From: Dan Carpenter <dan.carpenter@oracle.com>
To: Justin Capella <justincapella@gmail.com>
Cc: Johannes Berg <johannes@sipsolutions.net>,
syzbot <syzbot+34b582cf32c1db008f8e@syzkaller.appspotmail.com>,
"David S. Miller" <davem@davemloft.net>,
LKML <linux-kernel@vger.kernel.org>,
linux-wireless@vger.kernel.org, netdev@vger.kernel.org,
syzkaller-bugs@googlegroups.com,
Cody Schuffelen <schuffelen@google.com>
Subject: Re: BUG: unable to handle kernel NULL pointer dereference in cfg80211_wext_siwrts
Date: Mon, 13 Jan 2020 12:28:20 +0300 [thread overview]
Message-ID: <20200113092820.GB9510@kadam> (raw)
In-Reply-To: <CAMrEMU_a9evtp26tYB6VUxznmSmH98AmpP8xnejQr5bGTgE+8g@mail.gmail.com>
That's the wrong ops struct? I think I was looking at the "previous
report" that Johannes mentioned where it was crashing because
virt_wifi doesn't implement a set_wiphy_params function.
Smatch says there are two other drivers, the libertas and ipw2x00 which
don't have a set_wiphy_params function either. But maybe those handle
it a different way.
drivers/net/wireless/marvell/libertas/cfg.c | (null) | (struct cfg80211_ops)->set_wiphy_params | 0
drivers/net/wireless/virt_wifi.c | (null) | (struct cfg80211_ops)->set_wiphy_params | 0
drivers/net/wireless/intel/ipw2x00/libipw_module.c | (null) | (struct cfg80211_ops)->set_wiphy_params | 0
regards,
dan carpenter
On Fri, Jan 10, 2020 at 09:23:57PM -0800, Justin Capella wrote:
> I noticed pfifo_qdisc_ops is exported as default_qdisc_ops is it
> possible this is how rdev->ops is NULL
>
> Seems unlikely, but thought I'd point it out.
>
>
> On Fri, Jan 10, 2020 at 11:13 AM Johannes Berg
> <johannes@sipsolutions.net> wrote:
> >
> > On Fri, 2020-01-10 at 11:11 -0800, syzbot wrote:
> > > Hello,
> > >
> > > syzbot found the following crash on:
> > >
> > > HEAD commit: 2f806c2a Merge branch 'net-ungraft-prio'
> > > git tree: net
> > > console output: https://syzkaller.appspot.com/x/log.txt?x=1032069ee00000
> > > kernel config: https://syzkaller.appspot.com/x/.config?x=5c90cac8f1f8c619
> > > dashboard link: https://syzkaller.appspot.com/bug?extid=34b582cf32c1db008f8e
> > > compiler: gcc (GCC) 9.0.0 20181231 (experimental)
> > >
> > > Unfortunately, I don't have any reproducer for this crash yet.
> >
> > It's quite likely also in virt_wifi, evidently that has some issues.
> >
> > Cody, did you take a look at the previous report by any chance?
> >
> > johannes
> >
>
> --
> You received this message because you are subscribed to the Google Groups "syzkaller-bugs" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to syzkaller-bugs+unsubscribe@googlegroups.com.
> To view this discussion on the web visit https://groups.google.com/d/msgid/syzkaller-bugs/CAMrEMU_a9evtp26tYB6VUxznmSmH98AmpP8xnejQr5bGTgE%2B8g%40mail.gmail.com.
next prev parent reply other threads:[~2020-01-13 9:29 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-01-10 19:11 BUG: unable to handle kernel NULL pointer dereference in cfg80211_wext_siwrts syzbot
2020-01-10 19:12 ` Johannes Berg
2020-01-11 5:23 ` Justin Capella
2020-01-13 9:28 ` Dan Carpenter [this message]
2020-01-13 9:31 ` Johannes Berg
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200113092820.GB9510@kadam \
--to=dan.carpenter@oracle.com \
--cc=davem@davemloft.net \
--cc=johannes@sipsolutions.net \
--cc=justincapella@gmail.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-wireless@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=schuffelen@google.com \
--cc=syzbot+34b582cf32c1db008f8e@syzkaller.appspotmail.com \
--cc=syzkaller-bugs@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).