linux-kernel - Re: [PATCH] mac80211: fix race in ieee80211_register

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Tue, 7 Apr 2020 12:12:54 +0530
From:   Sumit Garg <sumit.garg@...aro.org>
To:     Krishna Chaitanya <chaitanya.mgit@...il.com>,
        Johannes Berg <johannes@...solutions.net>
Cc:     Kalle Valo <kvalo@...eaurora.org>,
        linux-wireless <linux-wireless@...r.kernel.org>,
        "David S. Miller" <davem@...emloft.net>, kuba@...nel.org,
        netdev <netdev@...r.kernel.org>,
        Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
        Matthias-Peter Schöpfer 
        <matthias.schoepfer@...inx.io>,
        "Berg Philipp (HAU-EDS)" <Philipp.Berg@...bherr.com>,
        "Weitner Michael (HAU-EDS)" <Michael.Weitner@...bherr.com>,
        Daniel Thompson <daniel.thompson@...aro.org>,
        Loic Poulain <loic.poulain@...aro.org>, stable@...r.kernel.org
Subject: Re: [PATCH] mac80211: fix race in ieee80211_register_hw()

On Mon, 6 Apr 2020 at 23:39, Krishna Chaitanya <chaitanya.mgit@...il.com> wrote:
>
> On Mon, Apr 6, 2020 at 8:36 PM Johannes Berg <johannes@...solutions.net> wrote:
> >
> > On Mon, 2020-04-06 at 19:55 +0530, Krishna Chaitanya wrote:
> >
> > > > iw phy0 interface add wlan0 type station
> > > > ip link set wlan0 up
> > > Ah okay, got it, thanks. Very narrow window though :-) as the
> > > alloc_ordered_workqueue
> > > doesn't need RTNL and there is a long way to go to do if_add() from
> > > user and setup
> > > the driver for interrupts.
> >
> > True, I do wonder how this is hit. Maybe something with no preempt and a
> > uevent triggering things?

The crash is reproducible while working with iwd [1] which is
basically a wireless daemon. It can be started as "iwd.service" during
boot that can detect wiphy registration events and configure
interfaces. Have a look at this text [2] from iwd manager.

To have a simple reproducer, please have a look at this trigger script
[3] from Matthias in CC. With this script I am able to reproduce the
kernel crash with approx. frequency of 1/10 across reboots on
dragonboard 410c.

There is nothing special like no preempt.

[1] https://wiki.archlinux.org/index.php/Iwd
[2] https://git.kernel.org/pub/scm/network/wireless/iwd.git/tree/src/manager.c#n563
[3] https://github.com/DasRoteSkelett/meta-iwd/blob/master/recipes-trigger/trigger/trigger/trigger.sh

> Probably, it might be specific to the dragonboard410c configuration
>

As described above, it isn't specific to any dragonboard 410c
configuration and one should be able to reproduce it on other boards
too using iwd depending on how long it takes to start corresponding
wiphy device.

> > > Again depends on the driver though, it
> > > should properly handle
> > > pending ieee80211_register_hw() with start().
>
> > It could, but it'd be really tricky. Much better to fix mac80211.

+1

-Sumit

> Sure, anyways it is a good change.