* [syzbot] divide error in mac80211_hwsim_bss_info_changed @ 2021-05-17 10:45 syzbot 2021-05-17 13:16 ` Johannes Berg 0 siblings, 1 reply; 2+ messages in thread From: syzbot @ 2021-05-17 10:45 UTC (permalink / raw) To: davem, johannes, kuba, kvalo, linux-kernel, linux-wireless, netdev, syzkaller-bugs Hello, syzbot found the following issue on: HEAD commit: eebe426d Merge tag 'fixes-for-5.12-rc7' of git://git.kerne.. git tree: upstream console output: https://syzkaller.appspot.com/x/log.txt?x=15e73ceed00000 kernel config: https://syzkaller.appspot.com/x/.config?x=9c3d8981d2bdb103 dashboard link: https://syzkaller.appspot.com/bug?extid=26727b5e00947e02242c compiler: Debian clang version 11.0.1-2 Unfortunately, I don't have any reproducer for this issue yet. IMPORTANT: if you fix the issue, please add the following tag to the commit: Reported-by: syzbot+26727b5e00947e02242c@syzkaller.appspotmail.com divide error: 0000 [#1] PREEMPT SMP KASAN CPU: 1 PID: 13049 Comm: kworker/u4:16 Not tainted 5.12.0-rc7-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: phy10 ieee80211_roc_work RIP: 0010:mac80211_hwsim_bss_info_changed+0x514/0xf90 drivers/net/wireless/mac80211_hwsim.c:2024 Code: 48 b8 00 00 00 00 00 fc ff df 80 7c 05 00 00 74 0a 48 8b 7c 24 08 e8 9b a6 68 fc 48 8b 44 24 08 48 8b 08 89 ce 48 89 d8 31 d2 <48> f7 f6 29 d1 48 69 f1 e8 03 00 00 48 8b 7c 24 10 31 d2 b9 05 00 RSP: 0018:ffffc900023bfb88 EFLAGS: 00010246 RAX: 0005bfe4b761f015 RBX: 0005bfe4b761f015 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000040 RBP: 1ffff11004556dcf R08: ffffffff81698b49 R09: fffffbfff1f272bd R10: fffffbfff1f272bd R11: 0000000000000000 R12: ffff888022ab0d50 R13: 0000000000000200 R14: ffff888022ab6fd8 R15: 1ffff110045561aa FS: 0000000000000000(0000) GS:ffff8880b9d00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000543038 CR3: 000000007746b000 CR4: 00000000001506e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: drv_bss_info_changed net/mac80211/driver-ops.h:177 [inline] ieee80211_bss_info_change_notify+0x27c/0x3a0 net/mac80211/main.c:210 ieee80211_offchannel_return+0x33b/0x470 net/mac80211/offchannel.c:158 __ieee80211_roc_work+0x282/0x340 net/mac80211/offchannel.c:444 ieee80211_roc_work+0x2b/0x40 net/mac80211/offchannel.c:458 process_one_work+0x789/0xfd0 kernel/workqueue.c:2275 worker_thread+0xac1/0x1300 kernel/workqueue.c:2421 kthread+0x39a/0x3c0 kernel/kthread.c:292 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:294 Modules linked in: ---[ end trace 2380ddc5fa748069 ]--- RIP: 0010:mac80211_hwsim_bss_info_changed+0x514/0xf90 drivers/net/wireless/mac80211_hwsim.c:2024 Code: 48 b8 00 00 00 00 00 fc ff df 80 7c 05 00 00 74 0a 48 8b 7c 24 08 e8 9b a6 68 fc 48 8b 44 24 08 48 8b 08 89 ce 48 89 d8 31 d2 <48> f7 f6 29 d1 48 69 f1 e8 03 00 00 48 8b 7c 24 10 31 d2 b9 05 00 RSP: 0018:ffffc900023bfb88 EFLAGS: 00010246 RAX: 0005bfe4b761f015 RBX: 0005bfe4b761f015 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000040 RBP: 1ffff11004556dcf R08: ffffffff81698b49 R09: fffffbfff1f272bd R10: fffffbfff1f272bd R11: 0000000000000000 R12: ffff888022ab0d50 R13: 0000000000000200 R14: ffff888022ab6fd8 R15: 1ffff110045561aa FS: 0000000000000000(0000) GS:ffff8880b9c00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000000219a708 CR3: 000000007746b000 CR4: 00000000001506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 --- This report is generated by a bot. It may contain errors. See https://goo.gl/tpsmEJ for more information about syzbot. syzbot engineers can be reached at syzkaller@googlegroups.com. syzbot will keep track of this issue. See: https://goo.gl/tpsmEJ#status for how to communicate with syzbot. ^ permalink raw reply [flat|nested] 2+ messages in thread
* Re: [syzbot] divide error in mac80211_hwsim_bss_info_changed 2021-05-17 10:45 [syzbot] divide error in mac80211_hwsim_bss_info_changed syzbot @ 2021-05-17 13:16 ` Johannes Berg 0 siblings, 0 replies; 2+ messages in thread From: Johannes Berg @ 2021-05-17 13:16 UTC (permalink / raw) To: syzbot, davem, kuba, kvalo, linux-kernel, linux-wireless, netdev, syzkaller-bugs On Mon, 2021-05-17 at 03:45 -0700, syzbot wrote: > Hello, > > syzbot found the following issue on: > > HEAD commit: eebe426d Merge tag 'fixes-for-5.12-rc7' of git://git.kerne.. > git tree: upstream > console output: https://syzkaller.appspot.com/x/log.txt?x=15e73ceed00000 > kernel config: https://syzkaller.appspot.com/x/.config?x=9c3d8981d2bdb103 > dashboard link: https://syzkaller.appspot.com/bug?extid=26727b5e00947e02242c > compiler: Debian clang version 11.0.1-2 > > Unfortunately, I don't have any reproducer for this issue yet. > That's not very surprising ... > IMPORTANT: if you fix the issue, please add the following tag to the commit: > Reported-by: syzbot+26727b5e00947e02242c@syzkaller.appspotmail.com > > divide error: 0000 [#1] PREEMPT SMP KASAN > CPU: 1 PID: 13049 Comm: kworker/u4:16 Not tainted 5.12.0-rc7-syzkaller #0 > Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 > Workqueue: phy10 ieee80211_roc_work > RIP: 0010:mac80211_hwsim_bss_info_changed+0x514/0xf90 drivers/net/wireless/mac80211_hwsim.c:2024 The issue here is that we have the following code in offchannel.c: mutex_lock(&local->iflist_mtx); list_for_each_entry(sdata, &local->interfaces, list) { ... if (test_and_clear_bit(SDATA_STATE_OFFCHANNEL_BEACON_STOPPED, &sdata->state)) { sdata->vif.bss_conf.enable_beacon = true; ieee80211_bss_info_change_notify( sdata, BSS_CHANGED_BEACON_ENABLED); } However, we have the following code in ibss.c ieee80211_ibss_disconnect(): sdata->vif.bss_conf.ibss_joined = false; sdata->vif.bss_conf.ibss_creator = false; sdata->vif.bss_conf.enable_beacon = false; sdata->vif.bss_conf.ssid_len = 0; /* remove beacon */ presp = rcu_dereference_protected(ifibss->presp, lockdep_is_held(&sdata->wdev.mtx)); RCU_INIT_POINTER(sdata->u.ibss.presp, NULL); if (presp) kfree_rcu(presp, rcu_head); clear_bit(SDATA_STATE_OFFCHANNEL_BEACON_STOPPED, &sdata->state); ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BEACON_ENABLED | BSS_CHANGED_IBSS); There's no common locking here, so it's simply racy. Normally, all of the ieee80211_ibss_disconnect() happens together, but if ieee80211_offchannel_return() happens to hit here before SDATA_STATE_OFFCHANNEL_BEACON_STOPPED is cleared, we might inadvertently enable beaconing while the interface is actually stopping. I'm not really sure what happens next, but perhaps the interface is going down and the beacon_int is reset to 0, or such, leading to the problem at hand. Off the top of my head, I don't really have a good idea about how to fix this - we'd want to add some more consistent locking everywhere. I assume that with the rtnl-weaning having happened, that might simply consist in aligning mac80211 to the cfg80211 wiphy mutex everywhere. johannes ^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2021-05-17 13:16 UTC | newest] Thread overview: 2+ messages (download: mbox.gz follow: Atom feed -- links below jump to the message on this page -- 2021-05-17 10:45 [syzbot] divide error in mac80211_hwsim_bss_info_changed syzbot 2021-05-17 13:16 ` Johannes Berg
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for NNTP newsgroup(s).