Linux wireless drivers development
 help / color / mirror / Atom feed

* Re: NXP NFC version and ACPI
From: Daniel Lezcano @ 2019-05-19 16:46 UTC (permalink / raw)
  To: sedat.dilek
  Cc: Samuel Ortiz, linux-wireless, linux-nfc, oleg.zhurakivskyy,
	clement.perrochaud, charles.gorand, Andy Shevchenko
In-Reply-To: <CA+icZUVaBdswfmRfbRtdVJY8ymeDOwDSFEf7G6jneqEmpW84bg@mail.gmail.com>


FYI, when I tried to make the NFC work on my x280, I tried the module at:

https://github.com/jr64/nxp-pn5xx

AFAIR, it finally worked somehow.

May be you can cross check with your series and the change in this
module to find out what could be missing? (I can do that but it will be
certainly easier for you spot something in the code you wrote).

I can experiment your changes in my laptop if needed.


On 14/05/2019 16:59, Sedat Dilek wrote:
> On Tue, May 14, 2019 at 10:17 AM Daniel Lezcano
> <daniel.lezcano@linaro.org> wrote:
> [...]
> 
> Just for the records:
> 
> root@iniza:~# rfkill --output ID,TYPE
> ID TYPE
>  0 bluetooth
>  1 nfc
>  2 wlan
>  3 bluetooth
> 
> root@iniza:~# rfkill list nfc
> 1: nfc0: NFC
>         Soft blocked: no
>         Hard blocked: no
> 
> - Sedat -
> 


-- 
 <http://www.linaro.org/> Linaro.org │ Open source software for ARM SoCs

Follow Linaro:  <http://www.facebook.com/pages/Linaro> Facebook |
<http://twitter.com/#!/linaroorg> Twitter |
<http://www.linaro.org/linaro-blog/> Blog


^ permalink raw reply

* Re: KASAN: use-after-free Read in p54u_load_firmware_cb
From: Christian Lamparter @ 2019-05-18 20:11 UTC (permalink / raw)
  To: Alan Stern
  Cc: syzbot, andreyknvl, chunkeey, davem, kvalo, linux-kernel,
	linux-usb, linux-wireless, netdev, oneukum, syzkaller-bugs
In-Reply-To: <Pine.LNX.4.44L0.1905181346380.10594-100000@netrider.rowland.org>

Hello,

On Saturday, May 18, 2019 7:49:49 PM CEST you wrote:
> On Sat, 18 May 2019, syzbot wrote:
> > 
> > syzbot has tested the proposed patch but the reproducer still triggered  
> > crash:
> > KASAN: use-after-free Read in usb_driver_release_interface
> > 
> > usb 1-1: Loading firmware file isl3887usb
> > usb 1-1: Direct firmware load for isl3887usb failed with error -2
> > usb 1-1: Firmware not found.
> > p54usb 1-1:0.143: failed to initialize device (-2)
> > ==================================================================
> > BUG: KASAN: use-after-free in usb_driver_release_interface+0x16b/0x190  
> > drivers/usb/core/driver.c:584
> > Read of size 8 at addr ffff88808fc31218 by task kworker/0:1/12
> 
> Now the bad access is in a different place.  That's a good sign.
> In this case it indicates that although udev is still hanging around, 
> intf has already been freed.  We really should acquire a reference to 
> it instead.
> 
> Alan Stern

Thanks. I can confirm that it works with the real ISL3887 
hardware as well. Can you please spin up a patch or how
should this be continued?

Cheers,
Christian 

>  drivers/net/wireless/intersil/p54/p54usb.c |   43 ++++++++++++-----------------
>  1 file changed, 18 insertions(+), 25 deletions(-)
> 
> Index: usb-devel/drivers/net/wireless/intersil/p54/p54usb.c
> ===================================================================
> --- usb-devel.orig/drivers/net/wireless/intersil/p54/p54usb.c
> +++ usb-devel/drivers/net/wireless/intersil/p54/p54usb.c
> @@ -33,6 +33,8 @@ MODULE_ALIAS("prism54usb");
>  MODULE_FIRMWARE("isl3886usb");
>  MODULE_FIRMWARE("isl3887usb");
>  
> +static struct usb_driver p54u_driver;
> +
>  /*
>   * Note:
>   *
> @@ -921,9 +923,9 @@ static void p54u_load_firmware_cb(const
>  {
>  	struct p54u_priv *priv = context;
>  	struct usb_device *udev = priv->udev;
> +	struct usb_interface *intf = priv->intf;
>  	int err;
>  
> -	complete(&priv->fw_wait_load);
>  	if (firmware) {
>  		priv->fw = firmware;
>  		err = p54u_start_ops(priv);
> @@ -932,26 +934,22 @@ static void p54u_load_firmware_cb(const
>  		dev_err(&udev->dev, "Firmware not found.\n");
>  	}
>  
> -	if (err) {
> -		struct device *parent = priv->udev->dev.parent;
> -
> -		dev_err(&udev->dev, "failed to initialize device (%d)\n", err);
> -
> -		if (parent)
> -			device_lock(parent);
> +	complete(&priv->fw_wait_load);
> +	/*
> +	 * At this point p54u_disconnect may have already freed
> +	 * the "priv" context. Do not use it anymore!
> +	 */
> +	priv = NULL;
>  
> -		device_release_driver(&udev->dev);
> -		/*
> -		 * At this point p54u_disconnect has already freed
> -		 * the "priv" context. Do not use it anymore!
> -		 */
> -		priv = NULL;
> +	if (err) {
> +		dev_err(&intf->dev, "failed to initialize device (%d)\n", err);
>  
> -		if (parent)
> -			device_unlock(parent);
> +		usb_lock_device(udev);
> +		usb_driver_release_interface(&p54u_driver, intf);
> +		usb_unlock_device(udev);
>  	}
>  
> -	usb_put_dev(udev);
> +	usb_put_intf(intf);
>  }
>  
>  static int p54u_load_firmware(struct ieee80211_hw *dev,
> @@ -972,14 +970,14 @@ static int p54u_load_firmware(struct iee
>  	dev_info(&priv->udev->dev, "Loading firmware file %s\n",
>  	       p54u_fwlist[i].fw);
>  
> -	usb_get_dev(udev);
> +	usb_get_intf(intf);
>  	err = request_firmware_nowait(THIS_MODULE, 1, p54u_fwlist[i].fw,
>  				      device, GFP_KERNEL, priv,
>  				      p54u_load_firmware_cb);
>  	if (err) {
>  		dev_err(&priv->udev->dev, "(p54usb) cannot load firmware %s "
>  					  "(%d)!\n", p54u_fwlist[i].fw, err);
> -		usb_put_dev(udev);
> +		usb_put_intf(intf);
>  	}
>  
>  	return err;
> @@ -1011,8 +1009,6 @@ static int p54u_probe(struct usb_interfa
>  	skb_queue_head_init(&priv->rx_queue);
>  	init_usb_anchor(&priv->submitted);
>  
> -	usb_get_dev(udev);
> -
>  	/* really lazy and simple way of figuring out if we're a 3887 */
>  	/* TODO: should just stick the identification in the device table */
>  	i = intf->altsetting->desc.bNumEndpoints;
> @@ -1053,10 +1049,8 @@ static int p54u_probe(struct usb_interfa
>  		priv->upload_fw = p54u_upload_firmware_net2280;
>  	}
>  	err = p54u_load_firmware(dev, intf);
> -	if (err) {
> -		usb_put_dev(udev);
> +	if (err)
>  		p54_free_common(dev);
> -	}
>  	return err;
>  }
>  
> @@ -1072,7 +1066,6 @@ static void p54u_disconnect(struct usb_i
>  	wait_for_completion(&priv->fw_wait_load);
>  	p54_unregister_common(dev);
>  
> -	usb_put_dev(interface_to_usbdev(intf));
>  	release_firmware(priv->fw);
>  	p54_free_common(dev);
>  }
> 
> 





^ permalink raw reply

* [PATCH] net: wireless: p54: fix crash during initialization
From: Christian Lamparter @ 2019-05-18 20:05 UTC (permalink / raw)
  To: linux-wireless; +Cc: David S . Miller, Kalle Valo

This patch fixes a crash that got introduced when the
mentioned patch replaced  the direct list_head access
with skb_peek_tail(). When the device is starting up,
there are  no entries in  the queue, so previously to
"Use skb_peek_tail() instead..." the target_skb would
end up as the  tail and head pointer which then could
be used by __skb_queue_after to fill the empty queue.

With skb_peek_tail() in its place will instead just
return NULL which then causes a crash in the
__skb_queue_after().

| BUG: unable to handle kernel NULL pointer dereference at 000000
| #PF error: [normal kernel read fault]
| PGD 0 P4D 0
| Oops: 0000 [#1] SMP PTI
| CPU: 0 PID: 12 Comm: kworker/0:1 Tainted: GO   5.1.0-rc7-wt+ #218
| Hardware name: MSI MS-7816/Z87-G43 (MS-7816), BIOS V1.11 05/09/2015
| Workqueue: events request_firmware_work_func
| RIP: 0010:p54_tx_pending+0x10f/0x1b0 [p54common]
| Code: 78 06 80 78 28 00 74 6d <48> 8b 07 49 89 7c 24 08 49 89 04 24 4
| RSP: 0018:ffffa81c81927d90 EFLAGS: 00010086
| RAX: ffff9bbaaf131048 RBX: 0000000000020670 RCX: 0000000000020264
| RDX: ffff9bbaa976d660 RSI: 0000000000000202 RDI: 0000000000000000
| RBP: ffff9bbaa976d620 R08: 00000000000006c0 R09: ffff9bbaa976d660
| R10: 0000000000000000 R11: ffffe8480dbc5900 R12: ffff9bbb45e87700
| R13: ffff9bbaa976d648 R14: ffff9bbaa976d674 R15: ffff9bbaaf131048
| FS:  0000000000000000(0000) GS:ffff9bbb5ec00000(0000) knlGS:00000
| CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
| CR2: 0000000000000000 CR3: 00000003695fc003 CR4: 00000000001606f0
| Call Trace:
|  p54_download_eeprom+0xbe/0x120 [p54common]
|  p54_read_eeprom+0x7f/0xc0 [p54common]
|  p54u_load_firmware_cb+0xe0/0x160 [p54usb]
|  request_firmware_work_func+0x42/0x80
|  process_one_work+0x1f5/0x3f0
|  worker_thread+0x28/0x3c0

Cc: stable@vger.kernel.org
Fixes: e3554197fc8f ("p54: Use skb_peek_tail() instead of direct head pointer accesses.")
Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
---
 drivers/net/wireless/intersil/p54/txrx.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/net/wireless/intersil/p54/txrx.c b/drivers/net/wireless/intersil/p54/txrx.c
index 790784568ad2..5bf1c19ecced 100644
--- a/drivers/net/wireless/intersil/p54/txrx.c
+++ b/drivers/net/wireless/intersil/p54/txrx.c
@@ -142,7 +142,10 @@ static int p54_assign_address(struct p54_common *priv, struct sk_buff *skb)
 	    unlikely(GET_HW_QUEUE(skb) == P54_QUEUE_BEACON))
 		priv->beacon_req_id = data->req_id;
 
-	__skb_queue_after(&priv->tx_queue, target_skb, skb);
+	if (target_skb)
+		__skb_queue_after(&priv->tx_queue, target_skb, skb);
+	else
+		__skb_queue_head(&priv->tx_queue, skb);
 	spin_unlock_irqrestore(&priv->tx_queue.lock, flags);
 	return 0;
 }
-- 
2.20.1


^ permalink raw reply related

* Re: KASAN: use-after-free Read in p54u_load_firmware_cb
From: syzbot @ 2019-05-18 18:31 UTC (permalink / raw)
  To: andreyknvl, chunkeey, chunkeey, davem, kvalo, linux-kernel,
	linux-usb, linux-wireless, netdev, oneukum, stern, syzkaller-bugs
In-Reply-To: <Pine.LNX.4.44L0.1905181346380.10594-100000@netrider.rowland.org>

Hello,

syzbot has tested the proposed patch and the reproducer did not trigger  
crash:

Reported-and-tested-by:  
syzbot+200d4bb11b23d929335f@syzkaller.appspotmail.com

Tested on:

commit:         43151d6c usb-fuzzer: main usb gadget fuzzer driver
git tree:       https://github.com/google/kasan.git usb-fuzzer
kernel config:  https://syzkaller.appspot.com/x/.config?x=4183eeef650d1234
compiler:       gcc (GCC) 9.0.0 20181231 (experimental)
patch:          https://syzkaller.appspot.com/x/patch.diff?x=17e42018a00000

Note: testing is done by a robot and is best-effort only.

^ permalink raw reply

* Re: [PATCH v2 2/2] qtnfmac: add support for Topaz chipsets
From: Jonas Gorski @ 2019-05-18 17:54 UTC (permalink / raw)
  To: Sergey Matyukevich
  Cc: linux-wireless@vger.kernel.org, Igor Mitsyanko, Andrey Shevchenko
In-Reply-To: <20181016102349.26544-3-sergey.matyukevich.os@quantenna.com>

Hi,

On Tue, 16 Oct 2018 at 12:25, Sergey Matyukevich
<sergey.matyukevich.os@quantenna.com> wrote:
>
> This patch adds support for QSR1000/QSR2000 family of chipsets
> to qtnfmac_pcie platform driver.
>
> QSR1000/QSR2000 (aka Topaz) is a family of 80MHz, 11ac Wave2,
> 4x4/2x4/2x2 chips, including single and dual band devices.
> Depending on specific chip model and firmware in use, either
> STA or both STA and AP modes are supported.
>
> Patch adds Topaz support to qtnfmac_pcie driver. Proper platform
> bus will be selected on probing based on chip ID.
>
> Signed-off-by: Igor Mitsyanko <igor.mitsyanko.os@quantenna.com>
> Signed-off-by: Sergey Matyukevich <sergey.matyukevich.os@quantenna.com>
> Signed-off-by: Andrey Shevchenko <ashevchenko@quantenna.com>
> ---

(snip)

> diff --git a/drivers/net/wireless/quantenna/qtnfmac/qtn_hw_ids.h b/drivers/net/wireless/quantenna/qtnfmac/qtn_hw_ids.h
> index 1fe798a9a667..40295a511224 100644
> --- a/drivers/net/wireless/quantenna/qtnfmac/qtn_hw_ids.h
> +++ b/drivers/net/wireless/quantenna/qtnfmac/qtn_hw_ids.h
> @@ -23,7 +23,7 @@
>
>  /* PCIE Device IDs */
>
> -#define        PCIE_DEVICE_ID_QTN_PEARL        (0x0008)
> +#define        PCIE_DEVICE_ID_QSR              (0x0008)
>
>  #define QTN_REG_SYS_CTRL_CSR           0x14
>  #define QTN_CHIP_ID_MASK               0xF0
> @@ -35,6 +35,8 @@
>  /* FW names */
>
>  #define QTN_PCI_PEARL_FW_NAME          "qtn/fmac_qsr10g.img"
> +#define QTN_PCI_TOPAZ_FW_NAME          "qtn/fmac_qsr1000.img"
> +#define QTN_PCI_TOPAZ_BOOTLD_NAME      "qtn/uboot_qsr1000.img"

A bit late of a review/question, but how does one obtain one of these
files? There's nothing in linux-firmware, and I see only one aborted
attempt for adding fmac_qsr10g.img from 2016, but none for the others.
Searching for these filenames also didn't reveal any external
locations.


Regards
Jonas

^ permalink raw reply

* Re: KASAN: use-after-free Read in p54u_load_firmware_cb
From: Alan Stern @ 2019-05-18 17:49 UTC (permalink / raw)
  To: syzbot
  Cc: andreyknvl, chunkeey, chunkeey, davem, kvalo, linux-kernel,
	linux-usb, linux-wireless, netdev, oneukum, syzkaller-bugs
In-Reply-To: <000000000000b8203405892cee43@google.com>

On Sat, 18 May 2019, syzbot wrote:

> Hello,
> 
> syzbot has tested the proposed patch but the reproducer still triggered  
> crash:
> KASAN: use-after-free Read in usb_driver_release_interface
> 
> usb 1-1: Loading firmware file isl3887usb
> usb 1-1: Direct firmware load for isl3887usb failed with error -2
> usb 1-1: Firmware not found.
> p54usb 1-1:0.143: failed to initialize device (-2)
> ==================================================================
> BUG: KASAN: use-after-free in usb_driver_release_interface+0x16b/0x190  
> drivers/usb/core/driver.c:584
> Read of size 8 at addr ffff88808fc31218 by task kworker/0:1/12

Now the bad access is in a different place.  That's a good sign.
In this case it indicates that although udev is still hanging around, 
intf has already been freed.  We really should acquire a reference to 
it instead.

Alan Stern


#syz test: https://github.com/google/kasan.git usb-fuzzer

 drivers/net/wireless/intersil/p54/p54usb.c |   43 ++++++++++++-----------------
 1 file changed, 18 insertions(+), 25 deletions(-)

Index: usb-devel/drivers/net/wireless/intersil/p54/p54usb.c
===================================================================
--- usb-devel.orig/drivers/net/wireless/intersil/p54/p54usb.c
+++ usb-devel/drivers/net/wireless/intersil/p54/p54usb.c
@@ -33,6 +33,8 @@ MODULE_ALIAS("prism54usb");
 MODULE_FIRMWARE("isl3886usb");
 MODULE_FIRMWARE("isl3887usb");
 
+static struct usb_driver p54u_driver;
+
 /*
  * Note:
  *
@@ -921,9 +923,9 @@ static void p54u_load_firmware_cb(const
 {
 	struct p54u_priv *priv = context;
 	struct usb_device *udev = priv->udev;
+	struct usb_interface *intf = priv->intf;
 	int err;
 
-	complete(&priv->fw_wait_load);
 	if (firmware) {
 		priv->fw = firmware;
 		err = p54u_start_ops(priv);
@@ -932,26 +934,22 @@ static void p54u_load_firmware_cb(const
 		dev_err(&udev->dev, "Firmware not found.\n");
 	}
 
-	if (err) {
-		struct device *parent = priv->udev->dev.parent;
-
-		dev_err(&udev->dev, "failed to initialize device (%d)\n", err);
-
-		if (parent)
-			device_lock(parent);
+	complete(&priv->fw_wait_load);
+	/*
+	 * At this point p54u_disconnect may have already freed
+	 * the "priv" context. Do not use it anymore!
+	 */
+	priv = NULL;
 
-		device_release_driver(&udev->dev);
-		/*
-		 * At this point p54u_disconnect has already freed
-		 * the "priv" context. Do not use it anymore!
-		 */
-		priv = NULL;
+	if (err) {
+		dev_err(&intf->dev, "failed to initialize device (%d)\n", err);
 
-		if (parent)
-			device_unlock(parent);
+		usb_lock_device(udev);
+		usb_driver_release_interface(&p54u_driver, intf);
+		usb_unlock_device(udev);
 	}
 
-	usb_put_dev(udev);
+	usb_put_intf(intf);
 }
 
 static int p54u_load_firmware(struct ieee80211_hw *dev,
@@ -972,14 +970,14 @@ static int p54u_load_firmware(struct iee
 	dev_info(&priv->udev->dev, "Loading firmware file %s\n",
 	       p54u_fwlist[i].fw);
 
-	usb_get_dev(udev);
+	usb_get_intf(intf);
 	err = request_firmware_nowait(THIS_MODULE, 1, p54u_fwlist[i].fw,
 				      device, GFP_KERNEL, priv,
 				      p54u_load_firmware_cb);
 	if (err) {
 		dev_err(&priv->udev->dev, "(p54usb) cannot load firmware %s "
 					  "(%d)!\n", p54u_fwlist[i].fw, err);
-		usb_put_dev(udev);
+		usb_put_intf(intf);
 	}
 
 	return err;
@@ -1011,8 +1009,6 @@ static int p54u_probe(struct usb_interfa
 	skb_queue_head_init(&priv->rx_queue);
 	init_usb_anchor(&priv->submitted);
 
-	usb_get_dev(udev);
-
 	/* really lazy and simple way of figuring out if we're a 3887 */
 	/* TODO: should just stick the identification in the device table */
 	i = intf->altsetting->desc.bNumEndpoints;
@@ -1053,10 +1049,8 @@ static int p54u_probe(struct usb_interfa
 		priv->upload_fw = p54u_upload_firmware_net2280;
 	}
 	err = p54u_load_firmware(dev, intf);
-	if (err) {
-		usb_put_dev(udev);
+	if (err)
 		p54_free_common(dev);
-	}
 	return err;
 }
 
@@ -1072,7 +1066,6 @@ static void p54u_disconnect(struct usb_i
 	wait_for_completion(&priv->fw_wait_load);
 	p54_unregister_common(dev);
 
-	usb_put_dev(interface_to_usbdev(intf));
 	release_firmware(priv->fw);
 	p54_free_common(dev);
 }


^ permalink raw reply

* Re: KASAN: use-after-free Read in p54u_load_firmware_cb
From: syzbot @ 2019-05-18 17:36 UTC (permalink / raw)
  To: andreyknvl, chunkeey, chunkeey, davem, kvalo, linux-kernel,
	linux-usb, linux-wireless, netdev, oneukum, stern, syzkaller-bugs
In-Reply-To: <Pine.LNX.4.44L0.1905181300440.10594-100000@netrider.rowland.org>

Hello,

syzbot has tested the proposed patch but the reproducer still triggered  
crash:
KASAN: use-after-free Read in usb_driver_release_interface

usb 1-1: Loading firmware file isl3887usb
usb 1-1: Direct firmware load for isl3887usb failed with error -2
usb 1-1: Firmware not found.
p54usb 1-1:0.143: failed to initialize device (-2)
==================================================================
BUG: KASAN: use-after-free in usb_driver_release_interface+0x16b/0x190  
drivers/usb/core/driver.c:584
Read of size 8 at addr ffff88808fc31218 by task kworker/0:1/12

CPU: 0 PID: 12 Comm: kworker/0:1 Not tainted 5.1.0-rc3-g43151d6-dirty #1
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS  
Google 01/01/2011
Workqueue: events request_firmware_work_func
Call Trace:
  __dump_stack lib/dump_stack.c:77 [inline]
  dump_stack+0xe8/0x16e lib/dump_stack.c:113
  print_address_description+0x6c/0x236 mm/kasan/report.c:187
  kasan_report.cold+0x1a/0x3c mm/kasan/report.c:317
  usb_driver_release_interface+0x16b/0x190 drivers/usb/core/driver.c:584
  p54u_load_firmware_cb+0x390/0x420  
drivers/net/wireless/intersil/p54/p54usb.c:948
  request_firmware_work_func+0x12d/0x249  
drivers/base/firmware_loader/main.c:785
  process_one_work+0x90f/0x1580 kernel/workqueue.c:2269
  worker_thread+0x9b/0xe20 kernel/workqueue.c:2415
  kthread+0x313/0x420 kernel/kthread.c:253
  ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:352

Allocated by task 12:
  set_track mm/kasan/common.c:87 [inline]
  __kasan_kmalloc mm/kasan/common.c:497 [inline]
  __kasan_kmalloc.constprop.0+0xbf/0xd0 mm/kasan/common.c:470
  kmalloc include/linux/slab.h:547 [inline]
  kzalloc include/linux/slab.h:742 [inline]
  usb_set_configuration+0x2e0/0x1740 drivers/usb/core/message.c:1846
  generic_probe+0xa2/0xda drivers/usb/core/generic.c:210
  usb_probe_device+0xc0/0x150 drivers/usb/core/driver.c:266
  really_probe+0x2da/0xb10 drivers/base/dd.c:509
  driver_probe_device+0x21d/0x350 drivers/base/dd.c:671
  __device_attach_driver+0x1d8/0x290 drivers/base/dd.c:778
  bus_for_each_drv+0x163/0x1e0 drivers/base/bus.c:454
  __device_attach+0x223/0x3a0 drivers/base/dd.c:844
  bus_probe_device+0x1f1/0x2a0 drivers/base/bus.c:514
  device_add+0xad2/0x16e0 drivers/base/core.c:2106
  usb_new_device.cold+0x537/0xccf drivers/usb/core/hub.c:2534
  hub_port_connect drivers/usb/core/hub.c:5089 [inline]
  hub_port_connect_change drivers/usb/core/hub.c:5204 [inline]
  port_event drivers/usb/core/hub.c:5350 [inline]
  hub_event+0x138e/0x3b00 drivers/usb/core/hub.c:5432
  process_one_work+0x90f/0x1580 kernel/workqueue.c:2269
  worker_thread+0x9b/0xe20 kernel/workqueue.c:2415
  kthread+0x313/0x420 kernel/kthread.c:253
  ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:352

Freed by task 5394:
  set_track mm/kasan/common.c:87 [inline]
  __kasan_slab_free+0x130/0x180 mm/kasan/common.c:459
  slab_free_hook mm/slub.c:1429 [inline]
  slab_free_freelist_hook+0x5e/0x140 mm/slub.c:1456
  slab_free mm/slub.c:3003 [inline]
  kfree+0xce/0x290 mm/slub.c:3958
  device_release+0x7d/0x210 drivers/base/core.c:1064
  kobject_cleanup lib/kobject.c:662 [inline]
  kobject_release lib/kobject.c:691 [inline]
  kref_put include/linux/kref.h:67 [inline]
  kobject_put+0x1df/0x4f0 lib/kobject.c:708
  put_device+0x21/0x30 drivers/base/core.c:2205
  usb_disable_device+0x309/0x790 drivers/usb/core/message.c:1244
  usb_disconnect+0x298/0x870 drivers/usb/core/hub.c:2197
  hub_port_connect drivers/usb/core/hub.c:4940 [inline]
  hub_port_connect_change drivers/usb/core/hub.c:5204 [inline]
  port_event drivers/usb/core/hub.c:5350 [inline]
  hub_event+0xcd2/0x3b00 drivers/usb/core/hub.c:5432
  process_one_work+0x90f/0x1580 kernel/workqueue.c:2269
  worker_thread+0x9b/0xe20 kernel/workqueue.c:2415
  kthread+0x313/0x420 kernel/kthread.c:253
  ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:352

The buggy address belongs to the object at ffff88808fc31100
  which belongs to the cache kmalloc-2k of size 2048
The buggy address is located 280 bytes inside of
  2048-byte region [ffff88808fc31100, ffff88808fc31900)
The buggy address belongs to the page:
page:ffffea00023f0c00 count:1 mapcount:0 mapping:ffff88812c3f4800 index:0x0  
compound_mapcount: 0
flags: 0xfff00000010200(slab|head)
raw: 00fff00000010200 dead000000000100 dead000000000200 ffff88812c3f4800
raw: 0000000000000000 00000000000f000f 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
  ffff88808fc31100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
  ffff88808fc31180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
> ffff88808fc31200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                             ^
  ffff88808fc31280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
  ffff88808fc31300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================


Tested on:

commit:         43151d6c usb-fuzzer: main usb gadget fuzzer driver
git tree:       https://github.com/google/kasan.git usb-fuzzer
console output: https://syzkaller.appspot.com/x/log.txt?x=148b9428a00000
kernel config:  https://syzkaller.appspot.com/x/.config?x=4183eeef650d1234
compiler:       gcc (GCC) 9.0.0 20181231 (experimental)
patch:          https://syzkaller.appspot.com/x/patch.diff?x=17642018a00000


^ permalink raw reply

* Re: KASAN: use-after-free Read in p54u_load_firmware_cb
From: Alan Stern @ 2019-05-18 17:01 UTC (permalink / raw)
  To: syzbot
  Cc: andreyknvl, chunkeey, chunkeey, davem, kvalo, linux-kernel,
	linux-usb, linux-wireless, netdev, oneukum, syzkaller-bugs
In-Reply-To: <00000000000043a1f905892c4a1f@google.com>

On Sat, 18 May 2019, syzbot wrote:

> Hello,
> 
> syzbot tried to test the proposed patch but build/boot failed:

One of these times I'll get it right...

Alan Stern


#syz test: https://github.com/google/kasan.git usb-fuzzer

 drivers/net/wireless/intersil/p54/p54usb.c |   37 +++++++++++------------------
 1 file changed, 15 insertions(+), 22 deletions(-)

Index: usb-devel/drivers/net/wireless/intersil/p54/p54usb.c
===================================================================
--- usb-devel.orig/drivers/net/wireless/intersil/p54/p54usb.c
+++ usb-devel/drivers/net/wireless/intersil/p54/p54usb.c
@@ -33,6 +33,8 @@ MODULE_ALIAS("prism54usb");
 MODULE_FIRMWARE("isl3886usb");
 MODULE_FIRMWARE("isl3887usb");
 
+static struct usb_driver p54u_driver;
+
 /*
  * Note:
  *
@@ -921,9 +923,9 @@ static void p54u_load_firmware_cb(const
 {
 	struct p54u_priv *priv = context;
 	struct usb_device *udev = priv->udev;
+	struct usb_interface *intf = priv->intf;
 	int err;
 
-	complete(&priv->fw_wait_load);
 	if (firmware) {
 		priv->fw = firmware;
 		err = p54u_start_ops(priv);
@@ -932,23 +934,19 @@ static void p54u_load_firmware_cb(const
 		dev_err(&udev->dev, "Firmware not found.\n");
 	}
 
-	if (err) {
-		struct device *parent = priv->udev->dev.parent;
-
-		dev_err(&udev->dev, "failed to initialize device (%d)\n", err);
-
-		if (parent)
-			device_lock(parent);
+	complete(&priv->fw_wait_load);
+	/*
+	 * At this point p54u_disconnect may have already freed
+	 * the "priv" context. Do not use it anymore!
+	 */
+	priv = NULL;
 
-		device_release_driver(&udev->dev);
-		/*
-		 * At this point p54u_disconnect has already freed
-		 * the "priv" context. Do not use it anymore!
-		 */
-		priv = NULL;
+	if (err) {
+		dev_err(&intf->dev, "failed to initialize device (%d)\n", err);
 
-		if (parent)
-			device_unlock(parent);
+		usb_lock_device(udev);
+		usb_driver_release_interface(&p54u_driver, intf);
+		usb_unlock_device(udev);
 	}
 
 	usb_put_dev(udev);
@@ -1011,8 +1009,6 @@ static int p54u_probe(struct usb_interfa
 	skb_queue_head_init(&priv->rx_queue);
 	init_usb_anchor(&priv->submitted);
 
-	usb_get_dev(udev);
-
 	/* really lazy and simple way of figuring out if we're a 3887 */
 	/* TODO: should just stick the identification in the device table */
 	i = intf->altsetting->desc.bNumEndpoints;
@@ -1053,10 +1049,8 @@ static int p54u_probe(struct usb_interfa
 		priv->upload_fw = p54u_upload_firmware_net2280;
 	}
 	err = p54u_load_firmware(dev, intf);
-	if (err) {
-		usb_put_dev(udev);
+	if (err)
 		p54_free_common(dev);
-	}
 	return err;
 }
 
@@ -1072,7 +1066,6 @@ static void p54u_disconnect(struct usb_i
 	wait_for_completion(&priv->fw_wait_load);
 	p54_unregister_common(dev);
 
-	usb_put_dev(interface_to_usbdev(intf));
 	release_firmware(priv->fw);
 	p54_free_common(dev);
 }


^ permalink raw reply

* Re: KASAN: use-after-free Read in p54u_load_firmware_cb
From: syzbot @ 2019-05-18 16:50 UTC (permalink / raw)
  To: andreyknvl, chunkeey, chunkeey, davem, kvalo, linux-kernel,
	linux-usb, linux-wireless, netdev, oneukum, stern, syzkaller-bugs
In-Reply-To: <Pine.LNX.4.44L0.1905181202500.7855-100000@netrider.rowland.org>

Hello,

syzbot tried to test the proposed patch but build/boot failed:

si/sg.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/disp/rootgp102.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/disp/rootgv100.o
   CC      drivers/scsi/ch.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/disp/roottu102.o
   CC      drivers/scsi/ses.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/disp/channv50.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/disp/changf119.o
   CC      drivers/scsi/scsi_sysfs.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/disp/changv100.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/disp/dmacnv50.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/disp/dmacgf119.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/disp/dmacgp102.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/disp/dmacgv100.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/disp/basenv50.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/disp/baseg84.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/disp/basegf119.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/disp/basegp102.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/disp/corenv50.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/disp/coreg84.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/disp/coreg94.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/disp/coregf119.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/disp/coregk104.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/disp/coregp102.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/disp/coregv100.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/disp/ovlynv50.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/disp/ovlyg84.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/disp/ovlygt200.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/disp/ovlygf119.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/disp/ovlygk104.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/disp/ovlygp102.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/disp/wimmgv100.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/disp/wndwgv100.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/disp/piocnv50.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/disp/piocgf119.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/disp/cursgf119.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/disp/cursgp102.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/disp/cursnv50.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/disp/cursgv100.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/disp/oimmnv50.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/disp/oimmgf119.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/disp/oimmgp102.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/dma/base.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/dma/nv04.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/dma/nv50.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/dma/gf100.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/dma/gf119.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/dma/gv100.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/dma/user.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/dma/usernv04.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/dma/usernv50.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/dma/usergf100.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/dma/usergf119.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/dma/usergv100.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/fifo/base.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/fifo/nv04.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/fifo/nv10.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/fifo/nv17.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/fifo/nv40.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/fifo/nv50.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/fifo/g84.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/fifo/gf100.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/fifo/gk110.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/fifo/gk208.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/fifo/gm107.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/fifo/gk20a.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/fifo/gk104.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/fifo/gm200.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/fifo/gm20b.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/fifo/gp100.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/fifo/gp10b.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/fifo/gv100.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/fifo/tu102.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/fifo/chan.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/fifo/channv50.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/fifo/chang84.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/fifo/dmanv04.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/fifo/dmanv17.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/fifo/dmanv10.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/fifo/dmanv40.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/fifo/dmanv50.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/fifo/dmag84.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/fifo/gpfifonv50.o
   AR      drivers/net/ethernet/sun/built-in.a
   CC      drivers/gpu/drm/nouveau/nvkm/engine/fifo/gpfifog84.o
   AR      drivers/net/ethernet/built-in.a
   CC      drivers/gpu/drm/nouveau/nvkm/engine/fifo/gpfifogk104.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/fifo/gpfifogf100.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/fifo/gpfifogv100.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/fifo/usergv100.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/gr/base.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/fifo/usertu102.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/gr/nv04.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/gr/nv15.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/fifo/gpfifotu102.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/gr/nv10.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/gr/nv17.o
scripts/Makefile.build:486: recipe for target 'drivers/net' failed
make[1]: *** [drivers/net] Error 2
make[1]: *** Waiting for unfinished jobs....
   CC      drivers/gpu/drm/nouveau/nvkm/engine/gr/nv25.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/gr/nv20.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/gr/nv2a.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/gr/nv30.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/gr/nv34.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/gr/nv35.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/gr/nv40.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/gr/nv44.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/gr/nv50.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/gr/g84.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/gr/gt200.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/gr/mcp79.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/gr/gt215.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/gr/gf100.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/gr/mcp89.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/gr/gf104.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/gr/gf110.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/gr/gf108.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/gr/gf117.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/gr/gf119.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/gr/gk110.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/gr/gk104.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/gr/gk110b.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/gr/gk208.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/gr/gk20a.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/gr/gm107.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/gr/gm200.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/gr/gm20b.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/gr/gp102.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/gr/gp100.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/gr/gp104.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/gr/gp107.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/gr/gv100.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/gr/gp10b.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxnv40.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxnv50.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgf100.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgf104.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgf108.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgf110.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgf119.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgf117.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgk104.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgk110.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgk110b.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgk208.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgk20a.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgm107.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgm200.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgm20b.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgp100.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgp102.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgp104.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgp107.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgv100.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/mpeg/nv31.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/mpeg/nv40.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/mpeg/nv44.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/mspdec/base.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/mpeg/g84.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/mpeg/nv50.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/mspdec/g98.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/mspdec/gt215.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/mspdec/gf100.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/mspdec/gk104.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/msppp/base.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/msppp/g98.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/msppp/gt215.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/msvld/base.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/msppp/gf100.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/msvld/g98.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/msvld/mcp89.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/msvld/gt215.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/msvld/gf100.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/msvld/gk104.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/nvdec/base.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/nvdec/gp102.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/pm/g84.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/pm/gt200.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/pm/gt215.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/pm/gf100.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/pm/gf108.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/pm/nv40.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/pm/base.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/pm/gf117.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/pm/gk104.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/sec2/base.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/sec/g98.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/pm/nv50.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/sec2/gp102.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/sec2/tu102.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/sw/base.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/sw/nv04.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/sw/nv10.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/sw/nv50.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/sw/gf100.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/sw/chan.o
   CC      drivers/gpu/drm/nouveau/nouveau_acpi.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/vp/g84.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/sw/nvsw.o
   CC      drivers/gpu/drm/nouveau/nouveau_debugfs.o
   CC      drivers/gpu/drm/nouveau/nouveau_drm.o
   CC      drivers/gpu/drm/nouveau/nouveau_hwmon.o
   CC      drivers/gpu/drm/nouveau/nouveau_ioc32.o
   CC      drivers/gpu/drm/nouveau/nouveau_led.o
   CC      drivers/gpu/drm/nouveau/nouveau_nvif.o
   CC      drivers/gpu/drm/nouveau/nouveau_usif.o
   CC      drivers/gpu/drm/nouveau/nouveau_bo.o
   CC      drivers/gpu/drm/nouveau/nouveau_gem.o
   CC      drivers/gpu/drm/nouveau/nouveau_mem.o
   CC      drivers/gpu/drm/nouveau/nouveau_backlight.o
   CC      drivers/gpu/drm/nouveau/nouveau_vga.o
   CC      drivers/gpu/drm/nouveau/nouveau_vmm.o
   CC      drivers/gpu/drm/nouveau/nouveau_ttm.o
   CC      drivers/gpu/drm/nouveau/nouveau_bios.o
   CC      drivers/gpu/drm/nouveau/nouveau_prime.o
   CC      drivers/gpu/drm/nouveau/nouveau_connector.o
   CC      drivers/gpu/drm/nouveau/nouveau_sgdma.o
   CC      drivers/gpu/drm/nouveau/nouveau_dp.o
   CC      drivers/gpu/drm/nouveau/nouveau_display.o
   CC      drivers/gpu/drm/nouveau/nv04_fbcon.o
   CC      drivers/gpu/drm/nouveau/nv50_fbcon.o
   CC      drivers/gpu/drm/nouveau/nouveau_fbcon.o
   CC      drivers/gpu/drm/nouveau/nvc0_fbcon.o
   CC      drivers/gpu/drm/nouveau/dispnv04/arb.o
   CC      drivers/gpu/drm/nouveau/dispnv04/crtc.o
   CC      drivers/gpu/drm/nouveau/dispnv04/cursor.o
   CC      drivers/gpu/drm/nouveau/dispnv04/dac.o
   CC      drivers/gpu/drm/nouveau/dispnv04/dfp.o
   CC      drivers/gpu/drm/nouveau/dispnv04/disp.o
   CC      drivers/gpu/drm/nouveau/dispnv04/hw.o
   CC      drivers/gpu/drm/nouveau/dispnv04/overlay.o
   CC      drivers/gpu/drm/nouveau/dispnv04/tvmodesnv17.o
   CC      drivers/gpu/drm/nouveau/dispnv04/tvnv04.o
   AR      drivers/scsi/built-in.a
   CC      drivers/gpu/drm/nouveau/dispnv04/tvnv17.o
   CC      drivers/gpu/drm/nouveau/dispnv50/disp.o
   CC      drivers/gpu/drm/nouveau/dispnv50/lut.o
   CC      drivers/gpu/drm/nouveau/dispnv50/core507d.o
   CC      drivers/gpu/drm/nouveau/dispnv50/core.o
   CC      drivers/gpu/drm/nouveau/dispnv50/core907d.o
   CC      drivers/gpu/drm/nouveau/dispnv50/core827d.o
   CC      drivers/gpu/drm/nouveau/dispnv50/core917d.o
   CC      drivers/gpu/drm/nouveau/dispnv50/corec37d.o
   CC      drivers/gpu/drm/nouveau/dispnv50/corec57d.o
   CC      drivers/gpu/drm/nouveau/dispnv50/dac907d.o
   CC      drivers/gpu/drm/nouveau/dispnv50/dac507d.o
   CC      drivers/gpu/drm/nouveau/dispnv50/pior507d.o
   CC      drivers/gpu/drm/nouveau/dispnv50/sor507d.o
   CC      drivers/gpu/drm/nouveau/dispnv50/sor907d.o
   CC      drivers/gpu/drm/nouveau/dispnv50/sorc37d.o
   CC      drivers/gpu/drm/nouveau/dispnv50/head.o
   CC      drivers/gpu/drm/nouveau/dispnv50/head507d.o
   CC      drivers/gpu/drm/nouveau/dispnv50/head827d.o
   CC      drivers/gpu/drm/nouveau/dispnv50/head907d.o
   CC      drivers/gpu/drm/nouveau/dispnv50/headc37d.o
   CC      drivers/gpu/drm/nouveau/dispnv50/head917d.o
   CC      drivers/gpu/drm/nouveau/dispnv50/headc57d.o
   CC      drivers/gpu/drm/nouveau/dispnv50/wimm.o
   CC      drivers/gpu/drm/nouveau/dispnv50/wimmc37b.o
   CC      drivers/gpu/drm/nouveau/dispnv50/wndwc37e.o
   CC      drivers/gpu/drm/nouveau/dispnv50/base.o
   CC      drivers/gpu/drm/nouveau/dispnv50/wndwc57e.o
   CC      drivers/gpu/drm/nouveau/dispnv50/wndw.o
   CC      drivers/gpu/drm/nouveau/dispnv50/base907c.o
   CC      drivers/gpu/drm/nouveau/dispnv50/base827c.o
   CC      drivers/gpu/drm/nouveau/dispnv50/base507c.o
   CC      drivers/gpu/drm/nouveau/dispnv50/base917c.o
   CC      drivers/gpu/drm/nouveau/dispnv50/curs.o
   CC      drivers/gpu/drm/nouveau/dispnv50/curs507a.o
   CC      drivers/gpu/drm/nouveau/dispnv50/curs907a.o
   CC      drivers/gpu/drm/nouveau/dispnv50/cursc37a.o
   CC      drivers/gpu/drm/nouveau/dispnv50/oimm.o
   CC      drivers/gpu/drm/nouveau/dispnv50/oimm507b.o
   CC      drivers/gpu/drm/nouveau/dispnv50/ovly.o
   CC      drivers/gpu/drm/nouveau/dispnv50/ovly507e.o
   CC      drivers/gpu/drm/nouveau/dispnv50/ovly827e.o
   CC      drivers/gpu/drm/nouveau/dispnv50/ovly907e.o
   CC      drivers/gpu/drm/nouveau/dispnv50/ovly917e.o
   CC      drivers/gpu/drm/nouveau/nouveau_abi16.o
   CC      drivers/gpu/drm/nouveau/nouveau_chan.o
   CC      drivers/gpu/drm/nouveau/nv04_fence.o
   CC      drivers/gpu/drm/nouveau/nouveau_fence.o
   CC      drivers/gpu/drm/nouveau/nouveau_dma.o
   CC      drivers/gpu/drm/nouveau/nv10_fence.o
   CC      drivers/gpu/drm/nouveau/nv50_fence.o
   CC      drivers/gpu/drm/nouveau/nv17_fence.o
   CC      drivers/gpu/drm/nouveau/nv84_fence.o
   CC      drivers/gpu/drm/nouveau/nvc0_fence.o
   AR      drivers/gpu/drm/nouveau/built-in.a
   AR      drivers/gpu/drm/built-in.a
   AR      drivers/gpu/built-in.a
Makefile:1051: recipe for target 'drivers' failed
make: *** [drivers] Error 2


Error text is too large and was truncated, full error text is at:
https://syzkaller.appspot.com/x/error.txt?x=164a0108a00000


Tested on:

commit:         43151d6c usb-fuzzer: main usb gadget fuzzer driver
git tree:       https://github.com/google/kasan.git usb-fuzzer
compiler:       gcc (GCC) 9.0.0 20181231 (experimental)
patch:          https://syzkaller.appspot.com/x/patch.diff?x=15d1ef02a00000


^ permalink raw reply

* Re: KASAN: use-after-free Read in p54u_load_firmware_cb
From: Alan Stern @ 2019-05-18 16:32 UTC (permalink / raw)
  To: syzbot
  Cc: andreyknvl, chunkeey, chunkeey, davem, kvalo, linux-kernel,
	linux-usb, linux-wireless, netdev, oneukum, syzkaller-bugs
In-Reply-To: <000000000000add98105892b73ec@google.com>

On Sat, 18 May 2019, syzbot wrote:

> Hello,
> 
> syzbot has tested the proposed patch but the reproducer still triggered  
> crash:
> KASAN: slab-out-of-bounds Read in p54u_load_firmware_cb
> 
> usb 6-1: Direct firmware load for isl3887usb failed with error -2
> p54u_load_firmware_cb: priv->udev = ffff88809ad5bb80
> usb 6-1: Firmware not found.
> ==================================================================
> BUG: KASAN: slab-out-of-bounds in p54u_load_firmware_cb+0x3c9/0x45f  
> drivers/net/wireless/intersil/p54/p54usb.c:937
> Read of size 8 at addr ffff88809abab588 by task kworker/1:8/5526

If you look at the full console log, you'll see that this address is 
different from all the addresses printed out earlier.  Not what you 
would expect.

Which makes me wonder: Suppose a disconnect occurs before the firmware 
loader callback runs?  p54_disconnect() will get stuck waiting for the 
priv->fw_load_wait completion to fire.  But when the callback runs, the 
first thing it does is activate the completion.

So now p54_disconnect() can finish doing its thing, including 
deallocating all the private data structures.  Then when 
p54u_load_firmware_cb() tries to read the contents of priv, it ends up 
accessing deallocated memory!

The patch below tries to do things the right way.

Alan Stern


#syz test: https://github.com/google/kasan.git usb-fuzzer

 drivers/net/wireless/intersil/p54/p54usb.c |   37 +++++++++++------------------
 1 file changed, 15 insertions(+), 22 deletions(-)

Index: usb-devel/drivers/net/wireless/intersil/p54/p54usb.c
===================================================================
--- usb-devel.orig/drivers/net/wireless/intersil/p54/p54usb.c
+++ usb-devel/drivers/net/wireless/intersil/p54/p54usb.c
@@ -33,6 +33,8 @@ MODULE_ALIAS("prism54usb");
 MODULE_FIRMWARE("isl3886usb");
 MODULE_FIRMWARE("isl3887usb");
 
+static struct usb_driver p54u_driver;
+
 /*
  * Note:
  *
@@ -921,9 +923,9 @@ static void p54u_load_firmware_cb(const
 {
 	struct p54u_priv *priv = context;
 	struct usb_device *udev = priv->udev;
+	struct usb_interface *intf = priv->intf;
 	int err;
 
-	complete(&priv->fw_wait_load);
 	if (firmware) {
 		priv->fw = firmware;
 		err = p54u_start_ops(priv);
@@ -932,23 +934,19 @@ static void p54u_load_firmware_cb(const
 		dev_err(&udev->dev, "Firmware not found.\n");
 	}
 
-	if (err) {
-		struct device *parent = priv->udev->dev.parent;
-
-		dev_err(&udev->dev, "failed to initialize device (%d)\n", err);
-
-		if (parent)
-			device_lock(parent);
+	complete(&priv->fw_wait_load);
+	/*
+	 * At this point p54u_disconnect may have already freed
+	 * the "priv" context. Do not use it anymore!
+	 */
+	priv = NULL;
 
-		device_release_driver(&udev->dev);
-		/*
-		 * At this point p54u_disconnect has already freed
-		 * the "priv" context. Do not use it anymore!
-		 */
-		priv = NULL;
+	if (err) {
+		dev_err(&intf->dev, "failed to initialize device (%d)\n", err);
 
-		if (parent)
-			device_unlock(parent);
+		usb_lock_device(udev);
+		usb_driver_release_interface(intf, &p54u_driver);
+		usb_unlock_device(udev);
 	}
 
 	usb_put_dev(udev);
@@ -1011,8 +1009,6 @@ static int p54u_probe(struct usb_interfa
 	skb_queue_head_init(&priv->rx_queue);
 	init_usb_anchor(&priv->submitted);
 
-	usb_get_dev(udev);
-
 	/* really lazy and simple way of figuring out if we're a 3887 */
 	/* TODO: should just stick the identification in the device table */
 	i = intf->altsetting->desc.bNumEndpoints;
@@ -1053,10 +1049,8 @@ static int p54u_probe(struct usb_interfa
 		priv->upload_fw = p54u_upload_firmware_net2280;
 	}
 	err = p54u_load_firmware(dev, intf);
-	if (err) {
-		usb_put_dev(udev);
+	if (err)
 		p54_free_common(dev);
-	}
 	return err;
 }
 
@@ -1072,7 +1066,6 @@ static void p54u_disconnect(struct usb_i
 	wait_for_completion(&priv->fw_wait_load);
 	p54_unregister_common(dev);
 
-	usb_put_dev(interface_to_usbdev(intf));
 	release_firmware(priv->fw);
 	p54_free_common(dev);
 }


^ permalink raw reply

* Re: KASAN: use-after-free Read in p54u_load_firmware_cb
From: syzbot @ 2019-05-18 15:50 UTC (permalink / raw)
  To: andreyknvl, chunkeey, chunkeey, davem, kvalo, linux-kernel,
	linux-usb, linux-wireless, netdev, oneukum, stern, syzkaller-bugs
In-Reply-To: <Pine.LNX.4.44L0.1905181045400.7855-100000@netrider.rowland.org>

Hello,

syzbot has tested the proposed patch but the reproducer still triggered  
crash:
KASAN: slab-out-of-bounds Read in p54u_load_firmware_cb

usb 6-1: Direct firmware load for isl3887usb failed with error -2
p54u_load_firmware_cb: priv->udev = ffff88809ad5bb80
usb 6-1: Firmware not found.
==================================================================
BUG: KASAN: slab-out-of-bounds in p54u_load_firmware_cb+0x3c9/0x45f  
drivers/net/wireless/intersil/p54/p54usb.c:937
Read of size 8 at addr ffff88809abab588 by task kworker/1:8/5526

CPU: 1 PID: 5526 Comm: kworker/1:8 Not tainted 5.1.0-rc3-g43151d6-dirty #1
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS  
Google 01/01/2011
Workqueue: events request_firmware_work_func
Call Trace:
  __dump_stack lib/dump_stack.c:77 [inline]
  dump_stack+0xe8/0x16e lib/dump_stack.c:113
  print_address_description+0x6c/0x236 mm/kasan/report.c:187
  kasan_report.cold+0x1a/0x3c mm/kasan/report.c:317
  p54u_load_firmware_cb+0x3c9/0x45f  
drivers/net/wireless/intersil/p54/p54usb.c:937
  request_firmware_work_func+0x12d/0x249  
drivers/base/firmware_loader/main.c:785
  process_one_work+0x90f/0x1580 kernel/workqueue.c:2269
  worker_thread+0x9b/0xe20 kernel/workqueue.c:2415
  kthread+0x313/0x420 kernel/kthread.c:253
  ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:352

Allocated by task 5503:
  set_track mm/kasan/common.c:87 [inline]
  __kasan_kmalloc mm/kasan/common.c:497 [inline]
  __kasan_kmalloc.constprop.0+0xbf/0xd0 mm/kasan/common.c:470
  slab_post_alloc_hook mm/slab.h:437 [inline]
  slab_alloc_node mm/slub.c:2756 [inline]
  __kmalloc_node_track_caller+0xf3/0x320 mm/slub.c:4372
  __kmalloc_reserve.isra.0+0x3e/0xf0 net/core/skbuff.c:140
  __alloc_skb+0xf4/0x5a0 net/core/skbuff.c:208
  alloc_skb include/linux/skbuff.h:1058 [inline]
  netlink_alloc_large_skb net/netlink/af_netlink.c:1182 [inline]
  netlink_sendmsg+0x8db/0xcd0 net/netlink/af_netlink.c:1900
  sock_sendmsg_nosec net/socket.c:651 [inline]
  sock_sendmsg+0xda/0x130 net/socket.c:661
  ___sys_sendmsg+0x80b/0x930 net/socket.c:2260
  __sys_sendmsg+0xf1/0x1b0 net/socket.c:2298
  do_syscall_64+0xcf/0x4f0 arch/x86/entry/common.c:290
  entry_SYSCALL_64_after_hwframe+0x49/0xbe

Freed by task 5503:
  set_track mm/kasan/common.c:87 [inline]
  __kasan_slab_free+0x130/0x180 mm/kasan/common.c:459
  slab_free_hook mm/slub.c:1429 [inline]
  slab_free_freelist_hook+0x5e/0x140 mm/slub.c:1456
  slab_free mm/slub.c:3003 [inline]
  kfree+0xce/0x290 mm/slub.c:3958
  skb_free_head+0x90/0xb0 net/core/skbuff.c:557
  skb_release_data+0x543/0x8b0 net/core/skbuff.c:577
  skb_release_all+0x4b/0x60 net/core/skbuff.c:631
  __kfree_skb net/core/skbuff.c:645 [inline]
  consume_skb net/core/skbuff.c:705 [inline]
  consume_skb+0xc5/0x2f0 net/core/skbuff.c:699
  netlink_unicast_kernel net/netlink/af_netlink.c:1311 [inline]
  netlink_unicast+0x4e2/0x690 net/netlink/af_netlink.c:1336
  netlink_sendmsg+0x810/0xcd0 net/netlink/af_netlink.c:1925
  sock_sendmsg_nosec net/socket.c:651 [inline]
  sock_sendmsg+0xda/0x130 net/socket.c:661
  ___sys_sendmsg+0x80b/0x930 net/socket.c:2260
  __sys_sendmsg+0xf1/0x1b0 net/socket.c:2298
  do_syscall_64+0xcf/0x4f0 arch/x86/entry/common.c:290
  entry_SYSCALL_64_after_hwframe+0x49/0xbe

The buggy address belongs to the object at ffff88809abab180
  which belongs to the cache kmalloc-1k of size 1024
The buggy address is located 8 bytes to the right of
  1024-byte region [ffff88809abab180, ffff88809abab580)
The buggy address belongs to the page:
page:ffffea00026aea00 count:1 mapcount:0 mapping:ffff88812c3f4a00 index:0x0  
compound_mapcount: 0
flags: 0xfff00000010200(slab|head)
raw: 00fff00000010200 dead000000000100 dead000000000200 ffff88812c3f4a00
raw: 0000000000000000 00000000000e000e 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
  ffff88809abab480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
  ffff88809abab500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
> ffff88809abab580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
                       ^
  ffff88809abab600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
  ffff88809abab680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================


Tested on:

commit:         43151d6c usb-fuzzer: main usb gadget fuzzer driver
git tree:       https://github.com/google/kasan.git usb-fuzzer
console output: https://syzkaller.appspot.com/x/log.txt?x=108a0108a00000
kernel config:  https://syzkaller.appspot.com/x/.config?x=4183eeef650d1234
compiler:       gcc (GCC) 9.0.0 20181231 (experimental)
patch:          https://syzkaller.appspot.com/x/patch.diff?x=1292f852a00000


^ permalink raw reply

* Re: KASAN: use-after-free Read in p54u_load_firmware_cb
From: Alan Stern @ 2019-05-18 15:13 UTC (permalink / raw)
  To: syzbot
  Cc: andreyknvl, chunkeey, chunkeey, davem, kvalo,
	Kernel development list, USB list, linux-wireless, netdev,
	Oliver Neukum, syzkaller-bugs
In-Reply-To: <00000000000009fcff05891bae0a@google.com>

On Fri, 17 May 2019, syzbot wrote:

> Hello,
> 
> syzbot tried to test the proposed patch but build/boot failed:

Drat.  Mistake in the patch.  Let's try again.

Incidentally, as far as I can tell there's no point in having the
usb_get_dev() in p54u_probe() and usb_put_dev() in p54u_disconnect().  
The device structure is guaranteed not to be deallocated while a driver
is bound to any of its interfaces, so taking an extra reference won't
make any difference.

On the other hand, I do see some problems in the firmware-load
callback.  First, it calls device_release_driver() without first
checking that the interface is still bound to the p54u driver.  
Second, it shouldn't call device_release_driver() at all -- it should
call usb_driver_release_interface().  It doesn't want to unbind the USB
device's driver; it wants to unbind the interface's driver.  And third,
to do this it needs to acquire udev's device lock, not the lock for
udev's parent.

Alan Stern


#syz test: https://github.com/google/kasan.git usb-fuzzer

 drivers/net/wireless/intersil/p54/p54usb.c |    3 +++
 1 file changed, 3 insertions(+)

Index: usb-devel/drivers/net/wireless/intersil/p54/p54usb.c
===================================================================
--- usb-devel.orig/drivers/net/wireless/intersil/p54/p54usb.c
+++ usb-devel/drivers/net/wireless/intersil/p54/p54usb.c
@@ -923,6 +923,7 @@ static void p54u_load_firmware_cb(const
 	struct usb_device *udev = priv->udev;
 	int err;
 
+	pr_info("%s: priv->udev = %px\n", __func__, udev);
 	complete(&priv->fw_wait_load);
 	if (firmware) {
 		priv->fw = firmware;
@@ -969,6 +970,8 @@ static int p54u_load_firmware(struct iee
 	if (i < 0)
 		return i;
 
+	dev_info(&udev->dev, "%s: udev @ %px, dev.parent @ %px\n",
+			__func__, udev, &udev->dev.parent);
 	dev_info(&priv->udev->dev, "Loading firmware file %s\n",
 	       p54u_fwlist[i].fw);


^ permalink raw reply

* RE: [PATCH 0/3] brcmfmac: sdio: Deal better w/ transmission errors waking from sleep
From: Avri Altman @ 2019-05-18 15:09 UTC (permalink / raw)
  To: Douglas Anderson, Ulf Hansson, Kalle Valo, Adrian Hunter,
	Arend van Spriel
  Cc: linux-rockchip@lists.infradead.org, Double Lo,
	briannorris@chromium.org, Madhan Mohan R, mka@chromium.org,
	Wright Feng, Chi-Hsien Lin, linux-mmc@vger.kernel.org, Shawn Lin,
	brcm80211-dev-list@cypress.com, YueHaibing, Hante Meuleman,
	Martin Hicks, Ritesh Harjani, Michael Trimarchi, Wolfram Sang,
	Franky Lin, Jiong Wu, brcm80211-dev-list.pdl@broadcom.com,
	David S. Miller, netdev@vger.kernel.org,
	linux-wireless@vger.kernel.org, linux-kernel@vger.kernel.org,
	Naveen Gupta, Madhan Mohan R
In-Reply-To: <20190517225420.176893-1-dianders@chromium.org>

> 
> This series attempts to deal better with the expected transmission
> errors that we get when waking up the SDIO-based WiFi on
> rk3288-veyron-minnie, rk3288-veyron-speedy, and rk3288-veyron-mickey.
> 
> Some details about those errors can be found in
> <https://crbug.com/960222>, but to summarize it here: if we try to
> send the wakeup command to the WiFi card at the same time it has
> decided to wake up itself then it will behave badly on the SDIO bus.
> This can cause timeouts or CRC errors.
Wake-up itself: as part of a WoWlan, or d0i3?
Looks like this calls for a wifi driver fix, and not WA in the mmc driver.

Thanks,
Avri

^ permalink raw reply

* [PATCH 0/3] brcmfmac: sdio: Deal better w/ transmission errors waking from sleep
From: Douglas Anderson @ 2019-05-17 22:54 UTC (permalink / raw)
  To: Ulf Hansson, Kalle Valo, Adrian Hunter, Arend van Spriel
  Cc: linux-rockchip, Double Lo, briannorris, Madhan Mohan R, mka,
	Wright Feng, Chi-Hsien Lin, Douglas Anderson, linux-mmc,
	Shawn Lin, brcm80211-dev-list, YueHaibing, Hante Meuleman,
	Martin Hicks, Ritesh Harjani, Michael Trimarchi, Wolfram Sang,
	Franky Lin, Jiong Wu, brcm80211-dev-list.pdl, David S. Miller,
	netdev, linux-wireless, linux-kernel, Naveen Gupta,
	Madhan Mohan R, Avri Altman

This series attempts to deal better with the expected transmission
errors that we get when waking up the SDIO-based WiFi on
rk3288-veyron-minnie, rk3288-veyron-speedy, and rk3288-veyron-mickey.

Some details about those errors can be found in
<https://crbug.com/960222>, but to summarize it here: if we try to
send the wakeup command to the WiFi card at the same time it has
decided to wake up itself then it will behave badly on the SDIO bus.
This can cause timeouts or CRC errors.

When I tested on 4.19 and 4.20 these CRC errors can be seen to cause
re-tuning.  Since I am currently developing on 4.19 this was the
original problem I attempted to solve.

On mainline it turns out that you don't see the retuning errors but
you see tons of spam about timeouts trying to wakeup from sleep.  I
tracked down the commit that was causing that and have partially
reverted it here.  I have no real knowledge about Broadcom WiFi, but
the commit that was causing problems sounds (from the descriptioin) to
be a hack commit penalizing all Broadcom WiFi users because of a bug
in a Cypress SD controller.  I will let others comment if this is
truly the case and, if so, what the right solution should be.


Douglas Anderson (3):
  brcmfmac: re-enable command decode in sdio_aos for BRCM 4354
  mmc: core: API for temporarily disabling auto-retuning due to errors
  brcmfmac: sdio: Disable auto-tuning around commands expected to fail

 drivers/mmc/core/core.c                       | 27 +++++++++++++++++--
 .../broadcom/brcm80211/brcmfmac/sdio.c        |  6 +++--
 include/linux/mmc/core.h                      |  2 ++
 include/linux/mmc/host.h                      |  1 +
 4 files changed, 32 insertions(+), 4 deletions(-)

-- 
2.21.0.1020.gf2820cf01a-goog


^ permalink raw reply

* [PATCH 1/3] brcmfmac: re-enable command decode in sdio_aos for BRCM 4354
From: Douglas Anderson @ 2019-05-17 22:54 UTC (permalink / raw)
  To: Ulf Hansson, Kalle Valo, Adrian Hunter, Arend van Spriel
  Cc: linux-rockchip, Double Lo, briannorris, Madhan Mohan R, mka,
	Wright Feng, Chi-Hsien Lin, Douglas Anderson,
	brcm80211-dev-list.pdl, Franky Lin, netdev, linux-wireless,
	linux-kernel, Madhan Mohan R, Hante Meuleman, Naveen Gupta,
	brcm80211-dev-list, YueHaibing, David S. Miller
In-Reply-To: <20190517225420.176893-1-dianders@chromium.org>

In commit 29f6589140a1 ("brcmfmac: disable command decode in
sdio_aos") we disabled something called "command decode in sdio_aos"
for a whole bunch of Broadcom SDIO WiFi parts.

After that patch landed I find that my kernel log on
rk3288-veyron-minnie and rk3288-veyron-speedy is filled with:
  brcmfmac: brcmf_sdio_bus_sleep: error while changing bus sleep state -110

This seems to happen every time the Broadcom WiFi transitions out of
sleep mode.  Reverting the part of the commit that affects the WiFi on
my boards fixes the problem for me, so that's what this patch does.

Note that, in general, the justification in the original commit seemed
a little weak.  It looked like someone was testing on a SD card
controller that would sometimes die if there were CRC errors on the
bus.  This used to happen back in early days of dw_mmc (the controller
on my boards), but we fixed it.  Disabling a feature on all boards
just because one SD card controller is broken seems bad.  ...so
instead of just this patch possibly the right thing to do is to fully
revert the original commit.

Fixes: 29f6589140a1 ("brcmfmac: disable command decode in sdio_aos")
Signed-off-by: Douglas Anderson <dianders@chromium.org>
---

 drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
index 22b73da42822..3fd2d58a3c88 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
@@ -3378,8 +3378,7 @@ static bool brcmf_sdio_aos_no_decode(struct brcmf_sdio *bus)
 	if (bus->ci->chip == CY_CC_43012_CHIP_ID ||
 	    bus->ci->chip == CY_CC_4373_CHIP_ID ||
 	    bus->ci->chip == BRCM_CC_4339_CHIP_ID ||
-	    bus->ci->chip == BRCM_CC_4345_CHIP_ID ||
-	    bus->ci->chip == BRCM_CC_4354_CHIP_ID)
+	    bus->ci->chip == BRCM_CC_4345_CHIP_ID)
 		return true;
 	else
 		return false;
-- 
2.21.0.1020.gf2820cf01a-goog


^ permalink raw reply related

* [PATCH 3/3] brcmfmac: sdio: Disable auto-tuning around commands expected to fail
From: Douglas Anderson @ 2019-05-17 22:54 UTC (permalink / raw)
  To: Ulf Hansson, Kalle Valo, Adrian Hunter, Arend van Spriel
  Cc: linux-rockchip, Double Lo, briannorris, Madhan Mohan R, mka,
	Wright Feng, Chi-Hsien Lin, Douglas Anderson,
	brcm80211-dev-list.pdl, David S. Miller, Franky Lin, netdev,
	linux-wireless, linux-kernel, Hante Meuleman, Naveen Gupta,
	brcm80211-dev-list, YueHaibing, Michael Trimarchi
In-Reply-To: <20190517225420.176893-1-dianders@chromium.org>

There are certain cases, notably when transitioning between sleep and
active state, when Broadcom SDIO WiFi cards will produce errors on the
SDIO bus.  This is evident from the source code where you can see that
we try commands in a loop until we either get success or we've tried
too many times.  The comment in the code reinforces this by saying
"just one write attempt may fail"

Unfortunately these failures sometimes end up causing an "-EILSEQ"
back to the core which triggers a retuning of the SDIO card and that
blocks all traffic to the card until it's done.

Let's disable retuning around the commands we expect might fail.

Fixes: bd11e8bd03ca ("mmc: core: Flag re-tuning is needed on CRC errors")
Signed-off-by: Douglas Anderson <dianders@chromium.org>
---

 drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
index 3fd2d58a3c88..c09bb8965487 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
@@ -27,6 +27,7 @@
 #include <linux/mmc/sdio_ids.h>
 #include <linux/mmc/sdio_func.h>
 #include <linux/mmc/card.h>
+#include <linux/mmc/core.h>
 #include <linux/semaphore.h>
 #include <linux/firmware.h>
 #include <linux/module.h>
@@ -708,6 +709,7 @@ brcmf_sdio_kso_control(struct brcmf_sdio *bus, bool on)
 		bmask = SBSDIO_FUNC1_SLEEPCSR_KSO_MASK;
 	}
 
+	mmc_expect_errors_begin(bus->sdiodev->func1->card->host);
 	do {
 		/* reliable KSO bit set/clr:
 		 * the sdiod sleep write access is synced to PMU 32khz clk
@@ -730,6 +732,7 @@ brcmf_sdio_kso_control(struct brcmf_sdio *bus, bool on)
 				   &err);
 
 	} while (try_cnt++ < MAX_KSO_ATTEMPTS);
+	mmc_expect_errors_end(bus->sdiodev->func1->card->host);
 
 	if (try_cnt > 2)
 		brcmf_dbg(SDIO, "try_cnt=%d rd_val=0x%x err=%d\n", try_cnt,
-- 
2.21.0.1020.gf2820cf01a-goog


^ permalink raw reply related

* Re: [PATCH] mt76: mt7615: select wifi band according to eeprom
From: Lorenzo Bianconi @ 2019-05-17 21:35 UTC (permalink / raw)
  To: Felix Fietkau; +Cc: linux-wireless, Ryder Lee, royluo
In-Reply-To: <38aa977df45a92f60d78d9cb7e575289ccbaeef6.1558127930.git.lorenzo@kernel.org>

>
> Select supported band according to the value read from
> eeprom mtd/otp partition
>

I forgot to mention this patch is based on 'mt76: mt7615: add support
for mtd eeprom parsing'
https://patchwork.kernel.org/patch/10947385/

Regards,
Lorenzo

> Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
> ---
>  .../wireless/mediatek/mt76/mt7615/eeprom.c    | 24 ++++++++++++++++---
>  .../wireless/mediatek/mt76/mt7615/eeprom.h    |  9 +++++++
>  2 files changed, 30 insertions(+), 3 deletions(-)
>
> diff --git a/drivers/net/wireless/mediatek/mt76/mt7615/eeprom.c b/drivers/net/wireless/mediatek/mt76/mt7615/eeprom.c
> index 1712f66520a8..714590878d65 100644
> --- a/drivers/net/wireless/mediatek/mt76/mt7615/eeprom.c
> +++ b/drivers/net/wireless/mediatek/mt76/mt7615/eeprom.c
> @@ -90,6 +90,26 @@ static int mt7615_check_eeprom(struct mt76_dev *dev)
>         }
>  }
>
> +static void mt7615_eeprom_parse_hw_cap(struct mt7615_dev *dev)
> +{
> +       u8 val, *eeprom = dev->mt76.eeprom.data;
> +
> +       val = FIELD_GET(MT_EE_NIC_WIFI_CONF_BAND_SEL,
> +                       eeprom[MT_EE_WIFI_CONF]);
> +       switch (val) {
> +       case MT_EE_5GHZ:
> +               dev->mt76.cap.has_5ghz = true;
> +               break;
> +       case MT_EE_2GHZ:
> +               dev->mt76.cap.has_2ghz = true;
> +               break;
> +       default:
> +               dev->mt76.cap.has_2ghz = true;
> +               dev->mt76.cap.has_5ghz = true;
> +               break;
> +       }
> +}
> +
>  int mt7615_eeprom_init(struct mt7615_dev *dev)
>  {
>         int ret;
> @@ -103,9 +123,7 @@ int mt7615_eeprom_init(struct mt7615_dev *dev)
>                 memcpy(dev->mt76.eeprom.data, dev->mt76.otp.data,
>                        MT7615_EEPROM_SIZE);
>
> -       dev->mt76.cap.has_2ghz = true;
> -       dev->mt76.cap.has_5ghz = true;
> -
> +       mt7615_eeprom_parse_hw_cap(dev);
>         memcpy(dev->mt76.macaddr, dev->mt76.eeprom.data + MT_EE_MAC_ADDR,
>                ETH_ALEN);
>
> diff --git a/drivers/net/wireless/mediatek/mt76/mt7615/eeprom.h b/drivers/net/wireless/mediatek/mt76/mt7615/eeprom.h
> index a4cf16688171..b422e395d6ee 100644
> --- a/drivers/net/wireless/mediatek/mt76/mt7615/eeprom.h
> +++ b/drivers/net/wireless/mediatek/mt76/mt7615/eeprom.h
> @@ -11,8 +11,17 @@ enum mt7615_eeprom_field {
>         MT_EE_VERSION =                         0x002,
>         MT_EE_MAC_ADDR =                        0x004,
>         MT_EE_NIC_CONF_0 =                      0x034,
> +       MT_EE_WIFI_CONF =                       0x03e,
>
>         __MT_EE_MAX =                           0x3bf
>  };
>
> +#define MT_EE_NIC_WIFI_CONF_BAND_SEL           GENMASK(5, 4)
> +enum mt7615_eeprom_band {
> +       MT_EE_DUAL_BAND,
> +       MT_EE_5GHZ,
> +       MT_EE_2GHZ,
> +       MT_EE_DBDC,
> +};
> +
>  #endif
> --
> 2.20.1
>

^ permalink raw reply

* [PATCH] mt76: mt7615: select wifi band according to eeprom
From: Lorenzo Bianconi @ 2019-05-17 21:32 UTC (permalink / raw)
  To: nbd; +Cc: lorenzo.bianconi, linux-wireless, ryder.lee, royluo
In-Reply-To: <cover.1558127930.git.lorenzo@kernel.org>

Select supported band according to the value read from
eeprom mtd/otp partition

Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
---
 .../wireless/mediatek/mt76/mt7615/eeprom.c    | 24 ++++++++++++++++---
 .../wireless/mediatek/mt76/mt7615/eeprom.h    |  9 +++++++
 2 files changed, 30 insertions(+), 3 deletions(-)

diff --git a/drivers/net/wireless/mediatek/mt76/mt7615/eeprom.c b/drivers/net/wireless/mediatek/mt76/mt7615/eeprom.c
index 1712f66520a8..714590878d65 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7615/eeprom.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7615/eeprom.c
@@ -90,6 +90,26 @@ static int mt7615_check_eeprom(struct mt76_dev *dev)
 	}
 }
 
+static void mt7615_eeprom_parse_hw_cap(struct mt7615_dev *dev)
+{
+	u8 val, *eeprom = dev->mt76.eeprom.data;
+
+	val = FIELD_GET(MT_EE_NIC_WIFI_CONF_BAND_SEL,
+			eeprom[MT_EE_WIFI_CONF]);
+	switch (val) {
+	case MT_EE_5GHZ:
+		dev->mt76.cap.has_5ghz = true;
+		break;
+	case MT_EE_2GHZ:
+		dev->mt76.cap.has_2ghz = true;
+		break;
+	default:
+		dev->mt76.cap.has_2ghz = true;
+		dev->mt76.cap.has_5ghz = true;
+		break;
+	}
+}
+
 int mt7615_eeprom_init(struct mt7615_dev *dev)
 {
 	int ret;
@@ -103,9 +123,7 @@ int mt7615_eeprom_init(struct mt7615_dev *dev)
 		memcpy(dev->mt76.eeprom.data, dev->mt76.otp.data,
 		       MT7615_EEPROM_SIZE);
 
-	dev->mt76.cap.has_2ghz = true;
-	dev->mt76.cap.has_5ghz = true;
-
+	mt7615_eeprom_parse_hw_cap(dev);
 	memcpy(dev->mt76.macaddr, dev->mt76.eeprom.data + MT_EE_MAC_ADDR,
 	       ETH_ALEN);
 
diff --git a/drivers/net/wireless/mediatek/mt76/mt7615/eeprom.h b/drivers/net/wireless/mediatek/mt76/mt7615/eeprom.h
index a4cf16688171..b422e395d6ee 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7615/eeprom.h
+++ b/drivers/net/wireless/mediatek/mt76/mt7615/eeprom.h
@@ -11,8 +11,17 @@ enum mt7615_eeprom_field {
 	MT_EE_VERSION =				0x002,
 	MT_EE_MAC_ADDR =			0x004,
 	MT_EE_NIC_CONF_0 =			0x034,
+	MT_EE_WIFI_CONF =			0x03e,
 
 	__MT_EE_MAX =				0x3bf
 };
 
+#define MT_EE_NIC_WIFI_CONF_BAND_SEL		GENMASK(5, 4)
+enum mt7615_eeprom_band {
+	MT_EE_DUAL_BAND,
+	MT_EE_5GHZ,
+	MT_EE_2GHZ,
+	MT_EE_DBDC,
+};
+
 #endif
-- 
2.20.1


^ permalink raw reply related

* Re: KASAN: use-after-free Read in p54u_load_firmware_cb
From: syzbot @ 2019-05-17 21:01 UTC (permalink / raw)
  To: andreyknvl, chunkeey, chunkeey, davem, flamingice, kvalo,
	linux-kernel, linux-usb, linux-wireless, netdev, oneukum, stern,
	syzkaller-bugs
In-Reply-To: <Pine.LNX.4.44L0.1905171644110.1430-100000@iolanthe.rowland.org>

Hello,

syzbot tried to test the proposed patch but build/boot failed:

  |  ipr_init_dump_entry_hdr(&driver_dump->location_entry.hdr);
       |                          ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   CC      drivers/gpu/drm/nouveau/nvkm/engine/disp/ovlygk104.o
   CC      drivers/scsi/xen-scsifront.o
drivers/scsi/ipr.c: In function ‘ipr_build_ioadl’:
drivers/scsi/ipr.c:6017:11: warning: taking address of packed member of  
‘struct ipr_ioarcb_add_data’ may result in an unaligned pointer value  
[-Waddress-of-packed-member]
  6017 |   ioadl = ioarcb->u.add_data.u.ioadl;
       |           ^~~~~~
drivers/scsi/ipr.c: In function ‘ipr_check_term_power’:
drivers/scsi/ipr.c:7452:8: warning: taking address of packed member of  
‘struct ipr_mode_page28’ may result in an unaligned pointer value  
[-Waddress-of-packed-member]
  7452 |  bus = mode_page->bus;
       |        ^~~~~~~~~
drivers/scsi/ipr.c: In function ‘ipr_modify_ioafp_mode_page_28’:
drivers/scsi/ipr.c:7514:20: warning: taking address of packed member of  
‘struct ipr_mode_page28’ may result in an unaligned pointer value  
[-Waddress-of-packed-member]
  7514 |  for (i = 0, bus = mode_page->bus;
       |                    ^~~~~~~~~
   CC      drivers/scsi/storvsc_drv.o
   CC      drivers/scsi/wd719x.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/disp/ovlygp102.o
   CC      drivers/scsi/st.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/disp/wimmgv100.o
   CC      drivers/scsi/osst.o
drivers/scsi/storvsc_drv.c: In function ‘storvsc_on_channel_callback’:
drivers/scsi/storvsc_drv.c:1173:24: warning: taking address of packed  
member of ‘struct vmpacket_descriptor’ may result in an unaligned pointer  
value [-Waddress-of-packed-member]
  1173 |    ((unsigned long)desc->trans_id);
       |                    ~~~~^~~~~~~~~~
   CC      drivers/gpu/drm/nouveau/nvkm/engine/disp/wndwgv100.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/disp/piocnv50.o
   CC      drivers/scsi/sd.o
   CC      drivers/scsi/sd_dif.o
   CC      drivers/scsi/sd_zbc.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/disp/piocgf119.o
   CC      drivers/scsi/sr.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/disp/cursnv50.o
   CC      drivers/scsi/sr_ioctl.o
   CC      drivers/scsi/sr_vendor.o
   CC      drivers/scsi/sg.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/disp/cursgf119.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/disp/cursgp102.o
   CC      drivers/scsi/ch.o
   CC      drivers/scsi/ses.o
   CC      drivers/scsi/scsi_sysfs.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/disp/cursgv100.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/disp/oimmnv50.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/disp/oimmgf119.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/disp/oimmgp102.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/dma/nv04.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/dma/base.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/dma/nv50.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/dma/gf100.o
   AR      drivers/scsi/qla2xxx/built-in.a
   CC      drivers/gpu/drm/nouveau/nvkm/engine/dma/gf119.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/dma/gv100.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/dma/user.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/dma/usernv04.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/dma/usergf100.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/dma/usernv50.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/dma/usergf119.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/fifo/nv04.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/dma/usergv100.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/fifo/base.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/fifo/nv10.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/fifo/nv40.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/fifo/nv17.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/fifo/nv50.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/fifo/g84.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/fifo/gf100.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/fifo/gk110.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/fifo/gk104.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/fifo/gk208.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/fifo/gk20a.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/fifo/gm107.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/fifo/gm200.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/fifo/gm20b.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/fifo/gp100.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/fifo/gp10b.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/fifo/gv100.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/fifo/tu102.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/fifo/chan.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/fifo/channv50.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/fifo/chang84.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/fifo/dmanv04.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/fifo/dmanv17.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/fifo/dmanv10.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/fifo/dmanv40.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/fifo/dmanv50.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/fifo/dmag84.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/fifo/gpfifonv50.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/fifo/gpfifog84.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/fifo/gpfifogf100.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/fifo/gpfifogk104.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/fifo/gpfifogv100.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/fifo/gpfifotu102.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/fifo/usertu102.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/fifo/usergv100.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/gr/base.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/gr/nv04.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/gr/nv10.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/gr/nv15.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/gr/nv17.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/gr/nv20.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/gr/nv25.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/gr/nv2a.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/gr/nv30.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/gr/nv34.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/gr/nv35.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/gr/nv44.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/gr/nv40.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/gr/nv50.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/gr/g84.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/gr/gt200.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/gr/mcp79.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/gr/gt215.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/gr/mcp89.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/gr/gf100.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/gr/gf104.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/gr/gf108.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/gr/gf110.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/gr/gf117.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/gr/gf119.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/gr/gk104.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/gr/gk110.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/gr/gk110b.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/gr/gk208.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/gr/gk20a.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/gr/gm107.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/gr/gm200.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/gr/gm20b.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/gr/gp100.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/gr/gp102.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/gr/gp104.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/gr/gp107.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/gr/gp10b.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/gr/gv100.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxnv40.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxnv50.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgf100.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgf104.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgf108.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgf110.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgf117.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgf119.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgk104.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgk110b.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgk110.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgk208.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgm107.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgk20a.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgm200.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgp100.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgp104.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgm20b.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgp107.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgp102.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/mpeg/nv31.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgv100.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/mpeg/nv40.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/mpeg/nv44.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/mpeg/nv50.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/mpeg/g84.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/mspdec/base.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/mspdec/g98.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/mspdec/gt215.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/mspdec/gf100.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/msppp/base.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/mspdec/gk104.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/msppp/g98.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/msppp/gt215.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/msvld/base.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/msppp/gf100.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/msvld/g98.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/msvld/gt215.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/msvld/mcp89.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/msvld/gf100.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/msvld/gk104.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/nvdec/base.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/nvdec/gp102.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/pm/base.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/pm/nv40.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/pm/nv50.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/pm/g84.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/pm/gt200.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/pm/gt215.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/pm/gf108.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/pm/gf117.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/pm/gf100.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/pm/gk104.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/sec/g98.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/sec2/base.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/sec2/gp102.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/sec2/tu102.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/sw/base.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/sw/nv04.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/sw/nv10.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/sw/nv50.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/sw/gf100.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/sw/chan.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/sw/nvsw.o
   CC      drivers/gpu/drm/nouveau/nvkm/engine/vp/g84.o
   CC      drivers/gpu/drm/nouveau/nouveau_acpi.o
   CC      drivers/gpu/drm/nouveau/nouveau_debugfs.o
   CC      drivers/gpu/drm/nouveau/nouveau_drm.o
   CC      drivers/gpu/drm/nouveau/nouveau_hwmon.o
   CC      drivers/gpu/drm/nouveau/nouveau_ioc32.o
   CC      drivers/gpu/drm/nouveau/nouveau_led.o
   CC      drivers/gpu/drm/nouveau/nouveau_nvif.o
   CC      drivers/gpu/drm/nouveau/nouveau_usif.o
   CC      drivers/gpu/drm/nouveau/nouveau_vga.o
   CC      drivers/gpu/drm/nouveau/nouveau_bo.o
   CC      drivers/gpu/drm/nouveau/nouveau_gem.o
   CC      drivers/gpu/drm/nouveau/nouveau_mem.o
   CC      drivers/gpu/drm/nouveau/nouveau_prime.o
   CC      drivers/gpu/drm/nouveau/nouveau_sgdma.o
   CC      drivers/gpu/drm/nouveau/nouveau_ttm.o
   CC      drivers/gpu/drm/nouveau/nouveau_vmm.o
   CC      drivers/gpu/drm/nouveau/nouveau_display.o
   CC      drivers/gpu/drm/nouveau/nouveau_backlight.o
   CC      drivers/gpu/drm/nouveau/nouveau_bios.o
   CC      drivers/gpu/drm/nouveau/nouveau_connector.o
   CC      drivers/gpu/drm/nouveau/nv04_fbcon.o
   CC      drivers/gpu/drm/nouveau/nv50_fbcon.o
   CC      drivers/gpu/drm/nouveau/nvc0_fbcon.o
   CC      drivers/gpu/drm/nouveau/nouveau_dp.o
   CC      drivers/gpu/drm/nouveau/nouveau_fbcon.o
   CC      drivers/gpu/drm/nouveau/dispnv04/arb.o
   CC      drivers/gpu/drm/nouveau/dispnv04/cursor.o
   CC      drivers/gpu/drm/nouveau/dispnv04/crtc.o
   CC      drivers/gpu/drm/nouveau/dispnv04/dfp.o
   CC      drivers/gpu/drm/nouveau/dispnv04/dac.o
   CC      drivers/gpu/drm/nouveau/dispnv04/hw.o
   CC      drivers/gpu/drm/nouveau/dispnv04/overlay.o
   CC      drivers/gpu/drm/nouveau/dispnv04/tvnv17.o
   CC      drivers/gpu/drm/nouveau/dispnv04/tvmodesnv17.o
   CC      drivers/gpu/drm/nouveau/dispnv04/tvnv04.o
   CC      drivers/gpu/drm/nouveau/dispnv50/core.o
   CC      drivers/gpu/drm/nouveau/dispnv50/lut.o
   CC      drivers/gpu/drm/nouveau/dispnv04/disp.o
   CC      drivers/gpu/drm/nouveau/dispnv50/disp.o
   CC      drivers/gpu/drm/nouveau/dispnv50/core507d.o
   AR      drivers/scsi/built-in.a
   CC      drivers/gpu/drm/nouveau/dispnv50/core827d.o
   CC      drivers/gpu/drm/nouveau/dispnv50/core907d.o
   CC      drivers/gpu/drm/nouveau/dispnv50/core917d.o
   CC      drivers/gpu/drm/nouveau/dispnv50/corec37d.o
   CC      drivers/gpu/drm/nouveau/dispnv50/corec57d.o
   CC      drivers/gpu/drm/nouveau/dispnv50/dac507d.o
   CC      drivers/gpu/drm/nouveau/dispnv50/dac907d.o
   CC      drivers/gpu/drm/nouveau/dispnv50/pior507d.o
   CC      drivers/gpu/drm/nouveau/dispnv50/sor507d.o
   CC      drivers/gpu/drm/nouveau/dispnv50/head507d.o
   CC      drivers/gpu/drm/nouveau/dispnv50/head.o
   CC      drivers/gpu/drm/nouveau/dispnv50/sorc37d.o
   CC      drivers/gpu/drm/nouveau/dispnv50/sor907d.o
   CC      drivers/gpu/drm/nouveau/dispnv50/head827d.o
   CC      drivers/gpu/drm/nouveau/dispnv50/head917d.o
   CC      drivers/gpu/drm/nouveau/dispnv50/head907d.o
   CC      drivers/gpu/drm/nouveau/dispnv50/headc37d.o
   CC      drivers/gpu/drm/nouveau/dispnv50/wimm.o
   CC      drivers/gpu/drm/nouveau/dispnv50/headc57d.o
   CC      drivers/gpu/drm/nouveau/dispnv50/wimmc37b.o
   CC      drivers/gpu/drm/nouveau/dispnv50/wndwc37e.o
   CC      drivers/gpu/drm/nouveau/dispnv50/wndw.o
   CC      drivers/gpu/drm/nouveau/dispnv50/base.o
   CC      drivers/gpu/drm/nouveau/dispnv50/wndwc57e.o
   CC      drivers/gpu/drm/nouveau/dispnv50/base507c.o
   CC      drivers/gpu/drm/nouveau/dispnv50/base827c.o
   CC      drivers/gpu/drm/nouveau/dispnv50/base907c.o
   CC      drivers/gpu/drm/nouveau/dispnv50/base917c.o
   CC      drivers/gpu/drm/nouveau/dispnv50/curs.o
   CC      drivers/gpu/drm/nouveau/dispnv50/curs507a.o
   CC      drivers/gpu/drm/nouveau/dispnv50/curs907a.o
   CC      drivers/gpu/drm/nouveau/dispnv50/cursc37a.o
   CC      drivers/gpu/drm/nouveau/dispnv50/oimm.o
   CC      drivers/gpu/drm/nouveau/dispnv50/oimm507b.o
   CC      drivers/gpu/drm/nouveau/dispnv50/ovly.o
   CC      drivers/gpu/drm/nouveau/dispnv50/ovly507e.o
   CC      drivers/gpu/drm/nouveau/dispnv50/ovly827e.o
   CC      drivers/gpu/drm/nouveau/dispnv50/ovly907e.o
   CC      drivers/gpu/drm/nouveau/dispnv50/ovly917e.o
   CC      drivers/gpu/drm/nouveau/nouveau_abi16.o
   CC      drivers/gpu/drm/nouveau/nouveau_dma.o
   CC      drivers/gpu/drm/nouveau/nouveau_chan.o
   CC      drivers/gpu/drm/nouveau/nouveau_fence.o
   CC      drivers/gpu/drm/nouveau/nv04_fence.o
   CC      drivers/gpu/drm/nouveau/nv10_fence.o
   CC      drivers/gpu/drm/nouveau/nv17_fence.o
   CC      drivers/gpu/drm/nouveau/nv50_fence.o
   CC      drivers/gpu/drm/nouveau/nv84_fence.o
   CC      drivers/gpu/drm/nouveau/nvc0_fence.o
   AR      drivers/gpu/drm/nouveau/built-in.a
   AR      drivers/gpu/drm/built-in.a
   AR      drivers/gpu/built-in.a
Makefile:1051: recipe for target 'drivers' failed
make: *** [drivers] Error 2


Error text is too large and was truncated, full error text is at:
https://syzkaller.appspot.com/x/error.txt?x=17a6b2f8a00000


Tested on:

commit:         43151d6c usb-fuzzer: main usb gadget fuzzer driver
git tree:       https://github.com/google/kasan.git usb-fuzzer
compiler:       gcc (GCC) 9.0.0 20181231 (experimental)
patch:          https://syzkaller.appspot.com/x/patch.diff?x=173a6c54a00000


^ permalink raw reply

* Re: KASAN: use-after-free Read in p54u_load_firmware_cb
From: Alan Stern @ 2019-05-17 20:46 UTC (permalink / raw)
  To: Christian Lamparter
  Cc: Oliver Neukum, syzbot, kvalo, davem, andreyknvl, syzkaller-bugs,
	chunkeey, linux-kernel, linux-usb, linux-wireless, netdev,
	Michael Wu
In-Reply-To: <5014675.0cgHOJIxtM@debian64>

On Fri, 17 May 2019, Christian Lamparter wrote:

> On Monday, May 13, 2019 3:28:30 PM CEST Oliver Neukum wrote:
> > On Mo, 2019-05-13 at 03:23 -0700, syzbot wrote:
> > > syzbot has found a reproducer for the following crash on:
> > > 
> > > HEAD commit:    43151d6c usb-fuzzer: main usb gadget fuzzer driver
> > > git tree:       https://github.com/google/kasan.git usb-fuzzer
> > > console output: https://syzkaller.appspot.com/x/log.txt?x=16b64110a00000
> > > kernel config:  https://syzkaller.appspot.com/x/.config?x=4183eeef650d1234
> > > dashboard link: https://syzkaller.appspot.com/bug?extid=200d4bb11b23d929335f
> > > compiler:       gcc (GCC) 9.0.0 20181231 (experimental)
> > > syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=1634c900a00000
> > > 
> > > IMPORTANT: if you fix the bug, please add the following tag to the commit:
> > > Reported-by: syzbot+200d4bb11b23d929335f@syzkaller.appspotmail.com
> > > 
> > > usb 1-1: config 0 descriptor??
> > > usb 1-1: reset high-speed USB device number 2 using dummy_hcd
> > > usb 1-1: device descriptor read/64, error -71
> > > usb 1-1: Using ep0 maxpacket: 8
> > > usb 1-1: Loading firmware file isl3887usb
> > > usb 1-1: Direct firmware load for isl3887usb failed with error -2
> > > usb 1-1: Firmware not found.
> > > ==================================================================
> > > BUG: KASAN: use-after-free in p54u_load_firmware_cb.cold+0x97/0x13a  
> > > drivers/net/wireless/intersil/p54/p54usb.c:936
> > > Read of size 8 at addr ffff88809803f588 by task kworker/1:0/17
> > 
> > Hi,
> > 
> > it looks to me as if refcounting is broken.
> > You should have a usb_put_dev() in p54u_load_firmware_cb() or in
> > p54u_disconnect(), but not both.
> 
> There's more to that refcounting that meets the eye. Do you see that
> request_firmware_nowait() in the driver? That's the async firmware
> request call that get's completed by the p54u_load_firmware_cb()
> So what's happening here is that the driver has to be protected
> against rmmod when the driver is waiting for request_firmware_nowait
> to "finally" callback, which depending on the system can be up to 
> 60 seconds.
> 
> Now, what seems to be odd is that it's at line 936
> > > BUG: KASAN: use-after-free in p54u_load_firmware_cb.cold+0x97/0x13a  
> > > drivers/net/wireless/intersil/p54/p54usb.c:936
> 
> because if you put it in context:
> 
> |
> |static void p54u_load_firmware_cb(const struct firmware *firmware,
> |				  void *context)
> |{
> |	struct p54u_priv *priv = context;
> |	struct usb_device *udev = priv->udev;
> |	int err;
> |
> |	complete(&priv->fw_wait_load);
> |	if (firmware) {
> |		priv->fw = firmware;
> |		err = p54u_start_ops(priv);
> |	} else {
> |		err = -ENOENT;
> |		dev_err(&udev->dev, "Firmware not found.\n");
> |	}
> |
> |	if (err) {
> |>>	>>	struct device *parent = priv->udev->dev.parent; <<<<-- 936 is here
> |
> |		dev_err(&udev->dev, "failed to initialize device (%d)\n", err);
> |
> |		if (parent)
> |			device_lock(parent);
> |
> |		device_release_driver(&udev->dev);
> |		/*
> |		 * At this point p54u_disconnect has already freed
> |		 * the "priv" context. Do not use it anymore!
> |		 */
> |		priv = NULL;
> |
> |		if (parent)
> |			device_unlock(parent);
> |	}
> |
> |	usb_put_dev(udev);
> |}
> 
> it seems very out of place, because at that line the device is still bound to
> the driver! Only with device_release_driver in line 942, I could see that
> something woulb be aray... !BUT! that's why we do have the extra
> usb_get_dev(udev) in p54u_load_firmware() so we can do the usb_put_dev(udev) in
> line 953 to ensure that nothing (like the rmmod I talked above) will interfere
> until everything is done.
> 
> I've no idea what's wrong here, is gcc 9.0 aggressivly reording the put? Or is
> something else going on with the sanitizers? Because this report does look
> dogdy there!
> 
> (Note: p54usb has !strategic! dev_err/infos in place right around the
> usb_get_dev/usb_put_dev so we can sort of tell the refvalue of the udev
> and it all seems to be correct from what I can gleam) 

I agree; it doesn't seem to make sense.  The nice thing about syzbot, 
though, is you can ask it to run a debugging test for you.  Let's start 
by making sure that the faulty address really is &udev->dev.parent.

Alan


#syz test: https://github.com/google/kasan.git usb-fuzzer

 drivers/net/wireless/intersil/p54/p54usb.c |    3 +++
 1 file changed, 3 insertions(+)

Index: usb-devel/drivers/net/wireless/intersil/p54/p54usb.c
===================================================================
--- usb-devel.orig/drivers/net/wireless/intersil/p54/p54usb.c
+++ usb-devel/drivers/net/wireless/intersil/p54/p54usb.c
@@ -923,6 +923,7 @@ static void p54u_load_firmware_cb(const
 	struct usb_device *udev = priv->udev;
 	int err;
 
+	pr_info("%s: priv->udev = %px\n", __func__, udev);
 	complete(&priv->fw_wait_load);
 	if (firmware) {
 		priv->fw = firmware;
@@ -969,6 +970,8 @@ static int p54u_load_firmware(struct iee
 	if (i < 0)
 		return i;
 
+	dev_info(udev, "%s: udev @ %px, dev.parent @ %px\n",
+			__func__, udev, &udev->dev.parent);
 	dev_info(&priv->udev->dev, "Loading firmware file %s\n",
 	       p54u_fwlist[i].fw);
 


^ permalink raw reply

* [PATCH 2/7] iw: fix endless loop inside handle_mgmt_dump
From: John Crispin @ 2019-05-17 19:29 UTC (permalink / raw)
  To: Johannes Berg; +Cc: linux-wireless, John Crispin
In-Reply-To: <20190517192956.18372-1-john@phrozen.org>

passing -1 will break the while loop further down in the code.

Signed-off-by: John Crispin <john@phrozen.org>
---
 mgmt.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/mgmt.c b/mgmt.c
index 88fe3fd..338435d 100644
--- a/mgmt.c
+++ b/mgmt.c
@@ -109,6 +109,8 @@ static int handle_mgmt_dump(struct nl80211_state *state,
 	for (i = 3; i < argc; i += 3) {
 		if (strcmp(argv[i], "count") == 0) {
 			count = 1 + atoi(argv[i + 1]);
+			if (count < 1)
+				count = 1;
 			break;
 		}
 
-- 
2.20.1


^ permalink raw reply related

* [PATCH 3/7] iw: fix memory leak inside handle_cac
From: John Crispin @ 2019-05-17 19:29 UTC (permalink / raw)
  To: Johannes Berg; +Cc: linux-wireless, John Crispin
In-Reply-To: <20190517192956.18372-1-john@phrozen.org>

Signed-off-by: John Crispin <john@phrozen.org>
---
 phy.c | 20 ++++++++++++++------
 1 file changed, 14 insertions(+), 6 deletions(-)

diff --git a/phy.c b/phy.c
index 77df7a7..a4425ea 100644
--- a/phy.c
+++ b/phy.c
@@ -328,12 +328,15 @@ static int handle_cac(struct nl80211_state *state,
 	} else if (strcmp(argv[2], "freq") == 0) {
 		err = parse_freqchan(&chandef, false, argc - 3, argv + 3, NULL);
 	} else {
-		return 1;
+		err = 1;
+		goto err_out;
 	}
 
 	cac_trigger_argv = calloc(argc + 1, sizeof(char*));
-	if (!cac_trigger_argv)
-		return -ENOMEM;
+	if (!cac_trigger_argv) {
+		err = -ENOMEM;
+		goto err_out;
+	}
 
 	cac_trigger_argv[0] = argv[0];
 	cac_trigger_argv[1] = "cac";
@@ -341,9 +344,8 @@ static int handle_cac(struct nl80211_state *state,
 	memcpy(&cac_trigger_argv[3], &argv[2], (argc - 2) * sizeof(char*));
 
 	err = handle_cmd(state, id, argc + 1, cac_trigger_argv);
-	free(cac_trigger_argv);
 	if (err)
-		return err;
+		goto err_out;
 
 	cac_event.ret = 1;
 	cac_event.freq = chandef.control_freq;
@@ -357,7 +359,13 @@ static int handle_cac(struct nl80211_state *state,
 	while (cac_event.ret > 0)
 		nl_recvmsgs(state->nl_sock, radar_cb);
 
-	return 0;
+	err = 0;
+err_out:
+	if (radar_cb)
+		nl_cb_put(radar_cb);
+	if (cac_trigger_argv)
+		free(cac_trigger_argv);
+	return err;
 }
 TOPLEVEL(cac, "channel <channel> [NOHT|HT20|HT40+|HT40-|5MHz|10MHz|80MHz]\n"
 	      "freq <freq> [NOHT|HT20|HT40+|HT40-|5MHz|10MHz|80MHz]\n"
-- 
2.20.1


^ permalink raw reply related

* [PATCH 5/7] iw: fix memory leak inside parse_sched_scan
From: John Crispin @ 2019-05-17 19:29 UTC (permalink / raw)
  To: Johannes Berg; +Cc: linux-wireless, John Crispin
In-Reply-To: <20190517192956.18372-1-john@phrozen.org>

Signed-off-by: John Crispin <john@phrozen.org>
---
 scan.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/scan.c b/scan.c
index b0b7828..980bfb4 100644
--- a/scan.c
+++ b/scan.c
@@ -355,11 +355,12 @@ int parse_sched_scan(struct nl_msg *msg, int *argc, char ***argv)
 nla_put_failure:
 	if (match)
 		nla_nest_end(msg, match);
+out:
 	nlmsg_free(freqs);
 	nlmsg_free(matchset);
 	nlmsg_free(scan_plans);
+	nlmsg_free(ssids);
 
-out:
 	*argc = c;
 	*argv = v;
 	return err;
-- 
2.20.1


^ permalink raw reply related

* [PATCH 0/7] iw: various bug fixes
From: John Crispin @ 2019-05-17 19:29 UTC (permalink / raw)
  To: Johannes Berg; +Cc: linux-wireless, John Crispin

These fixes were extracted from the latest Intel/UGW. I am assuming they
ran static code analyses/Klocwork in the source.

John Crispin (7):
  iw: fix memory leak inside register_mgmt_frame
  iw: fix endless loop inside handle_mgmt_dump
  iw: fix memory leak inside handle_cac
  iw: fix fd leak inside handle_netns
  iw: fix memory leak inside parse_sched_scan
  iw: fix memory leaks inside handle_scan
  iw: fix fp handling inside handle_vendor

 mgmt.c   |  4 ++++
 phy.c    | 25 ++++++++++++++++++-------
 scan.c   | 34 +++++++++++++++++-----------------
 vendor.c |  5 ++++-
 4 files changed, 43 insertions(+), 25 deletions(-)

-- 
2.20.1


^ permalink raw reply

* [PATCH 1/7] iw: fix memory leak inside register_mgmt_frame
From: John Crispin @ 2019-05-17 19:29 UTC (permalink / raw)
  To: Johannes Berg; +Cc: linux-wireless, John Crispin
In-Reply-To: <20190517192956.18372-1-john@phrozen.org>

Signed-off-by: John Crispin <john@phrozen.org>
---
 mgmt.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/mgmt.c b/mgmt.c
index 60f544b..88fe3fd 100644
--- a/mgmt.c
+++ b/mgmt.c
@@ -69,9 +69,11 @@ static int register_mgmt_frame(struct nl80211_state *state,
 	NLA_PUT_U16(msg, NL80211_ATTR_FRAME_TYPE, type);
 	NLA_PUT(msg, NL80211_ATTR_FRAME_MATCH, match_len, match);
 
+	free(match);
 	return 0;
 
 nla_put_failure:
+	free(match);
 	return -ENOBUFS;
 }
 
-- 
2.20.1


^ permalink raw reply related

page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox