* [PATCH net] wifi: cfg80211: restrict NL80211_ATTR_TXQ_QUANTUM values
@ 2024-06-15 16:08 Eric Dumazet
2024-06-17 10:35 ` Toke Høiland-Jørgensen
2024-06-17 13:15 ` Kalle Valo
0 siblings, 2 replies; 8+ messages in thread
From: Eric Dumazet @ 2024-06-15 16:08 UTC (permalink / raw)
To: David S . Miller, Jakub Kicinski, Paolo Abeni, Johannes Berg
Cc: linux-wireless, netdev, eric.dumazet, Eric Dumazet,
Toke Høiland-Jørgensen
syzbot is able to trigger softlockups, setting NL80211_ATTR_TXQ_QUANTUM
to 2^31.
We had a similar issue in sch_fq, fixed with commit
d9e15a273306 ("pkt_sched: fq: do not accept silly TCA_FQ_QUANTUM")
watchdog: BUG: soft lockup - CPU#1 stuck for 26s! [kworker/1:0:24]
Modules linked in:
irq event stamp: 131135
hardirqs last enabled at (131134): [<ffff80008ae8778c>] __exit_to_kernel_mode arch/arm64/kernel/entry-common.c:85 [inline]
hardirqs last enabled at (131134): [<ffff80008ae8778c>] exit_to_kernel_mode+0xdc/0x10c arch/arm64/kernel/entry-common.c:95
hardirqs last disabled at (131135): [<ffff80008ae85378>] __el1_irq arch/arm64/kernel/entry-common.c:533 [inline]
hardirqs last disabled at (131135): [<ffff80008ae85378>] el1_interrupt+0x24/0x68 arch/arm64/kernel/entry-common.c:551
softirqs last enabled at (125892): [<ffff80008907e82c>] neigh_hh_init net/core/neighbour.c:1538 [inline]
softirqs last enabled at (125892): [<ffff80008907e82c>] neigh_resolve_output+0x268/0x658 net/core/neighbour.c:1553
softirqs last disabled at (125896): [<ffff80008904166c>] local_bh_disable+0x10/0x34 include/linux/bottom_half.h:19
CPU: 1 PID: 24 Comm: kworker/1:0 Not tainted 6.9.0-rc7-syzkaller-gfda5695d692c #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024
Workqueue: mld mld_ifc_work
pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : __list_del include/linux/list.h:195 [inline]
pc : __list_del_entry include/linux/list.h:218 [inline]
pc : list_move_tail include/linux/list.h:310 [inline]
pc : fq_tin_dequeue include/net/fq_impl.h:112 [inline]
pc : ieee80211_tx_dequeue+0x6b8/0x3b4c net/mac80211/tx.c:3854
lr : __list_del_entry include/linux/list.h:218 [inline]
lr : list_move_tail include/linux/list.h:310 [inline]
lr : fq_tin_dequeue include/net/fq_impl.h:112 [inline]
lr : ieee80211_tx_dequeue+0x67c/0x3b4c net/mac80211/tx.c:3854
sp : ffff800093d36700
x29: ffff800093d36a60 x28: ffff800093d36960 x27: dfff800000000000
x26: ffff0000d800ad50 x25: ffff0000d800abe0 x24: ffff0000d800abf0
x23: ffff0000e0032468 x22: ffff0000e00324d4 x21: ffff0000d800abf0
x20: ffff0000d800abf8 x19: ffff0000d800abf0 x18: ffff800093d363c0
x17: 000000000000d476 x16: ffff8000805519dc x15: ffff7000127a6cc8
x14: 1ffff000127a6cc8 x13: 0000000000000004 x12: ffffffffffffffff
x11: ffff7000127a6cc8 x10: 0000000000ff0100 x9 : 0000000000000000
x8 : 0000000000000000 x7 : 0000000000000000 x6 : 0000000000000000
x5 : ffff80009287aa08 x4 : 0000000000000008 x3 : ffff80008034c7fc
x2 : ffff0000e0032468 x1 : 00000000da0e46b8 x0 : ffff0000e0032470
Call trace:
__list_del include/linux/list.h:195 [inline]
__list_del_entry include/linux/list.h:218 [inline]
list_move_tail include/linux/list.h:310 [inline]
fq_tin_dequeue include/net/fq_impl.h:112 [inline]
ieee80211_tx_dequeue+0x6b8/0x3b4c net/mac80211/tx.c:3854
wake_tx_push_queue net/mac80211/util.c:294 [inline]
ieee80211_handle_wake_tx_queue+0x118/0x274 net/mac80211/util.c:315
drv_wake_tx_queue net/mac80211/driver-ops.h:1350 [inline]
schedule_and_wake_txq net/mac80211/driver-ops.h:1357 [inline]
ieee80211_queue_skb+0x18e8/0x2244 net/mac80211/tx.c:1664
ieee80211_tx+0x260/0x400 net/mac80211/tx.c:1966
ieee80211_xmit+0x278/0x354 net/mac80211/tx.c:2062
__ieee80211_subif_start_xmit+0xab8/0x122c net/mac80211/tx.c:4338
ieee80211_subif_start_xmit+0xe0/0x438 net/mac80211/tx.c:4532
__netdev_start_xmit include/linux/netdevice.h:4903 [inline]
netdev_start_xmit include/linux/netdevice.h:4917 [inline]
xmit_one net/core/dev.c:3531 [inline]
dev_hard_start_xmit+0x27c/0x938 net/core/dev.c:3547
__dev_queue_xmit+0x1678/0x33fc net/core/dev.c:4341
dev_queue_xmit include/linux/netdevice.h:3091 [inline]
neigh_resolve_output+0x558/0x658 net/core/neighbour.c:1563
neigh_output include/net/neighbour.h:542 [inline]
ip6_finish_output2+0x104c/0x1ee8 net/ipv6/ip6_output.c:137
ip6_finish_output+0x428/0x7a0 net/ipv6/ip6_output.c:222
NF_HOOK_COND include/linux/netfilter.h:303 [inline]
ip6_output+0x270/0x594 net/ipv6/ip6_output.c:243
dst_output include/net/dst.h:450 [inline]
NF_HOOK+0x160/0x4f0 include/linux/netfilter.h:314
mld_sendpack+0x7b4/0x10f4 net/ipv6/mcast.c:1818
mld_send_cr net/ipv6/mcast.c:2119 [inline]
mld_ifc_work+0x840/0xd0c net/ipv6/mcast.c:2650
process_one_work+0x7b8/0x15d4 kernel/workqueue.c:3267
process_scheduled_works kernel/workqueue.c:3348 [inline]
worker_thread+0x938/0xef4 kernel/workqueue.c:3429
kthread+0x288/0x310 kernel/kthread.c:388
ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:860
Fixes: 52539ca89f36 ("cfg80211: Expose TXQ stats and parameters to userspace")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: Toke Høiland-Jørgensen <toke@toke.dk>
---
net/wireless/nl80211.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 3c0bca4238d357c01b6fe92bb0f2b2b8a2917725..72c7bf55858166b8fc12114f090bf085d652db6b 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -468,6 +468,10 @@ static const struct netlink_range_validation nl80211_punct_bitmap_range = {
.max = 0xffff,
};
+static const struct netlink_range_validation q_range = {
+ .max = INT_MAX,
+};
+
static const struct nla_policy nl80211_policy[NUM_NL80211_ATTR] = {
[0] = { .strict_start_type = NL80211_ATTR_HE_OBSS_PD },
[NL80211_ATTR_WIPHY] = { .type = NLA_U32 },
@@ -754,7 +758,7 @@ static const struct nla_policy nl80211_policy[NUM_NL80211_ATTR] = {
[NL80211_ATTR_TXQ_LIMIT] = { .type = NLA_U32 },
[NL80211_ATTR_TXQ_MEMORY_LIMIT] = { .type = NLA_U32 },
- [NL80211_ATTR_TXQ_QUANTUM] = { .type = NLA_U32 },
+ [NL80211_ATTR_TXQ_QUANTUM] = NLA_POLICY_FULL_RANGE(NLA_U32, &q_range),
[NL80211_ATTR_HE_CAPABILITY] =
NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_he_capa,
NL80211_HE_MAX_CAPABILITY_LEN),
--
2.45.2.627.g7a2c4fd464-goog
^ permalink raw reply related [flat|nested] 8+ messages in thread
* Re: [PATCH net] wifi: cfg80211: restrict NL80211_ATTR_TXQ_QUANTUM values
2024-06-15 16:08 [PATCH net] wifi: cfg80211: restrict NL80211_ATTR_TXQ_QUANTUM values Eric Dumazet
@ 2024-06-17 10:35 ` Toke Høiland-Jørgensen
2024-06-19 9:07 ` Eric Dumazet
2024-06-17 13:15 ` Kalle Valo
1 sibling, 1 reply; 8+ messages in thread
From: Toke Høiland-Jørgensen @ 2024-06-17 10:35 UTC (permalink / raw)
To: Eric Dumazet, David S . Miller, Jakub Kicinski, Paolo Abeni,
Johannes Berg
Cc: linux-wireless, netdev, eric.dumazet, Eric Dumazet
Eric Dumazet <edumazet@google.com> writes:
> syzbot is able to trigger softlockups, setting NL80211_ATTR_TXQ_QUANTUM
> to 2^31.
>
> We had a similar issue in sch_fq, fixed with commit
> d9e15a273306 ("pkt_sched: fq: do not accept silly TCA_FQ_QUANTUM")
>
> watchdog: BUG: soft lockup - CPU#1 stuck for 26s! [kworker/1:0:24]
> Modules linked in:
> irq event stamp: 131135
> hardirqs last enabled at (131134): [<ffff80008ae8778c>] __exit_to_kernel_mode arch/arm64/kernel/entry-common.c:85 [inline]
> hardirqs last enabled at (131134): [<ffff80008ae8778c>] exit_to_kernel_mode+0xdc/0x10c arch/arm64/kernel/entry-common.c:95
> hardirqs last disabled at (131135): [<ffff80008ae85378>] __el1_irq arch/arm64/kernel/entry-common.c:533 [inline]
> hardirqs last disabled at (131135): [<ffff80008ae85378>] el1_interrupt+0x24/0x68 arch/arm64/kernel/entry-common.c:551
> softirqs last enabled at (125892): [<ffff80008907e82c>] neigh_hh_init net/core/neighbour.c:1538 [inline]
> softirqs last enabled at (125892): [<ffff80008907e82c>] neigh_resolve_output+0x268/0x658 net/core/neighbour.c:1553
> softirqs last disabled at (125896): [<ffff80008904166c>] local_bh_disable+0x10/0x34 include/linux/bottom_half.h:19
> CPU: 1 PID: 24 Comm: kworker/1:0 Not tainted 6.9.0-rc7-syzkaller-gfda5695d692c #0
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024
> Workqueue: mld mld_ifc_work
> pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
> pc : __list_del include/linux/list.h:195 [inline]
> pc : __list_del_entry include/linux/list.h:218 [inline]
> pc : list_move_tail include/linux/list.h:310 [inline]
> pc : fq_tin_dequeue include/net/fq_impl.h:112 [inline]
> pc : ieee80211_tx_dequeue+0x6b8/0x3b4c net/mac80211/tx.c:3854
> lr : __list_del_entry include/linux/list.h:218 [inline]
> lr : list_move_tail include/linux/list.h:310 [inline]
> lr : fq_tin_dequeue include/net/fq_impl.h:112 [inline]
> lr : ieee80211_tx_dequeue+0x67c/0x3b4c net/mac80211/tx.c:3854
> sp : ffff800093d36700
> x29: ffff800093d36a60 x28: ffff800093d36960 x27: dfff800000000000
> x26: ffff0000d800ad50 x25: ffff0000d800abe0 x24: ffff0000d800abf0
> x23: ffff0000e0032468 x22: ffff0000e00324d4 x21: ffff0000d800abf0
> x20: ffff0000d800abf8 x19: ffff0000d800abf0 x18: ffff800093d363c0
> x17: 000000000000d476 x16: ffff8000805519dc x15: ffff7000127a6cc8
> x14: 1ffff000127a6cc8 x13: 0000000000000004 x12: ffffffffffffffff
> x11: ffff7000127a6cc8 x10: 0000000000ff0100 x9 : 0000000000000000
> x8 : 0000000000000000 x7 : 0000000000000000 x6 : 0000000000000000
> x5 : ffff80009287aa08 x4 : 0000000000000008 x3 : ffff80008034c7fc
> x2 : ffff0000e0032468 x1 : 00000000da0e46b8 x0 : ffff0000e0032470
> Call trace:
> __list_del include/linux/list.h:195 [inline]
> __list_del_entry include/linux/list.h:218 [inline]
> list_move_tail include/linux/list.h:310 [inline]
> fq_tin_dequeue include/net/fq_impl.h:112 [inline]
> ieee80211_tx_dequeue+0x6b8/0x3b4c net/mac80211/tx.c:3854
> wake_tx_push_queue net/mac80211/util.c:294 [inline]
> ieee80211_handle_wake_tx_queue+0x118/0x274 net/mac80211/util.c:315
> drv_wake_tx_queue net/mac80211/driver-ops.h:1350 [inline]
> schedule_and_wake_txq net/mac80211/driver-ops.h:1357 [inline]
> ieee80211_queue_skb+0x18e8/0x2244 net/mac80211/tx.c:1664
> ieee80211_tx+0x260/0x400 net/mac80211/tx.c:1966
> ieee80211_xmit+0x278/0x354 net/mac80211/tx.c:2062
> __ieee80211_subif_start_xmit+0xab8/0x122c net/mac80211/tx.c:4338
> ieee80211_subif_start_xmit+0xe0/0x438 net/mac80211/tx.c:4532
> __netdev_start_xmit include/linux/netdevice.h:4903 [inline]
> netdev_start_xmit include/linux/netdevice.h:4917 [inline]
> xmit_one net/core/dev.c:3531 [inline]
> dev_hard_start_xmit+0x27c/0x938 net/core/dev.c:3547
> __dev_queue_xmit+0x1678/0x33fc net/core/dev.c:4341
> dev_queue_xmit include/linux/netdevice.h:3091 [inline]
> neigh_resolve_output+0x558/0x658 net/core/neighbour.c:1563
> neigh_output include/net/neighbour.h:542 [inline]
> ip6_finish_output2+0x104c/0x1ee8 net/ipv6/ip6_output.c:137
> ip6_finish_output+0x428/0x7a0 net/ipv6/ip6_output.c:222
> NF_HOOK_COND include/linux/netfilter.h:303 [inline]
> ip6_output+0x270/0x594 net/ipv6/ip6_output.c:243
> dst_output include/net/dst.h:450 [inline]
> NF_HOOK+0x160/0x4f0 include/linux/netfilter.h:314
> mld_sendpack+0x7b4/0x10f4 net/ipv6/mcast.c:1818
> mld_send_cr net/ipv6/mcast.c:2119 [inline]
> mld_ifc_work+0x840/0xd0c net/ipv6/mcast.c:2650
> process_one_work+0x7b8/0x15d4 kernel/workqueue.c:3267
> process_scheduled_works kernel/workqueue.c:3348 [inline]
> worker_thread+0x938/0xef4 kernel/workqueue.c:3429
> kthread+0x288/0x310 kernel/kthread.c:388
> ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:860
>
> Fixes: 52539ca89f36 ("cfg80211: Expose TXQ stats and parameters to userspace")
> Signed-off-by: Eric Dumazet <edumazet@google.com>
> Signed-off-by: Toke Høiland-Jørgensen <toke@toke.dk>
Hmm, extraneous s-o-b? :)
> ---
> net/wireless/nl80211.c | 6 +++++-
> 1 file changed, 5 insertions(+), 1 deletion(-)
>
> diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
> index 3c0bca4238d357c01b6fe92bb0f2b2b8a2917725..72c7bf55858166b8fc12114f090bf085d652db6b 100644
> --- a/net/wireless/nl80211.c
> +++ b/net/wireless/nl80211.c
> @@ -468,6 +468,10 @@ static const struct netlink_range_validation nl80211_punct_bitmap_range = {
> .max = 0xffff,
> };
>
> +static const struct netlink_range_validation q_range = {
> + .max = INT_MAX,
> +};
The corresponding fixes to sch_fq and fq_codel use a limit of 1<<20;
INT_MAX is a bit above that, won't that still lead to issues?
-Toke
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [PATCH net] wifi: cfg80211: restrict NL80211_ATTR_TXQ_QUANTUM values
2024-06-15 16:08 [PATCH net] wifi: cfg80211: restrict NL80211_ATTR_TXQ_QUANTUM values Eric Dumazet
2024-06-17 10:35 ` Toke Høiland-Jørgensen
@ 2024-06-17 13:15 ` Kalle Valo
2024-06-19 9:10 ` Eric Dumazet
1 sibling, 1 reply; 8+ messages in thread
From: Kalle Valo @ 2024-06-17 13:15 UTC (permalink / raw)
To: Eric Dumazet
Cc: David S . Miller, Jakub Kicinski, Paolo Abeni, Johannes Berg,
linux-wireless, netdev, eric.dumazet,
Toke Høiland-Jørgensen
Eric Dumazet <edumazet@google.com> writes:
> syzbot is able to trigger softlockups, setting NL80211_ATTR_TXQ_QUANTUM
> to 2^31.
>
> We had a similar issue in sch_fq, fixed with commit
> d9e15a273306 ("pkt_sched: fq: do not accept silly TCA_FQ_QUANTUM")
>
> watchdog: BUG: soft lockup - CPU#1 stuck for 26s! [kworker/1:0:24]
> Modules linked in:
> irq event stamp: 131135
> hardirqs last enabled at (131134): [<ffff80008ae8778c>] __exit_to_kernel_mode arch/arm64/kernel/entry-common.c:85 [inline]
> hardirqs last enabled at (131134): [<ffff80008ae8778c>] exit_to_kernel_mode+0xdc/0x10c arch/arm64/kernel/entry-common.c:95
> hardirqs last disabled at (131135): [<ffff80008ae85378>] __el1_irq arch/arm64/kernel/entry-common.c:533 [inline]
> hardirqs last disabled at (131135): [<ffff80008ae85378>] el1_interrupt+0x24/0x68 arch/arm64/kernel/entry-common.c:551
> softirqs last enabled at (125892): [<ffff80008907e82c>] neigh_hh_init net/core/neighbour.c:1538 [inline]
> softirqs last enabled at (125892): [<ffff80008907e82c>] neigh_resolve_output+0x268/0x658 net/core/neighbour.c:1553
> softirqs last disabled at (125896): [<ffff80008904166c>] local_bh_disable+0x10/0x34 include/linux/bottom_half.h:19
> CPU: 1 PID: 24 Comm: kworker/1:0 Not tainted 6.9.0-rc7-syzkaller-gfda5695d692c #0
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024
> Workqueue: mld mld_ifc_work
> pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
> pc : __list_del include/linux/list.h:195 [inline]
> pc : __list_del_entry include/linux/list.h:218 [inline]
> pc : list_move_tail include/linux/list.h:310 [inline]
> pc : fq_tin_dequeue include/net/fq_impl.h:112 [inline]
> pc : ieee80211_tx_dequeue+0x6b8/0x3b4c net/mac80211/tx.c:3854
> lr : __list_del_entry include/linux/list.h:218 [inline]
> lr : list_move_tail include/linux/list.h:310 [inline]
> lr : fq_tin_dequeue include/net/fq_impl.h:112 [inline]
> lr : ieee80211_tx_dequeue+0x67c/0x3b4c net/mac80211/tx.c:3854
> sp : ffff800093d36700
> x29: ffff800093d36a60 x28: ffff800093d36960 x27: dfff800000000000
> x26: ffff0000d800ad50 x25: ffff0000d800abe0 x24: ffff0000d800abf0
> x23: ffff0000e0032468 x22: ffff0000e00324d4 x21: ffff0000d800abf0
> x20: ffff0000d800abf8 x19: ffff0000d800abf0 x18: ffff800093d363c0
> x17: 000000000000d476 x16: ffff8000805519dc x15: ffff7000127a6cc8
> x14: 1ffff000127a6cc8 x13: 0000000000000004 x12: ffffffffffffffff
> x11: ffff7000127a6cc8 x10: 0000000000ff0100 x9 : 0000000000000000
> x8 : 0000000000000000 x7 : 0000000000000000 x6 : 0000000000000000
> x5 : ffff80009287aa08 x4 : 0000000000000008 x3 : ffff80008034c7fc
> x2 : ffff0000e0032468 x1 : 00000000da0e46b8 x0 : ffff0000e0032470
> Call trace:
> __list_del include/linux/list.h:195 [inline]
> __list_del_entry include/linux/list.h:218 [inline]
> list_move_tail include/linux/list.h:310 [inline]
> fq_tin_dequeue include/net/fq_impl.h:112 [inline]
> ieee80211_tx_dequeue+0x6b8/0x3b4c net/mac80211/tx.c:3854
> wake_tx_push_queue net/mac80211/util.c:294 [inline]
> ieee80211_handle_wake_tx_queue+0x118/0x274 net/mac80211/util.c:315
> drv_wake_tx_queue net/mac80211/driver-ops.h:1350 [inline]
> schedule_and_wake_txq net/mac80211/driver-ops.h:1357 [inline]
> ieee80211_queue_skb+0x18e8/0x2244 net/mac80211/tx.c:1664
> ieee80211_tx+0x260/0x400 net/mac80211/tx.c:1966
> ieee80211_xmit+0x278/0x354 net/mac80211/tx.c:2062
> __ieee80211_subif_start_xmit+0xab8/0x122c net/mac80211/tx.c:4338
> ieee80211_subif_start_xmit+0xe0/0x438 net/mac80211/tx.c:4532
> __netdev_start_xmit include/linux/netdevice.h:4903 [inline]
> netdev_start_xmit include/linux/netdevice.h:4917 [inline]
> xmit_one net/core/dev.c:3531 [inline]
> dev_hard_start_xmit+0x27c/0x938 net/core/dev.c:3547
> __dev_queue_xmit+0x1678/0x33fc net/core/dev.c:4341
> dev_queue_xmit include/linux/netdevice.h:3091 [inline]
> neigh_resolve_output+0x558/0x658 net/core/neighbour.c:1563
> neigh_output include/net/neighbour.h:542 [inline]
> ip6_finish_output2+0x104c/0x1ee8 net/ipv6/ip6_output.c:137
> ip6_finish_output+0x428/0x7a0 net/ipv6/ip6_output.c:222
> NF_HOOK_COND include/linux/netfilter.h:303 [inline]
> ip6_output+0x270/0x594 net/ipv6/ip6_output.c:243
> dst_output include/net/dst.h:450 [inline]
> NF_HOOK+0x160/0x4f0 include/linux/netfilter.h:314
> mld_sendpack+0x7b4/0x10f4 net/ipv6/mcast.c:1818
> mld_send_cr net/ipv6/mcast.c:2119 [inline]
> mld_ifc_work+0x840/0xd0c net/ipv6/mcast.c:2650
> process_one_work+0x7b8/0x15d4 kernel/workqueue.c:3267
> process_scheduled_works kernel/workqueue.c:3348 [inline]
> worker_thread+0x938/0xef4 kernel/workqueue.c:3429
> kthread+0x288/0x310 kernel/kthread.c:388
> ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:860
>
> Fixes: 52539ca89f36 ("cfg80211: Expose TXQ stats and parameters to userspace")
> Signed-off-by: Eric Dumazet <edumazet@google.com>
> Signed-off-by: Toke Høiland-Jørgensen <toke@toke.dk>
cfg80211 patches go to wireless tree, not net.
--
https://patchwork.kernel.org/project/linux-wireless/list/
https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [PATCH net] wifi: cfg80211: restrict NL80211_ATTR_TXQ_QUANTUM values
2024-06-17 10:35 ` Toke Høiland-Jørgensen
@ 2024-06-19 9:07 ` Eric Dumazet
2024-06-19 9:22 ` Eric Dumazet
0 siblings, 1 reply; 8+ messages in thread
From: Eric Dumazet @ 2024-06-19 9:07 UTC (permalink / raw)
To: Toke Høiland-Jørgensen
Cc: David S . Miller, Jakub Kicinski, Paolo Abeni, Johannes Berg,
linux-wireless, netdev, eric.dumazet
On Mon, Jun 17, 2024 at 12:35 PM Toke Høiland-Jørgensen <toke@toke.dk> wrote:
>
> Eric Dumazet <edumazet@google.com> writes:
>
> > syzbot is able to trigger softlockups, setting NL80211_ATTR_TXQ_QUANTUM
> > to 2^31.
> >
> > We had a similar issue in sch_fq, fixed with commit
> > d9e15a273306 ("pkt_sched: fq: do not accept silly TCA_FQ_QUANTUM")
> >
> > watchdog: BUG: soft lockup - CPU#1 stuck for 26s! [kworker/1:0:24]
> > Modules linked in:
> > irq event stamp: 131135
> > hardirqs last enabled at (131134): [<ffff80008ae8778c>] __exit_to_kernel_mode arch/arm64/kernel/entry-common.c:85 [inline]
> > hardirqs last enabled at (131134): [<ffff80008ae8778c>] exit_to_kernel_mode+0xdc/0x10c arch/arm64/kernel/entry-common.c:95
> > hardirqs last disabled at (131135): [<ffff80008ae85378>] __el1_irq arch/arm64/kernel/entry-common.c:533 [inline]
> > hardirqs last disabled at (131135): [<ffff80008ae85378>] el1_interrupt+0x24/0x68 arch/arm64/kernel/entry-common.c:551
> > softirqs last enabled at (125892): [<ffff80008907e82c>] neigh_hh_init net/core/neighbour.c:1538 [inline]
> > softirqs last enabled at (125892): [<ffff80008907e82c>] neigh_resolve_output+0x268/0x658 net/core/neighbour.c:1553
> > softirqs last disabled at (125896): [<ffff80008904166c>] local_bh_disable+0x10/0x34 include/linux/bottom_half.h:19
> > CPU: 1 PID: 24 Comm: kworker/1:0 Not tainted 6.9.0-rc7-syzkaller-gfda5695d692c #0
> > Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024
> > Workqueue: mld mld_ifc_work
> > pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
> > pc : __list_del include/linux/list.h:195 [inline]
> > pc : __list_del_entry include/linux/list.h:218 [inline]
> > pc : list_move_tail include/linux/list.h:310 [inline]
> > pc : fq_tin_dequeue include/net/fq_impl.h:112 [inline]
> > pc : ieee80211_tx_dequeue+0x6b8/0x3b4c net/mac80211/tx.c:3854
> > lr : __list_del_entry include/linux/list.h:218 [inline]
> > lr : list_move_tail include/linux/list.h:310 [inline]
> > lr : fq_tin_dequeue include/net/fq_impl.h:112 [inline]
> > lr : ieee80211_tx_dequeue+0x67c/0x3b4c net/mac80211/tx.c:3854
> > sp : ffff800093d36700
> > x29: ffff800093d36a60 x28: ffff800093d36960 x27: dfff800000000000
> > x26: ffff0000d800ad50 x25: ffff0000d800abe0 x24: ffff0000d800abf0
> > x23: ffff0000e0032468 x22: ffff0000e00324d4 x21: ffff0000d800abf0
> > x20: ffff0000d800abf8 x19: ffff0000d800abf0 x18: ffff800093d363c0
> > x17: 000000000000d476 x16: ffff8000805519dc x15: ffff7000127a6cc8
> > x14: 1ffff000127a6cc8 x13: 0000000000000004 x12: ffffffffffffffff
> > x11: ffff7000127a6cc8 x10: 0000000000ff0100 x9 : 0000000000000000
> > x8 : 0000000000000000 x7 : 0000000000000000 x6 : 0000000000000000
> > x5 : ffff80009287aa08 x4 : 0000000000000008 x3 : ffff80008034c7fc
> > x2 : ffff0000e0032468 x1 : 00000000da0e46b8 x0 : ffff0000e0032470
> > Call trace:
> > __list_del include/linux/list.h:195 [inline]
> > __list_del_entry include/linux/list.h:218 [inline]
> > list_move_tail include/linux/list.h:310 [inline]
> > fq_tin_dequeue include/net/fq_impl.h:112 [inline]
> > ieee80211_tx_dequeue+0x6b8/0x3b4c net/mac80211/tx.c:3854
> > wake_tx_push_queue net/mac80211/util.c:294 [inline]
> > ieee80211_handle_wake_tx_queue+0x118/0x274 net/mac80211/util.c:315
> > drv_wake_tx_queue net/mac80211/driver-ops.h:1350 [inline]
> > schedule_and_wake_txq net/mac80211/driver-ops.h:1357 [inline]
> > ieee80211_queue_skb+0x18e8/0x2244 net/mac80211/tx.c:1664
> > ieee80211_tx+0x260/0x400 net/mac80211/tx.c:1966
> > ieee80211_xmit+0x278/0x354 net/mac80211/tx.c:2062
> > __ieee80211_subif_start_xmit+0xab8/0x122c net/mac80211/tx.c:4338
> > ieee80211_subif_start_xmit+0xe0/0x438 net/mac80211/tx.c:4532
> > __netdev_start_xmit include/linux/netdevice.h:4903 [inline]
> > netdev_start_xmit include/linux/netdevice.h:4917 [inline]
> > xmit_one net/core/dev.c:3531 [inline]
> > dev_hard_start_xmit+0x27c/0x938 net/core/dev.c:3547
> > __dev_queue_xmit+0x1678/0x33fc net/core/dev.c:4341
> > dev_queue_xmit include/linux/netdevice.h:3091 [inline]
> > neigh_resolve_output+0x558/0x658 net/core/neighbour.c:1563
> > neigh_output include/net/neighbour.h:542 [inline]
> > ip6_finish_output2+0x104c/0x1ee8 net/ipv6/ip6_output.c:137
> > ip6_finish_output+0x428/0x7a0 net/ipv6/ip6_output.c:222
> > NF_HOOK_COND include/linux/netfilter.h:303 [inline]
> > ip6_output+0x270/0x594 net/ipv6/ip6_output.c:243
> > dst_output include/net/dst.h:450 [inline]
> > NF_HOOK+0x160/0x4f0 include/linux/netfilter.h:314
> > mld_sendpack+0x7b4/0x10f4 net/ipv6/mcast.c:1818
> > mld_send_cr net/ipv6/mcast.c:2119 [inline]
> > mld_ifc_work+0x840/0xd0c net/ipv6/mcast.c:2650
> > process_one_work+0x7b8/0x15d4 kernel/workqueue.c:3267
> > process_scheduled_works kernel/workqueue.c:3348 [inline]
> > worker_thread+0x938/0xef4 kernel/workqueue.c:3429
> > kthread+0x288/0x310 kernel/kthread.c:388
> > ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:860
> >
> > Fixes: 52539ca89f36 ("cfg80211: Expose TXQ stats and parameters to userspace")
> > Signed-off-by: Eric Dumazet <edumazet@google.com>
> > Signed-off-by: Toke Høiland-Jørgensen <toke@toke.dk>
>
> Hmm, extraneous s-o-b? :)
>
> > ---
> > net/wireless/nl80211.c | 6 +++++-
> > 1 file changed, 5 insertions(+), 1 deletion(-)
> >
> > diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
> > index 3c0bca4238d357c01b6fe92bb0f2b2b8a2917725..72c7bf55858166b8fc12114f090bf085d652db6b 100644
> > --- a/net/wireless/nl80211.c
> > +++ b/net/wireless/nl80211.c
> > @@ -468,6 +468,10 @@ static const struct netlink_range_validation nl80211_punct_bitmap_range = {
> > .max = 0xffff,
> > };
> >
> > +static const struct netlink_range_validation q_range = {
> > + .max = INT_MAX,
> > +};
>
> The corresponding fixes to sch_fq and fq_codel use a limit of 1<<20;
> INT_MAX is a bit above that, won't that still lead to issues?
What kind of issues do you envision ?
I do not know what kind of aggregation level wireless will have in 2030.
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [PATCH net] wifi: cfg80211: restrict NL80211_ATTR_TXQ_QUANTUM values
2024-06-17 13:15 ` Kalle Valo
@ 2024-06-19 9:10 ` Eric Dumazet
2024-06-19 9:52 ` Kalle Valo
0 siblings, 1 reply; 8+ messages in thread
From: Eric Dumazet @ 2024-06-19 9:10 UTC (permalink / raw)
To: Kalle Valo
Cc: David S . Miller, Jakub Kicinski, Paolo Abeni, Johannes Berg,
linux-wireless, netdev, eric.dumazet,
Toke Høiland-Jørgensen
On Mon, Jun 17, 2024 at 3:15 PM Kalle Valo <kvalo@kernel.org> wrote:
>
> Eric Dumazet <edumazet@google.com> writes:
>
> > syzbot is able to trigger softlockups, setting NL80211_ATTR_TXQ_QUANTUM
> > to 2^31.
> >
> > We had a similar issue in sch_fq, fixed with commit
> > d9e15a273306 ("pkt_sched: fq: do not accept silly TCA_FQ_QUANTUM")
> >
> > watchdog: BUG: soft lockup - CPU#1 stuck for 26s! [kworker/1:0:24]
> > Modules linked in:
> > irq event stamp: 131135
> > hardirqs last enabled at (131134): [<ffff80008ae8778c>] __exit_to_kernel_mode arch/arm64/kernel/entry-common.c:85 [inline]
> > hardirqs last enabled at (131134): [<ffff80008ae8778c>] exit_to_kernel_mode+0xdc/0x10c arch/arm64/kernel/entry-common.c:95
> > hardirqs last disabled at (131135): [<ffff80008ae85378>] __el1_irq arch/arm64/kernel/entry-common.c:533 [inline]
> > hardirqs last disabled at (131135): [<ffff80008ae85378>] el1_interrupt+0x24/0x68 arch/arm64/kernel/entry-common.c:551
> > softirqs last enabled at (125892): [<ffff80008907e82c>] neigh_hh_init net/core/neighbour.c:1538 [inline]
> > softirqs last enabled at (125892): [<ffff80008907e82c>] neigh_resolve_output+0x268/0x658 net/core/neighbour.c:1553
> > softirqs last disabled at (125896): [<ffff80008904166c>] local_bh_disable+0x10/0x34 include/linux/bottom_half.h:19
> > CPU: 1 PID: 24 Comm: kworker/1:0 Not tainted 6.9.0-rc7-syzkaller-gfda5695d692c #0
> > Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024
> > Workqueue: mld mld_ifc_work
> > pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
> > pc : __list_del include/linux/list.h:195 [inline]
> > pc : __list_del_entry include/linux/list.h:218 [inline]
> > pc : list_move_tail include/linux/list.h:310 [inline]
> > pc : fq_tin_dequeue include/net/fq_impl.h:112 [inline]
> > pc : ieee80211_tx_dequeue+0x6b8/0x3b4c net/mac80211/tx.c:3854
> > lr : __list_del_entry include/linux/list.h:218 [inline]
> > lr : list_move_tail include/linux/list.h:310 [inline]
> > lr : fq_tin_dequeue include/net/fq_impl.h:112 [inline]
> > lr : ieee80211_tx_dequeue+0x67c/0x3b4c net/mac80211/tx.c:3854
> > sp : ffff800093d36700
> > x29: ffff800093d36a60 x28: ffff800093d36960 x27: dfff800000000000
> > x26: ffff0000d800ad50 x25: ffff0000d800abe0 x24: ffff0000d800abf0
> > x23: ffff0000e0032468 x22: ffff0000e00324d4 x21: ffff0000d800abf0
> > x20: ffff0000d800abf8 x19: ffff0000d800abf0 x18: ffff800093d363c0
> > x17: 000000000000d476 x16: ffff8000805519dc x15: ffff7000127a6cc8
> > x14: 1ffff000127a6cc8 x13: 0000000000000004 x12: ffffffffffffffff
> > x11: ffff7000127a6cc8 x10: 0000000000ff0100 x9 : 0000000000000000
> > x8 : 0000000000000000 x7 : 0000000000000000 x6 : 0000000000000000
> > x5 : ffff80009287aa08 x4 : 0000000000000008 x3 : ffff80008034c7fc
> > x2 : ffff0000e0032468 x1 : 00000000da0e46b8 x0 : ffff0000e0032470
> > Call trace:
> > __list_del include/linux/list.h:195 [inline]
> > __list_del_entry include/linux/list.h:218 [inline]
> > list_move_tail include/linux/list.h:310 [inline]
> > fq_tin_dequeue include/net/fq_impl.h:112 [inline]
> > ieee80211_tx_dequeue+0x6b8/0x3b4c net/mac80211/tx.c:3854
> > wake_tx_push_queue net/mac80211/util.c:294 [inline]
> > ieee80211_handle_wake_tx_queue+0x118/0x274 net/mac80211/util.c:315
> > drv_wake_tx_queue net/mac80211/driver-ops.h:1350 [inline]
> > schedule_and_wake_txq net/mac80211/driver-ops.h:1357 [inline]
> > ieee80211_queue_skb+0x18e8/0x2244 net/mac80211/tx.c:1664
> > ieee80211_tx+0x260/0x400 net/mac80211/tx.c:1966
> > ieee80211_xmit+0x278/0x354 net/mac80211/tx.c:2062
> > __ieee80211_subif_start_xmit+0xab8/0x122c net/mac80211/tx.c:4338
> > ieee80211_subif_start_xmit+0xe0/0x438 net/mac80211/tx.c:4532
> > __netdev_start_xmit include/linux/netdevice.h:4903 [inline]
> > netdev_start_xmit include/linux/netdevice.h:4917 [inline]
> > xmit_one net/core/dev.c:3531 [inline]
> > dev_hard_start_xmit+0x27c/0x938 net/core/dev.c:3547
> > __dev_queue_xmit+0x1678/0x33fc net/core/dev.c:4341
> > dev_queue_xmit include/linux/netdevice.h:3091 [inline]
> > neigh_resolve_output+0x558/0x658 net/core/neighbour.c:1563
> > neigh_output include/net/neighbour.h:542 [inline]
> > ip6_finish_output2+0x104c/0x1ee8 net/ipv6/ip6_output.c:137
> > ip6_finish_output+0x428/0x7a0 net/ipv6/ip6_output.c:222
> > NF_HOOK_COND include/linux/netfilter.h:303 [inline]
> > ip6_output+0x270/0x594 net/ipv6/ip6_output.c:243
> > dst_output include/net/dst.h:450 [inline]
> > NF_HOOK+0x160/0x4f0 include/linux/netfilter.h:314
> > mld_sendpack+0x7b4/0x10f4 net/ipv6/mcast.c:1818
> > mld_send_cr net/ipv6/mcast.c:2119 [inline]
> > mld_ifc_work+0x840/0xd0c net/ipv6/mcast.c:2650
> > process_one_work+0x7b8/0x15d4 kernel/workqueue.c:3267
> > process_scheduled_works kernel/workqueue.c:3348 [inline]
> > worker_thread+0x938/0xef4 kernel/workqueue.c:3429
> > kthread+0x288/0x310 kernel/kthread.c:388
> > ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:860
> >
> > Fixes: 52539ca89f36 ("cfg80211: Expose TXQ stats and parameters to userspace")
> > Signed-off-by: Eric Dumazet <edumazet@google.com>
> > Signed-off-by: Toke Høiland-Jørgensen <toke@toke.dk>
>
> cfg80211 patches go to wireless tree, not net.
>
> --
> https://patchwork.kernel.org/project/linux-wireless/list/
>
> https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches
I used as usual for wifi paches :
git send-email \
--to "David S. Miller <davem@davemloft.net>" \
--to "Jakub Kicinski <kuba@kernel.org>" \
--to "Paolo Abeni <pabeni@redhat.com>" \
--cc "linux-wireless@vger.kernel.org" \
--to "Johannes Berg <johannes@sipsolutions.net>" \
--cc "netdev@vger.kernel.org" \
--cc "eric.dumazet@gmail.com" \
--validate \
0001-wifi-cfg80211-restrict-NL80211_ATTR_TXQ_QUANTUM-valu.patch
What did I miss ?
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [PATCH net] wifi: cfg80211: restrict NL80211_ATTR_TXQ_QUANTUM values
2024-06-19 9:07 ` Eric Dumazet
@ 2024-06-19 9:22 ` Eric Dumazet
0 siblings, 0 replies; 8+ messages in thread
From: Eric Dumazet @ 2024-06-19 9:22 UTC (permalink / raw)
To: Toke Høiland-Jørgensen
Cc: David S . Miller, Jakub Kicinski, Paolo Abeni, Johannes Berg,
linux-wireless, netdev, eric.dumazet
On Wed, Jun 19, 2024 at 11:07 AM Eric Dumazet <edumazet@google.com> wrote:
>
> On Mon, Jun 17, 2024 at 12:35 PM Toke Høiland-Jørgensen <toke@toke.dk> wrote:
> >
> > Eric Dumazet <edumazet@google.com> writes:
> >
> > > syzbot is able to trigger softlockups, setting NL80211_ATTR_TXQ_QUANTUM
> > > to 2^31.
> > >
> > > We had a similar issue in sch_fq, fixed with commit
> > > d9e15a273306 ("pkt_sched: fq: do not accept silly TCA_FQ_QUANTUM")
> > >
> > > watchdog: BUG: soft lockup - CPU#1 stuck for 26s! [kworker/1:0:24]
> > > Modules linked in:
> > > irq event stamp: 131135
> > > hardirqs last enabled at (131134): [<ffff80008ae8778c>] __exit_to_kernel_mode arch/arm64/kernel/entry-common.c:85 [inline]
> > > hardirqs last enabled at (131134): [<ffff80008ae8778c>] exit_to_kernel_mode+0xdc/0x10c arch/arm64/kernel/entry-common.c:95
> > > hardirqs last disabled at (131135): [<ffff80008ae85378>] __el1_irq arch/arm64/kernel/entry-common.c:533 [inline]
> > > hardirqs last disabled at (131135): [<ffff80008ae85378>] el1_interrupt+0x24/0x68 arch/arm64/kernel/entry-common.c:551
> > > softirqs last enabled at (125892): [<ffff80008907e82c>] neigh_hh_init net/core/neighbour.c:1538 [inline]
> > > softirqs last enabled at (125892): [<ffff80008907e82c>] neigh_resolve_output+0x268/0x658 net/core/neighbour.c:1553
> > > softirqs last disabled at (125896): [<ffff80008904166c>] local_bh_disable+0x10/0x34 include/linux/bottom_half.h:19
> > > CPU: 1 PID: 24 Comm: kworker/1:0 Not tainted 6.9.0-rc7-syzkaller-gfda5695d692c #0
> > > Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024
> > > Workqueue: mld mld_ifc_work
> > > pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
> > > pc : __list_del include/linux/list.h:195 [inline]
> > > pc : __list_del_entry include/linux/list.h:218 [inline]
> > > pc : list_move_tail include/linux/list.h:310 [inline]
> > > pc : fq_tin_dequeue include/net/fq_impl.h:112 [inline]
> > > pc : ieee80211_tx_dequeue+0x6b8/0x3b4c net/mac80211/tx.c:3854
> > > lr : __list_del_entry include/linux/list.h:218 [inline]
> > > lr : list_move_tail include/linux/list.h:310 [inline]
> > > lr : fq_tin_dequeue include/net/fq_impl.h:112 [inline]
> > > lr : ieee80211_tx_dequeue+0x67c/0x3b4c net/mac80211/tx.c:3854
> > > sp : ffff800093d36700
> > > x29: ffff800093d36a60 x28: ffff800093d36960 x27: dfff800000000000
> > > x26: ffff0000d800ad50 x25: ffff0000d800abe0 x24: ffff0000d800abf0
> > > x23: ffff0000e0032468 x22: ffff0000e00324d4 x21: ffff0000d800abf0
> > > x20: ffff0000d800abf8 x19: ffff0000d800abf0 x18: ffff800093d363c0
> > > x17: 000000000000d476 x16: ffff8000805519dc x15: ffff7000127a6cc8
> > > x14: 1ffff000127a6cc8 x13: 0000000000000004 x12: ffffffffffffffff
> > > x11: ffff7000127a6cc8 x10: 0000000000ff0100 x9 : 0000000000000000
> > > x8 : 0000000000000000 x7 : 0000000000000000 x6 : 0000000000000000
> > > x5 : ffff80009287aa08 x4 : 0000000000000008 x3 : ffff80008034c7fc
> > > x2 : ffff0000e0032468 x1 : 00000000da0e46b8 x0 : ffff0000e0032470
> > > Call trace:
> > > __list_del include/linux/list.h:195 [inline]
> > > __list_del_entry include/linux/list.h:218 [inline]
> > > list_move_tail include/linux/list.h:310 [inline]
> > > fq_tin_dequeue include/net/fq_impl.h:112 [inline]
> > > ieee80211_tx_dequeue+0x6b8/0x3b4c net/mac80211/tx.c:3854
> > > wake_tx_push_queue net/mac80211/util.c:294 [inline]
> > > ieee80211_handle_wake_tx_queue+0x118/0x274 net/mac80211/util.c:315
> > > drv_wake_tx_queue net/mac80211/driver-ops.h:1350 [inline]
> > > schedule_and_wake_txq net/mac80211/driver-ops.h:1357 [inline]
> > > ieee80211_queue_skb+0x18e8/0x2244 net/mac80211/tx.c:1664
> > > ieee80211_tx+0x260/0x400 net/mac80211/tx.c:1966
> > > ieee80211_xmit+0x278/0x354 net/mac80211/tx.c:2062
> > > __ieee80211_subif_start_xmit+0xab8/0x122c net/mac80211/tx.c:4338
> > > ieee80211_subif_start_xmit+0xe0/0x438 net/mac80211/tx.c:4532
> > > __netdev_start_xmit include/linux/netdevice.h:4903 [inline]
> > > netdev_start_xmit include/linux/netdevice.h:4917 [inline]
> > > xmit_one net/core/dev.c:3531 [inline]
> > > dev_hard_start_xmit+0x27c/0x938 net/core/dev.c:3547
> > > __dev_queue_xmit+0x1678/0x33fc net/core/dev.c:4341
> > > dev_queue_xmit include/linux/netdevice.h:3091 [inline]
> > > neigh_resolve_output+0x558/0x658 net/core/neighbour.c:1563
> > > neigh_output include/net/neighbour.h:542 [inline]
> > > ip6_finish_output2+0x104c/0x1ee8 net/ipv6/ip6_output.c:137
> > > ip6_finish_output+0x428/0x7a0 net/ipv6/ip6_output.c:222
> > > NF_HOOK_COND include/linux/netfilter.h:303 [inline]
> > > ip6_output+0x270/0x594 net/ipv6/ip6_output.c:243
> > > dst_output include/net/dst.h:450 [inline]
> > > NF_HOOK+0x160/0x4f0 include/linux/netfilter.h:314
> > > mld_sendpack+0x7b4/0x10f4 net/ipv6/mcast.c:1818
> > > mld_send_cr net/ipv6/mcast.c:2119 [inline]
> > > mld_ifc_work+0x840/0xd0c net/ipv6/mcast.c:2650
> > > process_one_work+0x7b8/0x15d4 kernel/workqueue.c:3267
> > > process_scheduled_works kernel/workqueue.c:3348 [inline]
> > > worker_thread+0x938/0xef4 kernel/workqueue.c:3429
> > > kthread+0x288/0x310 kernel/kthread.c:388
> > > ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:860
> > >
> > > Fixes: 52539ca89f36 ("cfg80211: Expose TXQ stats and parameters to userspace")
> > > Signed-off-by: Eric Dumazet <edumazet@google.com>
> > > Signed-off-by: Toke Høiland-Jørgensen <toke@toke.dk>
> >
> > Hmm, extraneous s-o-b? :)
> >
> > > ---
> > > net/wireless/nl80211.c | 6 +++++-
> > > 1 file changed, 5 insertions(+), 1 deletion(-)
> > >
> > > diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
> > > index 3c0bca4238d357c01b6fe92bb0f2b2b8a2917725..72c7bf55858166b8fc12114f090bf085d652db6b 100644
> > > --- a/net/wireless/nl80211.c
> > > +++ b/net/wireless/nl80211.c
> > > @@ -468,6 +468,10 @@ static const struct netlink_range_validation nl80211_punct_bitmap_range = {
> > > .max = 0xffff,
> > > };
> > >
> > > +static const struct netlink_range_validation q_range = {
> > > + .max = INT_MAX,
> > > +};
> >
> > The corresponding fixes to sch_fq and fq_codel use a limit of 1<<20;
> > INT_MAX is a bit above that, won't that still lead to issues?
>
> What kind of issues do you envision ?
>
> I do not know what kind of aggregation level wireless will have in 2030.
BTW we also chose INT_MAX in this prior commit, for syzkaller sake.
commit 7041101ff6c3073fd8f2e99920f535b111c929cb
Author: Davide Caratti <dcaratti@redhat.com>
Date: Thu Apr 20 16:59:46 2023 +0200
net/sched: sch_fq: fix integer overflow of "credit"
I do not think precise value is important, this is only to avoid
potential infinite loops.
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [PATCH net] wifi: cfg80211: restrict NL80211_ATTR_TXQ_QUANTUM values
2024-06-19 9:10 ` Eric Dumazet
@ 2024-06-19 9:52 ` Kalle Valo
2024-06-19 9:56 ` Eric Dumazet
0 siblings, 1 reply; 8+ messages in thread
From: Kalle Valo @ 2024-06-19 9:52 UTC (permalink / raw)
To: Eric Dumazet
Cc: David S . Miller, Jakub Kicinski, Paolo Abeni, Johannes Berg,
linux-wireless, netdev, eric.dumazet,
Toke Høiland-Jørgensen
Eric Dumazet <edumazet@google.com> writes:
> On Mon, Jun 17, 2024 at 3:15 PM Kalle Valo <kvalo@kernel.org> wrote:
>
>>
>> Eric Dumazet <edumazet@google.com> writes:
>>
>> > syzbot is able to trigger softlockups, setting NL80211_ATTR_TXQ_QUANTUM
>> > to 2^31.
>> >
>> > We had a similar issue in sch_fq, fixed with commit
>> > d9e15a273306 ("pkt_sched: fq: do not accept silly TCA_FQ_QUANTUM")
>> >
>> > watchdog: BUG: soft lockup - CPU#1 stuck for 26s! [kworker/1:0:24]
>> > Modules linked in:
>> > irq event stamp: 131135
>> > hardirqs last enabled at (131134): [<ffff80008ae8778c>] __exit_to_kernel_mode arch/arm64/kernel/entry-common.c:85 [inline]
>> > hardirqs last enabled at (131134): [<ffff80008ae8778c>] exit_to_kernel_mode+0xdc/0x10c arch/arm64/kernel/entry-common.c:95
>> > hardirqs last disabled at (131135): [<ffff80008ae85378>] __el1_irq arch/arm64/kernel/entry-common.c:533 [inline]
>> > hardirqs last disabled at (131135): [<ffff80008ae85378>] el1_interrupt+0x24/0x68 arch/arm64/kernel/entry-common.c:551
>> > softirqs last enabled at (125892): [<ffff80008907e82c>] neigh_hh_init net/core/neighbour.c:1538 [inline]
>> > softirqs last enabled at (125892): [<ffff80008907e82c>] neigh_resolve_output+0x268/0x658 net/core/neighbour.c:1553
>> > softirqs last disabled at (125896): [<ffff80008904166c>] local_bh_disable+0x10/0x34 include/linux/bottom_half.h:19
>> > CPU: 1 PID: 24 Comm: kworker/1:0 Not tainted 6.9.0-rc7-syzkaller-gfda5695d692c #0
>> > Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024
>> > Workqueue: mld mld_ifc_work
>> > pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
>> > pc : __list_del include/linux/list.h:195 [inline]
>> > pc : __list_del_entry include/linux/list.h:218 [inline]
>> > pc : list_move_tail include/linux/list.h:310 [inline]
>> > pc : fq_tin_dequeue include/net/fq_impl.h:112 [inline]
>> > pc : ieee80211_tx_dequeue+0x6b8/0x3b4c net/mac80211/tx.c:3854
>> > lr : __list_del_entry include/linux/list.h:218 [inline]
>> > lr : list_move_tail include/linux/list.h:310 [inline]
>> > lr : fq_tin_dequeue include/net/fq_impl.h:112 [inline]
>> > lr : ieee80211_tx_dequeue+0x67c/0x3b4c net/mac80211/tx.c:3854
>> > sp : ffff800093d36700
>> > x29: ffff800093d36a60 x28: ffff800093d36960 x27: dfff800000000000
>> > x26: ffff0000d800ad50 x25: ffff0000d800abe0 x24: ffff0000d800abf0
>> > x23: ffff0000e0032468 x22: ffff0000e00324d4 x21: ffff0000d800abf0
>> > x20: ffff0000d800abf8 x19: ffff0000d800abf0 x18: ffff800093d363c0
>> > x17: 000000000000d476 x16: ffff8000805519dc x15: ffff7000127a6cc8
>> > x14: 1ffff000127a6cc8 x13: 0000000000000004 x12: ffffffffffffffff
>> > x11: ffff7000127a6cc8 x10: 0000000000ff0100 x9 : 0000000000000000
>> > x8 : 0000000000000000 x7 : 0000000000000000 x6 : 0000000000000000
>> > x5 : ffff80009287aa08 x4 : 0000000000000008 x3 : ffff80008034c7fc
>> > x2 : ffff0000e0032468 x1 : 00000000da0e46b8 x0 : ffff0000e0032470
>> > Call trace:
>> > __list_del include/linux/list.h:195 [inline]
>> > __list_del_entry include/linux/list.h:218 [inline]
>> > list_move_tail include/linux/list.h:310 [inline]
>> > fq_tin_dequeue include/net/fq_impl.h:112 [inline]
>> > ieee80211_tx_dequeue+0x6b8/0x3b4c net/mac80211/tx.c:3854
>> > wake_tx_push_queue net/mac80211/util.c:294 [inline]
>> > ieee80211_handle_wake_tx_queue+0x118/0x274 net/mac80211/util.c:315
>> > drv_wake_tx_queue net/mac80211/driver-ops.h:1350 [inline]
>> > schedule_and_wake_txq net/mac80211/driver-ops.h:1357 [inline]
>> > ieee80211_queue_skb+0x18e8/0x2244 net/mac80211/tx.c:1664
>> > ieee80211_tx+0x260/0x400 net/mac80211/tx.c:1966
>> > ieee80211_xmit+0x278/0x354 net/mac80211/tx.c:2062
>> > __ieee80211_subif_start_xmit+0xab8/0x122c net/mac80211/tx.c:4338
>> > ieee80211_subif_start_xmit+0xe0/0x438 net/mac80211/tx.c:4532
>> > __netdev_start_xmit include/linux/netdevice.h:4903 [inline]
>> > netdev_start_xmit include/linux/netdevice.h:4917 [inline]
>> > xmit_one net/core/dev.c:3531 [inline]
>> > dev_hard_start_xmit+0x27c/0x938 net/core/dev.c:3547
>> > __dev_queue_xmit+0x1678/0x33fc net/core/dev.c:4341
>> > dev_queue_xmit include/linux/netdevice.h:3091 [inline]
>> > neigh_resolve_output+0x558/0x658 net/core/neighbour.c:1563
>> > neigh_output include/net/neighbour.h:542 [inline]
>> > ip6_finish_output2+0x104c/0x1ee8 net/ipv6/ip6_output.c:137
>> > ip6_finish_output+0x428/0x7a0 net/ipv6/ip6_output.c:222
>> > NF_HOOK_COND include/linux/netfilter.h:303 [inline]
>> > ip6_output+0x270/0x594 net/ipv6/ip6_output.c:243
>> > dst_output include/net/dst.h:450 [inline]
>> > NF_HOOK+0x160/0x4f0 include/linux/netfilter.h:314
>> > mld_sendpack+0x7b4/0x10f4 net/ipv6/mcast.c:1818
>> > mld_send_cr net/ipv6/mcast.c:2119 [inline]
>> > mld_ifc_work+0x840/0xd0c net/ipv6/mcast.c:2650
>> > process_one_work+0x7b8/0x15d4 kernel/workqueue.c:3267
>> > process_scheduled_works kernel/workqueue.c:3348 [inline]
>> > worker_thread+0x938/0xef4 kernel/workqueue.c:3429
>> > kthread+0x288/0x310 kernel/kthread.c:388
>> > ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:860
>> >
>> > Fixes: 52539ca89f36 ("cfg80211: Expose TXQ stats and parameters to userspace")
>> > Signed-off-by: Eric Dumazet <edumazet@google.com>
>> > Signed-off-by: Toke Høiland-Jørgensen <toke@toke.dk>
>>
>> cfg80211 patches go to wireless tree, not net.
>>
>> --
>> https://patchwork.kernel.org/project/linux-wireless/list/
>>
>> https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches
>
>
> I used as usual for wifi paches :
>
> git send-email \
> --to "David S. Miller <davem@davemloft.net>" \
> --to "Jakub Kicinski <kuba@kernel.org>" \
> --to "Paolo Abeni <pabeni@redhat.com>" \
> --cc "linux-wireless@vger.kernel.org" \
> --to "Johannes Berg <johannes@sipsolutions.net>" \
> --cc "netdev@vger.kernel.org" \
> --cc "eric.dumazet@gmail.com" \
> --validate \
> 0001-wifi-cfg80211-restrict-NL80211_ATTR_TXQ_QUANTUM-valu.patch
>
>
> What did I miss ?
Just the tag in subject claims it's for the net tree:
Subject: [PATCH net] ...
Not a big deal, actually happens quite often. I just usually send a
reply to remind the net maintainers not take the patch :)
--
https://patchwork.kernel.org/project/linux-wireless/list/
https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [PATCH net] wifi: cfg80211: restrict NL80211_ATTR_TXQ_QUANTUM values
2024-06-19 9:52 ` Kalle Valo
@ 2024-06-19 9:56 ` Eric Dumazet
0 siblings, 0 replies; 8+ messages in thread
From: Eric Dumazet @ 2024-06-19 9:56 UTC (permalink / raw)
To: Kalle Valo
Cc: David S . Miller, Jakub Kicinski, Paolo Abeni, Johannes Berg,
linux-wireless, netdev, eric.dumazet,
Toke Høiland-Jørgensen
On Wed, Jun 19, 2024 at 11:52 AM Kalle Valo <kvalo@kernel.org> wrote:
>
> Just the tag in subject claims it's for the net tree:
>
> Subject: [PATCH net] ...
>
> Not a big deal, actually happens quite often. I just usually send a
> reply to remind the net maintainers not take the patch :)
>
I see, thanks. My scripts are mainly targeting net trees, that is why
we see net there :)
^ permalink raw reply [flat|nested] 8+ messages in thread
end of thread, other threads:[~2024-06-19 9:56 UTC | newest]
Thread overview: 8+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2024-06-15 16:08 [PATCH net] wifi: cfg80211: restrict NL80211_ATTR_TXQ_QUANTUM values Eric Dumazet
2024-06-17 10:35 ` Toke Høiland-Jørgensen
2024-06-19 9:07 ` Eric Dumazet
2024-06-19 9:22 ` Eric Dumazet
2024-06-17 13:15 ` Kalle Valo
2024-06-19 9:10 ` Eric Dumazet
2024-06-19 9:52 ` Kalle Valo
2024-06-19 9:56 ` Eric Dumazet
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).