linux-kernel - Re: [PATCH] wifi: cfg80211: Lock wiphy in cfg80211_get

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Tue, 21 May 2024 09:01:08 +0200
From: "Nicolas Escande" <nico.escande@...il.com>
To: "Remi Pommarel" <repk@...plefau.lt>, "Johannes Berg"
 <johannes@...solutions.net>
Cc: "Antonio Quartulli" <antonio@...n-mesh.com>,
 <linux-wireless@...r.kernel.org>, <b.a.t.m.a.n@...ts.open-mesh.org>,
 <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH] wifi: cfg80211: Lock wiphy in cfg80211_get_station

On Sat May 18, 2024 at 5:50 PM CEST, Remi Pommarel wrote:
> Wiphy should be locked before calling rdev_get_station() (see lockdep
> assert in ieee80211_get_station()).
>
> This fixes the following kernel NULL dereference:
>
>  Unable to handle kernel NULL pointer dereference at virtual address 0000000000000050
>  Mem abort info:
>    ESR = 0x0000000096000006
>    EC = 0x25: DABT (current EL), IL = 32 bits
>    SET = 0, FnV = 0
>    EA = 0, S1PTW = 0
>    FSC = 0x06: level 2 translation fault
>  Data abort info:
>    ISV = 0, ISS = 0x00000006
>    CM = 0, WnR = 0
>  user pgtable: 4k pages, 48-bit VAs, pgdp=0000000003001000
>  [0000000000000050] pgd=0800000002dca003, p4d=0800000002dca003, pud=08000000028e9003, pmd=0000000000000000
>  Internal error: Oops: 0000000096000006 [#1] SMP
>  Modules linked in: netconsole dwc3_meson_g12a dwc3_of_simple dwc3 ip_gre gre ath10k_pci ath10k_core ath9k ath9k_common ath9k_hw ath
>  CPU: 0 PID: 1091 Comm: kworker/u8:0 Not tainted 6.4.0-02144-g565f9a3a7911-dirty #705
>  Hardware name: RPT (r1) (DT)
>  Workqueue: bat_events batadv_v_elp_throughput_metric_update
>  pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
>  pc : ath10k_sta_statistics+0x10/0x2dc [ath10k_core]
>  lr : sta_set_sinfo+0xcc/0xbd4
>  sp : ffff000007b43ad0
>  x29: ffff000007b43ad0 x28: ffff0000071fa900 x27: ffff00000294ca98
>  x26: ffff000006830880 x25: ffff000006830880 x24: ffff00000294c000
>  x23: 0000000000000001 x22: ffff000007b43c90 x21: ffff800008898acc
>  x20: ffff00000294c6e8 x19: ffff000007b43c90 x18: 0000000000000000
>  x17: 445946354d552d78 x16: 62661f7200000000 x15: 57464f445946354d
>  x14: 0000000000000000 x13: 00000000000000e3 x12: d5f0acbcebea978e
>  x11: 00000000000000e3 x10: 000000010048fe41 x9 : 0000000000000000
>  x8 : ffff000007b43d90 x7 : 000000007a1e2125 x6 : 0000000000000000
>  x5 : ffff0000024e0900 x4 : ffff800000a0250c x3 : ffff000007b43c90
>  x2 : ffff00000294ca98 x1 : ffff000006831920 x0 : 0000000000000000
>  Call trace:
>   ath10k_sta_statistics+0x10/0x2dc [ath10k_core]
>   sta_set_sinfo+0xcc/0xbd4
>   ieee80211_get_station+0x2c/0x44
>   cfg80211_get_station+0x80/0x154
>   batadv_v_elp_get_throughput+0x138/0x1fc
>   batadv_v_elp_throughput_metric_update+0x1c/0xa4
>   process_one_work+0x1ec/0x414
>   worker_thread+0x70/0x46c
>   kthread+0xdc/0xe0
>   ret_from_fork+0x10/0x20
>  Code: a9bb7bfd 910003fd a90153f3 f9411c40 (f9402814)
>
> Fixes: 7406353d43c8 ("cfg80211: implement cfg80211_get_station cfg80211 API")
> Signed-off-by: Remi Pommarel <repk@...plefau.lt>

Reviewed-by: Nicolas Escande <nico.escande@...il.com>