net/wireless/ibss.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
syzkaller got the following warning:
------------[ cut here ]------------
WARNING: CPU: 0 PID: 9992 at net/wireless/ibss.c:36 __cfg80211_ibss
This warning is the result of the race condition between the following
events:
event1 event2 event3
__ieee80211_sta_join_ibss() | |
creates new cgf80211_bss | |
structure. | |
Calls cfg80211_ibss_joined() | |
which will scheduled | |
new event_work. | |
ieee80211_ibss_disconnect() |
is called due to connection |
dropped/ibss leaves to |
remove cfg80211_bss structure. |
event_work starts.
__cfg80211_ibss_joined()
is called and WARNING is
detected due to
cfg80211_bss structure was
removed by event2.
It is a normal situation when connection is dropped during handshaking.
So it looks reasonable to replace WARN_ON() with warning message to
prevent false alarm.
Found by Linux Verification Center (linuxtesting.org) with syzkaller.
Fixes: 04a773ade068 ("cfg80211/nl80211: add IBSS API")
Signed-off-by: Vladislav Efanov <VEfanov@ispras.ru>
---
net/wireless/ibss.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/net/wireless/ibss.c b/net/wireless/ibss.c
index e6fdb0b8187d..93c8bee12bdf 100644
--- a/net/wireless/ibss.c
+++ b/net/wireless/ibss.c
@@ -34,8 +34,10 @@ void __cfg80211_ibss_joined(struct net_device *dev, const u8 *bssid,
bss = cfg80211_get_bss(wdev->wiphy, channel, bssid, NULL, 0,
IEEE80211_BSS_TYPE_IBSS, IEEE80211_PRIVACY_ANY);
- if (WARN_ON(!bss))
+ if (!bss) {
+ pr_warn("cfg80211: cfg80211_bss with bssid %s not found.\n", bssid);
return;
+ }
if (wdev->u.ibss.current_bss) {
cfg80211_unhold_bss(wdev->u.ibss.current_bss);
--
2.34.1On Thu, 2024-09-26 at 16:34 +0300, Vladislav Efanov wrote: > syzkaller got the following warning: > ------------[ cut here ]------------ > WARNING: CPU: 0 PID: 9992 at net/wireless/ibss.c:36 __cfg80211_ibss > > This warning is the result of the race condition between the following > events: > > event1 event2 event3 > __ieee80211_sta_join_ibss() | | > creates new cgf80211_bss | | > structure. | | > Calls cfg80211_ibss_joined() | | > which will scheduled | | > new event_work. | | > ieee80211_ibss_disconnect() | > is called due to connection | > dropped/ibss leaves to | > remove cfg80211_bss structure. | > event_work starts. > __cfg80211_ibss_joined() > Seems almost better though to solve it by removing the pending work when disconnecting? johannes
Vladislav Efanov <VEfanov@ispras.ru> writes:
> syzkaller got the following warning:
> ------------[ cut here ]------------
> WARNING: CPU: 0 PID: 9992 at net/wireless/ibss.c:36 __cfg80211_ibss
>
> This warning is the result of the race condition between the following
> events:
>
> event1 event2 event3
> __ieee80211_sta_join_ibss() | |
> creates new cgf80211_bss | |
> structure. | |
> Calls cfg80211_ibss_joined() | |
> which will scheduled | |
> new event_work. | |
> ieee80211_ibss_disconnect() |
> is called due to connection |
> dropped/ibss leaves to |
> remove cfg80211_bss structure. |
> event_work starts.
> __cfg80211_ibss_joined()
> is called and WARNING is
> detected due to
> cfg80211_bss structure was
> removed by event2.
>
> It is a normal situation when connection is dropped during handshaking.
> So it looks reasonable to replace WARN_ON() with warning message to
> prevent false alarm.
>
> Found by Linux Verification Center (linuxtesting.org) with syzkaller.
> Fixes: 04a773ade068 ("cfg80211/nl80211: add IBSS API")
> Signed-off-by: Vladislav Efanov <VEfanov@ispras.ru>
> ---
> net/wireless/ibss.c | 4 +++-
> 1 file changed, 3 insertions(+), 1 deletion(-)
>
> diff --git a/net/wireless/ibss.c b/net/wireless/ibss.c
> index e6fdb0b8187d..93c8bee12bdf 100644
> --- a/net/wireless/ibss.c
> +++ b/net/wireless/ibss.c
> @@ -34,8 +34,10 @@ void __cfg80211_ibss_joined(struct net_device *dev, const u8 *bssid,
> bss = cfg80211_get_bss(wdev->wiphy, channel, bssid, NULL, 0,
> IEEE80211_BSS_TYPE_IBSS, IEEE80211_PRIVACY_ANY);
>
> - if (WARN_ON(!bss))
> + if (!bss) {
> + pr_warn("cfg80211: cfg80211_bss with bssid %s not found.\n", bssid);
> return;
> + }
If it's a normal case (disclaimer: didn't investigate that) the warning
message could be more descriptive. I suspect the user is just confused
after seeing that.
Also 'wifi:' missing from subject.
--
https://patchwork.kernel.org/project/linux-wireless/list/
https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches
© 2016 - 2024 Red Hat, Inc.