asm/uaccess_64.h:141 lib/iov_iter.c:55 include/linux/iov_iter.h:30 include/linux/iov_iter.h:300 include/linux/iov_iter.h:328 lib/iov_iter.c:249 lib/iov_iter.c:260)
[ 86.969090][ T5533] genl_rcv (net/netlink/genetlink.c:1220)
[ 86.972925][ T5533] netlink_unicast (net/netlink/af_netlink.c:1322 net/netlink/af_netlink.c:1347)
[ 86.977540][ T5533] ? __pfx_netlink_unicast (net/netlink/af_netlink.c:1332)
[   86.982673][ T5533]  ? 0xffffffff81000000
[ 86.986678][ T5533] ? __check_object_size (mm/memremap.c:421)
[ 86.992336][ T5533] netlink_sendmsg (net/netlink/af_netlink.c:1891)
[ 86.996950][ T5533] ? __pfx_netlink_sendmsg (net/netlink/af_netlink.c:1810)
[ 87.002083][ T5533] ? __import_iovec (lib/iov_iter.c:1438 lib/iov_iter.c:1454)
[ 87.006782][ T5533] ? _inline_copy_from_user (arch/x86/include/asm/uaccess_64.h:134 arch/x86/include/asm/uaccess_64.h:134 arch/x86/include/asm/uaccess_64.h:141 include/linux/uaccess.h:178)
[ 87.012003][ T5533] ? __pfx_netlink_sendmsg (net/netlink/af_netlink.c:1810)
[ 87.017135][ T5533] ____sys_sendmsg (net/socket.c:711 net/socket.c:726 net/socket.c:2583)
[ 87.021749][ T5533] ? __pfx_____sys_sendmsg (net/socket.c:2529)
[ 87.026895][ T5533] ? __pfx_copy_msghdr_from_user (net/socket.c:2509)
[ 87.032559][ T5533] ? copy_from_sockptr_offset (include/linux/sockptr.h:51)
[ 87.039082][ T5533] ___sys_sendmsg (net/socket.c:2639)
[ 87.043523][ T5533] ? __pfx____sys_sendmsg (net/socket.c:2626)
[ 87.048571][ T5533] ? do_sock_setsockopt (net/socket.c:2282)
[ 87.053617][ T5533] ? do_sock_setsockopt (net/socket.c:2282)
[ 87.058664][ T5533] ? __pfx_do_sock_setsockopt (net/socket.c:2282)
[ 87.064055][ T5533] ? up_write (arch/x86/include/asm/atomic64_64.h:87 include/linux/atomic/atomic-arch-fallback.h:2852 include/linux/atomic/atomic-long.h:268 include/linux/atomic/atomic-instrumented.h:3391 kernel/locking/rwsem.c:1372 kernel/locking/rwsem.c:1630)
[ 87.068064][ T5533] ? fdget (include/linux/atomic/atomic-arch-fallback.h:479 include/linux/atomic/atomic-instrumented.h:50 fs/file.c:1145 fs/file.c:1159)
[ 87.071898][ T5533] ? fdget (include/linux/atomic/atomic-arch-fallback.h:479 include/linux/atomic/atomic-instrumented.h:50 fs/file.c:1145 fs/file.c:1159)
[ 87.075742][ T5533] __sys_sendmsg (net/socket.c:2669)
[ 87.080182][ T5533] ? __pfx___sys_sendmsg (net/socket.c:2654)
[ 87.085144][ T5533] ? ksys_write (fs/read_write.c:731)
[ 87.089412][ T5533] ? __pfx_ksys_write (fs/read_write.c:721)
[ 87.094112][ T5533] do_syscall_64 (arch/x86/entry/common.c:52 arch/x86/entry/common.c:83)
[ 87.098466][ T5533] ? syscall_exit_to_user_mode (arch/x86/include/asm/irqflags.h:37 arch/x86/include/asm/irqflags.h:92 include/linux/entry-common.h:232 kernel/entry/common.c:206 kernel/entry/common.c:218)
[ 87.103947][ T5533] ? do_syscall_64 (arch/x86/entry/common.c:102)
[ 87.108474][ T5533] ? __count_memcg_events (arch/x86/include/asm/atomic64_64.h:15 include/linux/atomic/atomic-arch-fallback.h:2583 include/linux/atomic/atomic-instrumented.h:1611 mm/memcontrol.c:569 mm/memcontrol.c:594 mm/memcontrol.c:857)
[ 87.113694][ T5533] ? handle_mm_fault (mm/memory.c:5986 mm/memory.c:6138)
[ 87.118482][ T5533] ? do_user_addr_fault (include/linux/rcupdate.h:882 include/linux/mm.h:741 arch/x86/mm/fault.c:1340)
[ 87.123530][ T5533] ? exc_page_fault (arch/x86/include/asm/irqflags.h:37 arch/x86/include/asm/irqflags.h:92 arch/x86/mm/fault.c:1489 arch/x86/mm/fault.c:1539)
[ 87.128058][ T5533] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)
[   87.133802][ T5533] RIP: 0033:0x7fdd421a8af0
[ 87.138067][ T5533] Code: 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b7 66 2e 0f 1f 84 00 00 00 00 00 90 80 3d f1 fa 0c 00 00 74 17 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 58 c3 0f 1f 80 00 00 00 00 48 83 ec 28 89 54
All code
========
   0:	00 f7                	add    %dh,%bh
   2:	d8 64 89 02          	fsubs  0x2(%rcx,%rcx,4)
   6:	48 c7 c0 ff ff ff ff 	mov    $0xffffffffffffffff,%rax
   d:	eb b7                	jmp    0xffffffffffffffc6
   f:	66 2e 0f 1f 84 00 00 	cs nopw 0x0(%rax,%rax,1)
  16:	00 00 00 
  19:	90                   	nop
  1a:	80 3d f1 fa 0c 00 00 	cmpb   $0x0,0xcfaf1(%rip)        # 0xcfb12
  21:	74 17                	je     0x3a
  23:	b8 2e 00 00 00       	mov    $0x2e,%eax
  28:	0f 05                	syscall
  2a:*	48 3d 00 f0 ff ff    	cmp    $0xfffffffffffff000,%rax		<-- trapping instruction
  30:	77 58                	ja     0x8a
  32:	c3                   	ret
  33:	0f 1f 80 00 00 00 00 	nopl   0x0(%rax)
  3a:	48 83 ec 28          	sub    $0x28,%rsp
  3e:	89                   	.byte 0x89
  3f:	54                   	push   %rsp

Code starting with the faulting instruction
===========================================
   0:	48 3d 00 f0 ff ff    	cmp    $0xfffffffffffff000,%rax
   6:	77 58                	ja     0x60
   8:	c3                   	ret
   9:	0f 1f 80 00 00 00 00 	nopl   0x0(%rax)
  10:	48 83 ec 28          	sub    $0x28,%rsp
  14:	89                   	.byte 0x89
  15:	54                   	push   %rsp


The kernel config and materials to reproduce are available at:
https://download.01.org/0day-ci/archive/20241231/202412311225.52d0fafe-lkp@intel.com



-- 
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki