From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 51E43C7618E for ; Mon, 24 Apr 2023 19:12:18 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232585AbjDXTMQ (ORCPT ); Mon, 24 Apr 2023 15:12:16 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:59682 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S232530AbjDXTMI (ORCPT ); Mon, 24 Apr 2023 15:12:08 -0400 Received: from mail.ispras.ru (mail.ispras.ru [83.149.199.84]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 4DA25E5D; Mon, 24 Apr 2023 12:12:05 -0700 (PDT) Received: from fpc (unknown [46.242.14.200]) by mail.ispras.ru (Postfix) with ESMTPSA id 3981940755C6; Mon, 24 Apr 2023 19:12:03 +0000 (UTC) DKIM-Filter: OpenDKIM Filter v2.11.0 mail.ispras.ru 3981940755C6 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ispras.ru; s=default; t=1682363523; bh=mS4Y7rIFdUwUfVv7Jse8uehF8rfPCZBGekclWUdo4Vo=; h=Date:From:To:Cc:Subject:References:In-Reply-To:From; b=q9hl9BgwcJJoJgecJZ0W+IMwIrUWLGdHaIe02B0CvfgexxSQGiJwdLkycD09eDJI8 jr+BkclsHR6JYN3x0LuD3NOEAY9LW4Soi/rvMnXIrYSCE+5OCwu0rZLTNiD08qThtp ayXgmBgz8Y5FOr+XLt/lqz8/qOeQaSxtzEMeIc70= Date: Mon, 24 Apr 2023 22:11:58 +0300 From: Fedor Pchelkin To: Toke =?utf-8?Q?H=C3=B8iland-J=C3=B8rgensen?= , Kalle Valo Cc: Kalle Valo , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Senthil Balasubramanian , "John W. Linville" , Vasanthakumar Thiagarajan , Sujith , linux-wireless@vger.kernel.org, netdev@vger.kernel.org, linux-kernel@vger.kernel.org, Alexey Khoroshilov , lvc-project@linuxtesting.org, syzbot+df61b36319e045c00a08@syzkaller.appspotmail.com Subject: Re: [PATCH 2/3] wifi: ath9k: fix races between ath9k_wmi_cmd and ath9k_wmi_ctrl_rx Message-ID: <20230424191158.iebfqubeanurdabk@fpc> References: <20230315202112.163012-1-pchelkin@ispras.ru> <20230315202112.163012-3-pchelkin@ispras.ru> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20230315202112.163012-3-pchelkin@ispras.ru> Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org This problem is realy subtle, I suppose. In the v2 commit info, which I'll send in the next mail, the race condition is described which can lead to invalid behaviour. Couldn't reproduce that particular problem on real hardware, but if force timeouts to wmi cmd completions, local KMSan catches some uninit values. The synchronization between ath9k_wmi_cmd and ath9k_wmi_ctrl_rx on timeouts is good, especially after 8a2f35b98306 ("wifi: ath9k: Fix potential stack-out-of-bounds write in ath9k_wmi_rsp_callback()"). And I think the only place where the fuzzer can provoke failure is when wmi->last_seq_id in callback is checked before it is assigned zero inside ath9k_wmi_cmd() during timeout exit. This scenario is more thoroughly described in patch v2. Well, the issue seems to be rare and I don't know how to properly test it on real hardware. I've made some checks on a basic driver workflow, and there weren't any stalls or explicit failures, and the patch seems to close that tiny race condition window. But, anyway, it requires more discussion.