linux-kernel - Re: [PATCH v1] wifi: mac80211_hwsim: fix race condition in pending packet

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20220715001625.GA594816@roeck-us.net>
Date:   Thu, 14 Jul 2022 17:16:25 -0700
From:   Guenter Roeck <linux@...ck-us.net>
To:     Jeongik Cha <jeongik@...gle.com>
Cc:     Johannes Berg <johannes@...solutions.net>,
        Kalle Valo <kvalo@...nel.org>,
        "David S. Miller" <davem@...emloft.net>,
        Eric Dumazet <edumazet@...gle.com>,
        Jakub Kicinski <kuba@...nel.org>,
        Paolo Abeni <pabeni@...hat.com>, adelva@...gle.com,
        kernel-team@...roid.com, jaeman@...gle.com,
        linux-wireless@...r.kernel.org, netdev@...r.kernel.org,
        linux-kernel@...r.kernel.org
Subject: Re: [PATCH v1] wifi: mac80211_hwsim: fix race condition in pending
 packet

On Mon, Jul 04, 2022 at 05:43:54PM +0900, Jeongik Cha wrote:
> A pending packet uses a cookie as an unique key, but it can be duplicated
> because it didn't use atomic operators.
> 
> And also, a pending packet can be null in hwsim_tx_info_frame_received_nl
> due to race condition with mac80211_hwsim_stop.
> 
> For this,
>  * Use an atomic type and operator for a cookie
>  * Add a lock around the loop for pending packets
> 
> Signed-off-by: Jeongik Cha <jeongik@...gle.com>

Building i386:allyesconfig ... failed
--------------
Error log:

drivers/net/wireless/mac80211_hwsim.c: In function 'mac80211_hwsim_tx_frame_nl':
drivers/net/wireless/mac80211_hwsim.c:1431:37: error: cast to pointer from integer of different size

Also seen in other 32-bit builds.

Bisect log attached.

Guenter

---
# bad: [37b355fdaf31ee18bda9a93c2a438dc1cbf57ec9] Add linux-next specific files for 20220714
# good: [32346491ddf24599decca06190ebca03ff9de7f8] Linux 5.19-rc6
git bisect start 'HEAD' 'v5.19-rc6'
# bad: [6d30dd0872599b7004e26330fc2e476ad900e7f6] Merge branch 'drm-next' of git://git.freedesktop.org/git/drm/drm.git
git bisect bad 6d30dd0872599b7004e26330fc2e476ad900e7f6
# good: [6134a5c4db991084f2f7c2da6c6cf400e42e3a99] Merge branch 'docs-next' of git://git.lwn.net/linux.git
git bisect good 6134a5c4db991084f2f7c2da6c6cf400e42e3a99
# bad: [f6268862d21dc3233ced91b848a55b6dfa8d438b] Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next.git
git bisect bad f6268862d21dc3233ced91b848a55b6dfa8d438b
# good: [6d1ce9c03880c28a4a48f94d4a2dcb2e57c1b88e] net: phylink: fix SGMII inband autoneg enable
git bisect good 6d1ce9c03880c28a4a48f94d4a2dcb2e57c1b88e
# good: [480e10a33cdb7282f9ec91065fb624c0cd2f758f] Merge branch 'devfreq-next' of git://git.kernel.org/pub/scm/linux/kernel/git/chanwoo/linux.git
git bisect good 480e10a33cdb7282f9ec91065fb624c0cd2f758f
# good: [cfc6c2fcb686afdaea5bbca6f3dbb27815a23878] Merge branch 'phy-mxl-gpy-version-fix-and-improvements'
git bisect good cfc6c2fcb686afdaea5bbca6f3dbb27815a23878
# good: [8bc65d38ee466897a264c9e336fe21058818b1b1] wifi: nl80211: retrieve EHT related elements in AP mode
git bisect good 8bc65d38ee466897a264c9e336fe21058818b1b1
# good: [8f8df82f9cc2e76b48ba7cec3d08f4295e8f6ebb] Merge branch 'thermal/linux-next' of git://git.kernel.org/pub/scm/linux/kernel/git/thermal/linux.git
git bisect good 8f8df82f9cc2e76b48ba7cec3d08f4295e8f6ebb
# good: [2635d2a8d4664b665bc12e15eee88e9b1b40ae7b] IB: Fix spelling of 'writable'
git bisect good 2635d2a8d4664b665bc12e15eee88e9b1b40ae7b
# good: [c18bd03474a070e80fee20f0628fd0a6728c2475] Merge branch 'next' of git://git.kernel.org/pub/scm/linux/kernel/git/teigland/linux-dlm.git
git bisect good c18bd03474a070e80fee20f0628fd0a6728c2475
# good: [3c512307de4097aaaab3f4741c7a98fe88afa469] wifi: nl80211: fix sending link ID info of associated BSS
git bisect good 3c512307de4097aaaab3f4741c7a98fe88afa469
# bad: [736002fb6a09861c2663596011371884a8b7c0dd] Merge tag 'wireless-next-2022-07-13' of git://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless-next
git bisect bad 736002fb6a09861c2663596011371884a8b7c0dd
# good: [37babce9127f3145366a8f36334f24afa9a5d196] wifi: mac80211: Use the bitmap API to allocate bitmaps
git bisect good 37babce9127f3145366a8f36334f24afa9a5d196
# bad: [58b6259d820d63c2adf1c7541b54cce5a2ae6073] wifi: mac80211_hwsim: add back erroneously removed cast
git bisect bad 58b6259d820d63c2adf1c7541b54cce5a2ae6073
# bad: [4ee186fa7e40ae06ebbfbad77e249e3746e14114] wifi: mac80211_hwsim: fix race condition in pending packet
git bisect bad 4ee186fa7e40ae06ebbfbad77e249e3746e14114
# first bad commit: [4ee186fa7e40ae06ebbfbad77e249e3746e14114] wifi: mac80211_hwsim: fix race condition in pending packet