linux-kernel - Re: [regression] mt76x2u: NULL pointer dereference since recent change to fix chanctx emulation for monitor mode

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <852b737f-c158-4bb4-b5de-7b7d3d1d5331@gmx.de>
Date: Thu, 25 Jul 2024 18:00:06 +0200
From: ZeroBeat <ZeroBeat@....de>
To: Lorenzo Bianconi <lorenzo@...nel.org>
Cc: Johannes Berg <johannes@...solutions.net>,
 Linux regressions mailing list <regressions@...ts.linux.dev>,
 Felix Fietkau <nbd@....name>, Ryder Lee <ryder.lee@...iatek.com>,
 "linux-wireless@...r.kernel.org" <linux-wireless@...r.kernel.org>,
 LKML <linux-kernel@...r.kernel.org>, Kalle Valo <kvalo@...nel.org>
Subject: Re: [regression] mt76x2u: NULL pointer dereference since recent
 change to fix chanctx emulation for monitor mode

I've added several debug printk - no luck, yet.

Regards
Mike


Am 25.07.24 um 17:57 schrieb Lorenzo Bianconi:
>> Just to mention it here. The regression has now reached the longterm kernel:
>> affected devices: mt76 series (not affected mt7601u)
>>
>>
>> before update:
>> $ uname -r
>> 6.6.40-2-lts
>>
>> $ sudo hcxdumptool -i wlp5s0f4u2 --rcascan=active
>> ^C
>> 38 Packet(s) captured by kernel
>> 0 Packet(s) dropped by kernel
>> 14 PROBERESPONSE(s) captured
>>
>> exit on sigterm
>>
>>
>>
>> after update:
>> $ uname -r
>> 6.6.41-1-lts
>>
>> $ sudo hcxdumptool -i wlp48s0f4u2u1 --rcascan=active
>> ^C
>> 0 Packet(s) captured by kernel
>> 0 Packet(s) dropped by kernel
>> Warning: too less packets received (monitor mode may not work as expected)
>> Possible reasons:
>>   no transmitter in range
>>   frames are filtered out by BPF
>>   driver is broken
>> Warning: no PROBERESPONSES received (frame injection may not work as expected)
>> Possible reasons:
>>   no AP in range
>>   frames are filtered out by BPF
>>   driver is broken
>>   driver does not support frame injection
>>
>> exit on sigterm
>>
>>
>> Best regards
>> Mike
> 
> Hi,
> 
> I am looking into it. I will get back to you.
> 
> Regards,
> Lorenzo
> 
>>
>>
>>
>>
>>
>>
>> Am 24.07.24 um 10:47 schrieb Johannes Berg:
>>> On Wed, 2024-07-24 at 09:58 +0200, Linux regression tracking (Thorsten
>>> Leemhuis) wrote:
>>>> Hi, Thorsten here, the Linux kernel's regression tracker.
>>>>
>>>> Johannes, Felix, Lorenzo, Ryder, I noticed a report about a regression
>>>> in bugzilla.kernel.org that (for my untrained eyes) appears to be a bug
>>>> in some code paths of mt76x2u that was exposed by 0d9c2beed116e6 ("wifi:
>>>> mac80211: fix monitor channel with chanctx emulation") [v6.10-rc5,
>>>> v6.9.7] from Johannes.
>>>>
>>>> As many (most?) kernel developers don't keep an eye on the bug tracker,
>>>> I decided to write this mail. To quote from
>>>> https://bugzilla.kernel.org/show_bug.cgi?id=219086 :
>>>>
>>>>>    Michael 2024-07-23 15:38:43 UTC
>>>>>
>>>>> After a user opened this discussion:
>>>>> https://github.com/ZerBea/hcxdumptool/discussions/465
>>>>>
>>>>> Jul 21 05:40:39 rpi4b-aarch kernel: mt76x2u 2-2:1.0 wlan1: entered promiscuous mode
>>>>> Jul 21 05:40:45 rpi4b-aarch kernel: Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000
>>>>> Jul 21 05:40:45 rpi4b-aarch kernel: Mem abort info:
>>>>> Jul 21 05:40:45 rpi4b-aarch kernel:   ESR = 0x0000000096000044
>>>>> Jul 21 05:40:45 rpi4b-aarch kernel:   EC = 0x25: DABT (current EL), IL = 32 bits
>>>>> Jul 21 05:40:45 rpi4b-aarch kernel:   SET = 0, FnV = 0
>>>>> Jul 21 05:40:45 rpi4b-aarch kernel:   EA = 0, S1PTW = 0
>>>>> Jul 21 05:40:45 rpi4b-aarch kernel:   FSC = 0x04: level 0 translation fault
>>>>> Jul 21 05:40:45 rpi4b-aarch kernel: Data abort info:
>>>>> Jul 21 05:40:45 rpi4b-aarch kernel:   ISV = 0, ISS = 0x00000044, ISS2 = 0x00000000
>>>>> Jul 21 05:40:45 rpi4b-aarch kernel:   CM = 0, WnR = 1, TnD = 0, TagAccess = 0
>>>>> Jul 21 05:40:45 rpi4b-aarch kernel:   GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
>>>>> Jul 21 05:40:45 rpi4b-aarch kernel: user pgtable: 4k pages, 48-bit VAs, pgdp=0000000041300000
>>>>>
>>>
>>> Not too well-versed with ARM, does that tel me anything about where in
>>> the code the crash was? Without any further information I don't think I
>>> can see anything here, and I don't have an affected device.
>>>
>>> johannes
> 
> 
> 
> 
> 

Download attachment "OpenPGP_0x375516A45DB88630.asc" of type "application/pgp-keys" (1677 bytes)

Download attachment "OpenPGP_signature.asc" of type "application/pgp-signature" (496 bytes)