linux-kernel - Re: [PATCH v1] wifi: mac80211_hwsim: fix race condition in pending packet

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CAE7E4g=TyS97hQi6Tjc_OSV29Loz_5pBhqxQbwMQAsskfYi_iw@mail.gmail.com>
Date:   Fri, 15 Jul 2022 10:53:26 +0900
From:   Jeongik Cha <jeongik@...gle.com>
To:     Guenter Roeck <linux@...ck-us.net>
Cc:     Johannes Berg <johannes@...solutions.net>,
        Kalle Valo <kvalo@...nel.org>,
        "David S. Miller" <davem@...emloft.net>,
        Eric Dumazet <edumazet@...gle.com>,
        Jakub Kicinski <kuba@...nel.org>,
        Paolo Abeni <pabeni@...hat.com>, adelva@...gle.com,
        kernel-team@...roid.com, jaeman@...gle.com,
        linux-wireless@...r.kernel.org, netdev@...r.kernel.org,
        linux-kernel@...r.kernel.org
Subject: Re: [PATCH v1] wifi: mac80211_hwsim: fix race condition in pending packet

On Fri, Jul 15, 2022 at 9:16 AM Guenter Roeck <linux@...ck-us.net> wrote:
>
> On Mon, Jul 04, 2022 at 05:43:54PM +0900, Jeongik Cha wrote:
> > A pending packet uses a cookie as an unique key, but it can be duplicated
> > because it didn't use atomic operators.
> >
> > And also, a pending packet can be null in hwsim_tx_info_frame_received_nl
> > due to race condition with mac80211_hwsim_stop.
> >
> > For this,
> >  * Use an atomic type and operator for a cookie
> >  * Add a lock around the loop for pending packets
> >
> > Signed-off-by: Jeongik Cha <jeongik@...gle.com>
>
> Building i386:allyesconfig ... failed
> --------------
> Error log:
>
> drivers/net/wireless/mac80211_hwsim.c: In function 'mac80211_hwsim_tx_frame_nl':
> drivers/net/wireless/mac80211_hwsim.c:1431:37: error: cast to pointer from integer of different size
>
> Also seen in other 32-bit builds.
>
> Bisect log attached.
>
> Guenter
>
> ---
> # bad: [37b355fdaf31ee18bda9a93c2a438dc1cbf57ec9] Add linux-next specific files for 20220714
> # good: [32346491ddf24599decca06190ebca03ff9de7f8] Linux 5.19-rc6
> git bisect start 'HEAD' 'v5.19-rc6'
> # bad: [6d30dd0872599b7004e26330fc2e476ad900e7f6] Merge branch 'drm-next' of git://git.freedesktop.org/git/drm/drm.git
> git bisect bad 6d30dd0872599b7004e26330fc2e476ad900e7f6
> # good: [6134a5c4db991084f2f7c2da6c6cf400e42e3a99] Merge branch 'docs-next' of git://git.lwn.net/linux.git
> git bisect good 6134a5c4db991084f2f7c2da6c6cf400e42e3a99
> # bad: [f6268862d21dc3233ced91b848a55b6dfa8d438b] Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next.git
> git bisect bad f6268862d21dc3233ced91b848a55b6dfa8d438b
> # good: [6d1ce9c03880c28a4a48f94d4a2dcb2e57c1b88e] net: phylink: fix SGMII inband autoneg enable
> git bisect good 6d1ce9c03880c28a4a48f94d4a2dcb2e57c1b88e
> # good: [480e10a33cdb7282f9ec91065fb624c0cd2f758f] Merge branch 'devfreq-next' of git://git.kernel.org/pub/scm/linux/kernel/git/chanwoo/linux.git
> git bisect good 480e10a33cdb7282f9ec91065fb624c0cd2f758f
> # good: [cfc6c2fcb686afdaea5bbca6f3dbb27815a23878] Merge branch 'phy-mxl-gpy-version-fix-and-improvements'
> git bisect good cfc6c2fcb686afdaea5bbca6f3dbb27815a23878
> # good: [8bc65d38ee466897a264c9e336fe21058818b1b1] wifi: nl80211: retrieve EHT related elements in AP mode
> git bisect good 8bc65d38ee466897a264c9e336fe21058818b1b1
> # good: [8f8df82f9cc2e76b48ba7cec3d08f4295e8f6ebb] Merge branch 'thermal/linux-next' of git://git.kernel.org/pub/scm/linux/kernel/git/thermal/linux.git
> git bisect good 8f8df82f9cc2e76b48ba7cec3d08f4295e8f6ebb
> # good: [2635d2a8d4664b665bc12e15eee88e9b1b40ae7b] IB: Fix spelling of 'writable'
> git bisect good 2635d2a8d4664b665bc12e15eee88e9b1b40ae7b
> # good: [c18bd03474a070e80fee20f0628fd0a6728c2475] Merge branch 'next' of git://git.kernel.org/pub/scm/linux/kernel/git/teigland/linux-dlm.git
> git bisect good c18bd03474a070e80fee20f0628fd0a6728c2475
> # good: [3c512307de4097aaaab3f4741c7a98fe88afa469] wifi: nl80211: fix sending link ID info of associated BSS
> git bisect good 3c512307de4097aaaab3f4741c7a98fe88afa469
> # bad: [736002fb6a09861c2663596011371884a8b7c0dd] Merge tag 'wireless-next-2022-07-13' of git://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless-next
> git bisect bad 736002fb6a09861c2663596011371884a8b7c0dd
> # good: [37babce9127f3145366a8f36334f24afa9a5d196] wifi: mac80211: Use the bitmap API to allocate bitmaps
> git bisect good 37babce9127f3145366a8f36334f24afa9a5d196
> # bad: [58b6259d820d63c2adf1c7541b54cce5a2ae6073] wifi: mac80211_hwsim: add back erroneously removed cast
> git bisect bad 58b6259d820d63c2adf1c7541b54cce5a2ae6073
> # bad: [4ee186fa7e40ae06ebbfbad77e249e3746e14114] wifi: mac80211_hwsim: fix race condition in pending packet
> git bisect bad 4ee186fa7e40ae06ebbfbad77e249e3746e14114
> # first bad commit: [4ee186fa7e40ae06ebbfbad77e249e3746e14114] wifi: mac80211_hwsim: fix race condition in pending packet

I think https://patchwork.kernel.org/project/linux-wireless/patch/20220713211645.0d320e00e5b6.Ida11d2308dbf999d8bb9b1c49aa6e73af8fd3d33@changeid/
is the fix for this.

Thanks,
Jeongik