lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <b12aebd3b89bc0b96e11fc83d67aa697dffeb99d.camel@intel.com>
Date: Wed, 17 Jul 2024 08:31:03 +0000
From: "Berg, Benjamin" <benjamin.berg@...el.com>
To: "rafael@...nel.org" <rafael@...nel.org>, "gregkh@...uxfoundation.org"
	<gregkh@...uxfoundation.org>, "linux-fsdevel@...r.kernel.org"
	<linux-fsdevel@...r.kernel.org>,
	"syzbot+d5dc2801166df6d34774@...kaller.appspotmail.com"
	<syzbot+d5dc2801166df6d34774@...kaller.appspotmail.com>,
	"gregory.greenman@...el.com" <gregory.greenman@...el.com>,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>, "Korenblit,
 Miriam Rachel" <miriam.rachel.korenblit@...el.com>, "netdev@...r.kernel.org"
	<netdev@...r.kernel.org>, "hdanton@...a.com" <hdanton@...a.com>, "Berg,
 Johannes" <johannes.berg@...el.com>, "syzkaller-bugs@...glegroups.com"
	<syzkaller-bugs@...glegroups.com>
Subject: Re: [syzbot] [fs?] KASAN: slab-use-after-free Read in lockref_get

Hi,

we assume in ieee80211_debugfs_recreate_netdev that there are no
stations, as their debugfs entries will be removed but not recreated.

In this case, ieee80211_debugfs_recreate_netdev is called because the
mac address is changed and we do have a station.

My hunch right now would be that we should prevent changing the mac
address while we have a valid station on the interface. But, we can
also recreate the station entries and maybe we should do that either
way to ensure we cannot get into this bad state.

Benjamin

On Tue, 2024-07-16 at 05:48 -0700, syzbot wrote:
> syzbot has bisected this issue to:
> 
> commit 0a3d898ee9a8303d5b3982b97ef0703919c3ea76
> Author: Benjamin Berg <benjamin.berg@...el.com>
> Date:   Wed Dec 20 02:38:01 2023 +0000
> 
>     wifi: mac80211: add/remove driver debugfs entries as appropriate
> 
> bisection log: 
> https://syzkaller.appspot.com/x/bisect.txt?x=150e3cf1980000
> start commit:   58f9416d413a Merge branch 'ice-support-to-dump-phy-
> config-..
> git tree:       net-next
> final oops:    
> https://syzkaller.appspot.com/x/report.txt?x=170e3cf1980000
> console output:
> https://syzkaller.appspot.com/x/log.txt?x=130e3cf1980000
> kernel config: 
> https://syzkaller.appspot.com/x/.config?x=db697e01efa9d1d7
> dashboard link:
> https://syzkaller.appspot.com/bug?extid=d5dc2801166df6d34774
> syz repro:     
> https://syzkaller.appspot.com/x/repro.syz?x=1658c7dd980000
> C reproducer:  
> https://syzkaller.appspot.com/x/repro.c?x=16ed24b5980000
> 
> Reported-by: syzbot+d5dc2801166df6d34774@...kaller.appspotmail.com
> Fixes: 0a3d898ee9a8 ("wifi: mac80211: add/remove driver debugfs
> entries as appropriate")
> 
> For information about bisection process see:
> https://goo.gl/tpsmEJ#bisection

Intel Deutschland GmbH
Registered Address: Am Campeon 10, 85579 Neubiberg, Germany
Tel: +49 89 99 8853-0, www.intel.de
Managing Directors: Sean Fennelly, Jeffrey Schneiderman, Tiffany Doon Silva
Chairperson of the Supervisory Board: Nicole Lau
Registered Office: Munich
Commercial Register: Amtsgericht Muenchen HRB 186928

Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ