linux-kernel - Re: Divide error in minstrel_ht_get_tp

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Sat, 21 Aug 2021 14:19:00 +0200
From:   Willy Tarreau <w@....eu>
To:     Oleksandr Natalenko <oleksandr@...alenko.name>
Cc:     linux-kernel@...r.kernel.org, netdev@...r.kernel.org,
        linux-wireless@...r.kernel.org, Jakub Kicinski <kuba@...nel.org>,
        "David S. Miller" <davem@...emloft.net>,
        Johannes Berg <johannes@...solutions.net>,
        Felix Fietkau <nbd@....name>,
        Lorenzo Bianconi <lorenzo.bianconi83@...il.com>,
        Ryder Lee <ryder.lee@...iatek.com>,
        Kalle Valo <kvalo@...eaurora.org>
Subject: Re: Divide error in minstrel_ht_get_tp_avg()

On Sat, Aug 21, 2021 at 01:14:34PM +0200, Oleksandr Natalenko wrote:
> > > So, it seems `minstrel_ht_avg_ampdu_len()` can return 0, which is not
> > > really legitimate.
> > > 
> > > Looking at `minstrel_ht_avg_ampdu_len()`, I see the following:
> > > 
> > > ```
> > > 16:#define MINSTREL_SCALE  12
> > > ...
> > > 18:#define MINSTREL_TRUNC(val) ((val) >> MINSTREL_SCALE)
> > > ```
> > > 
> > > ```
> > > 
> > >  401 static unsigned int
> > >  402 minstrel_ht_avg_ampdu_len(struct minstrel_ht_sta *mi)
> > >  403 {
> > > 
> > > ...
> > > 
> > >  406     if (mi->avg_ampdu_len)
> > >  407         return MINSTREL_TRUNC(mi->avg_ampdu_len);
> > > 
> > > ```
> > > 
> > > So, likely, `mi->avg_ampdu_len` is non-zero, but it's too small, hence
> > > right bitshift makes it zero.
(...)
> I've also found out that this happens exactly at midnight, IOW, at 00:00:00. 
> Not every midnight, though.
> 
> Does it have something to do with timekeeping? This is strange, I wouldn't 
> expect kernel to act like that. Probably, some client sends malformed frame? 
> How to find out?

Well, in minstrel_ht_update_stats() at line 1006 avg_ampdu_len is
explicitly set to zero. And this seems to be called based on timing
criteria from minstrel_ht_tx_status() so this could confirm your
experience.  Thus there is some inconsistency there.

Willy