[PATCH] cfg80211: Convert WARN_ON() to warning message

[PATCH] cfg80211: Convert WARN_ON() to warning message

[Vladislav Efanov]

syzkaller got the following warning:
------------[ cut here ]------------
WARNING: CPU: 0 PID: 9992 at net/wireless/ibss.c:36 __cfg80211_ibss

This warning is the result of the race condition between the following
events:

event1                          event2                      event3
__ieee80211_sta_join_ibss()        |                          |
creates new cgf80211_bss           |                          |
structure.                         |                          |
Calls cfg80211_ibss_joined()       |                          |
which will scheduled               |                          |
new event_work.                    |                          |
                         ieee80211_ibss_disconnect()          |
                         is called due to connection          |
                         dropped/ibss leaves to               |
                         remove cfg80211_bss structure.       |
                                                event_work starts.
                                          __cfg80211_ibss_joined()
                                          is called and WARNING is
                                          detected due to
                                          cfg80211_bss structure was
                                          removed by event2.

It is a normal situation when connection is dropped during handshaking.
So it looks reasonable to replace WARN_ON() with warning message to
prevent false alarm.

Found by Linux Verification Center (linuxtesting.org) with syzkaller.
Fixes: 04a773ade068 ("cfg80211/nl80211: add IBSS API")
Signed-off-by: Vladislav Efanov <VEfanov@ispras.ru>
---
 net/wireless/ibss.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/net/wireless/ibss.c b/net/wireless/ibss.c
index e6fdb0b8187d..93c8bee12bdf 100644
--- a/net/wireless/ibss.c
+++ b/net/wireless/ibss.c
@@ -34,8 +34,10 @@ void __cfg80211_ibss_joined(struct net_device *dev, const u8 *bssid,
 	bss = cfg80211_get_bss(wdev->wiphy, channel, bssid, NULL, 0,
 			       IEEE80211_BSS_TYPE_IBSS, IEEE80211_PRIVACY_ANY);
 
-	if (WARN_ON(!bss))
+	if (!bss) {
+		pr_warn("cfg80211: cfg80211_bss with bssid %s not found.\n", bssid);
 		return;
+	}
 
 	if (wdev->u.ibss.current_bss) {
 		cfg80211_unhold_bss(wdev->u.ibss.current_bss);
-- 
2.34.1

Re: [PATCH] cfg80211: Convert WARN_ON() to warning message

[Kalle Valo]

Vladislav Efanov <VEfanov@ispras.ru> writes:

> syzkaller got the following warning:
> ------------[ cut here ]------------
> WARNING: CPU: 0 PID: 9992 at net/wireless/ibss.c:36 __cfg80211_ibss
>
> This warning is the result of the race condition between the following
> events:
>
> event1                          event2                      event3
> __ieee80211_sta_join_ibss()        |                          |
> creates new cgf80211_bss           |                          |
> structure.                         |                          |
> Calls cfg80211_ibss_joined()       |                          |
> which will scheduled               |                          |
> new event_work.                    |                          |
>                          ieee80211_ibss_disconnect()          |
>                          is called due to connection          |
>                          dropped/ibss leaves to               |
>                          remove cfg80211_bss structure.       |
>                                                 event_work starts.
>                                           __cfg80211_ibss_joined()
>                                           is called and WARNING is
>                                           detected due to
>                                           cfg80211_bss structure was
>                                           removed by event2.
>
> It is a normal situation when connection is dropped during handshaking.
> So it looks reasonable to replace WARN_ON() with warning message to
> prevent false alarm.
>
> Found by Linux Verification Center (linuxtesting.org) with syzkaller.
> Fixes: 04a773ade068 ("cfg80211/nl80211: add IBSS API")
> Signed-off-by: Vladislav Efanov <VEfanov@ispras.ru>
> ---
>  net/wireless/ibss.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
>
> diff --git a/net/wireless/ibss.c b/net/wireless/ibss.c
> index e6fdb0b8187d..93c8bee12bdf 100644
> --- a/net/wireless/ibss.c
> +++ b/net/wireless/ibss.c
> @@ -34,8 +34,10 @@ void __cfg80211_ibss_joined(struct net_device *dev, const u8 *bssid,
>  	bss = cfg80211_get_bss(wdev->wiphy, channel, bssid, NULL, 0,
>  			       IEEE80211_BSS_TYPE_IBSS, IEEE80211_PRIVACY_ANY);
>  
> -	if (WARN_ON(!bss))
> +	if (!bss) {
> +		pr_warn("cfg80211: cfg80211_bss with bssid %s not found.\n", bssid);
>  		return;
> +	}

If it's a normal case (disclaimer: didn't investigate that) the warning
message could be more descriptive. I suspect the user is just confused
after seeing that.

Also 'wifi:' missing from subject.

-- 
https://patchwork.kernel.org/project/linux-wireless/list/

https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches

Re: [PATCH] cfg80211: Convert WARN_ON() to warning message

[Johannes Berg]

On Thu, 2024-09-26 at 16:34 +0300, Vladislav Efanov wrote:
> syzkaller got the following warning:
> ------------[ cut here ]------------
> WARNING: CPU: 0 PID: 9992 at net/wireless/ibss.c:36 __cfg80211_ibss
> 
> This warning is the result of the race condition between the following
> events:
> 
> event1                          event2                      event3
> __ieee80211_sta_join_ibss()        |                          |
> creates new cgf80211_bss           |                          |
> structure.                         |                          |
> Calls cfg80211_ibss_joined()       |                          |
> which will scheduled               |                          |
> new event_work.                    |                          |
>                          ieee80211_ibss_disconnect()          |
>                          is called due to connection          |
>                          dropped/ibss leaves to               |
>                          remove cfg80211_bss structure.       |
>                                                 event_work starts.
>                                           __cfg80211_ibss_joined()
> 

Seems almost better though to solve it by removing the pending work when
disconnecting?

johannes