netdev - Re: [mac80211] BUG_ON with current -git (4.8.0-11417-g24532f7)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <1476263106.5271.23.camel@sipsolutions.net>
Date:   Wed, 12 Oct 2016 11:05:06 +0200
From:   Johannes Berg <johannes@...solutions.net>
To:     Sergey Senozhatsky <sergey.senozhatsky@...il.com>
Cc:     Andy Lutomirski <luto@...nel.org>,
        "David S. Miller" <davem@...emloft.net>,
        linux-wireless@...r.kernel.org, netdev@...r.kernel.org,
        linux-kernel@...r.kernel.org,
        Sergey Senozhatsky <sergey.senozhatsky.work@...il.com>,
        linux-next@...r.kernel.org,
        Stephen Rothwell <sfr@...b.auug.org.au>,
        Herbert Xu <herbert@...dor.apana.org.au>
Subject: Re: [mac80211] BUG_ON with current -git (4.8.0-11417-g24532f7)

Hi,

Sorry - I meant to look into this yesterday but forgot.

> Andy, can this be related to CONFIG_VMAP_STACK?

I think it is.

> > current -git kills my system. 

Can you elaborate on how exactly it kills your system?

> > adding
> > 
> > 	if (!virt_addr_valid(&aad[2])) {
> > 		WARN_ON(1);
> > 		return -EINVAL;
> > 	}

That's pretty obviously false with VMAP_STACK, since the caller
(ieee80211_crypto_ccmp_decrypt) puts the aad on the stack. b_0 is also
on the stack, but maybe that doesn't matter.

Herbert, do you know what could cause this, and how we should fix it?

We can't really afford to do an allocation here, and we don't have
space in the skb (not even in skb->cb at that point), so if we really
have no way to continue using the stack we'd ... not sure, use a per-
CPU buffer perhaps.
We need 32 bytes for aad and 16 bytes for b_0, if that also can't be on
the stack any more.

johannes