| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Tue, 2 Mar 2021 11:14:46 -0700
From: Jens Axboe <axboe@...com>
To: <netdev@...r.kernel.org>, Luca Coelho <luciano.coelho@...el.com>
Subject: [PATCH] iwlwifi: ensure that DMI scan table is properly terminated
My laptop crashes at boot, and I ran the same kernel with KASAN enabled.
Turns out the DMI addition for iwlwifi is broken (and untested?), since
it doesn't properly terminate the scan table. Ensure that we do so.
==================================================================
BUG: KASAN: global-out-of-bounds in dmi_check_system+0x5a/0x70
Read of size 1 at addr ffffffffc16af750 by task NetworkManager/1913
CPU: 4 PID: 1913 Comm: NetworkManager Not tainted 5.12.0-rc1+ #10057
Hardware name: LENOVO 20THCTO1WW/20THCTO1WW, BIOS N2VET27W (1.12 ) 12/21/2020
Call Trace:
dump_stack+0x90/0xbe
print_address_description.constprop.0+0x1d/0x140
? dmi_check_system+0x5a/0x70
? dmi_check_system+0x5a/0x70
kasan_report.cold+0x7b/0xd4
? dmi_check_system+0x5a/0x70
__asan_load1+0x4d/0x50
dmi_check_system+0x5a/0x70
iwl_mvm_up+0x1360/0x1690 [iwlmvm]
? iwl_mvm_send_recovery_cmd+0x270/0x270 [iwlmvm]
? setup_object.isra.0+0x27/0xd0
? kasan_poison+0x20/0x50
? ___slab_alloc.constprop.0+0x483/0x5b0
? mempool_kmalloc+0x17/0x20
? ftrace_graph_ret_addr+0x2a/0xb0
? kasan_poison+0x3c/0x50
? cfg80211_iftype_allowed+0x2e/0x90 [cfg80211]
? __kasan_check_write+0x14/0x20
? mutex_lock+0x86/0xe0
? __mutex_lock_slowpath+0x20/0x20
__iwl_mvm_mac_start+0x49/0x290 [iwlmvm]
iwl_mvm_mac_start+0x37/0x50 [iwlmvm]
drv_start+0x73/0x1b0 [mac80211]
ieee80211_do_open+0x53e/0xf10 [mac80211]
? ieee80211_check_concurrent_iface+0x266/0x2e0 [mac80211]
ieee80211_open+0xb9/0x100 [mac80211]
__dev_open+0x1b8/0x280
? dev_set_rx_mode+0x40/0x40
__dev_change_flags+0x32f/0x3a0
? dev_set_allmulti+0x20/0x20
? is_bpf_text_address+0x24/0x30
? kernel_text_address+0xbb/0xd0
dev_change_flags+0x63/0xc0
do_setlink+0xb59/0x18c0
? rtnetlink_put_metrics+0x2e0/0x2e0
? stack_trace_consume_entry+0x90/0x90
? if6_seq_show+0xb0/0xb0
? kasan_save_stack+0x42/0x50
? kasan_save_stack+0x23/0x50
? kasan_set_track+0x20/0x30
? kasan_set_free_info+0x24/0x40
? __kasan_slab_free+0xea/0x120
? kfree+0x94/0x250
? memset+0x3c/0x50
? __nla_validate_parse+0xc1/0x12d0
? ____sys_sendmsg+0x430/0x450
? ___sys_sendmsg+0xf2/0x160
? __sys_sendmsg+0xc8/0x150
? __x64_sys_sendmsg+0x48/0x50
? do_syscall_64+0x32/0x80
? entry_SYSCALL_64_after_hwframe+0x44/0xae
? nla_get_range_signed+0x1c0/0x1c0
? nla_put_ifalias+0x86/0xf0
? __cgroup_bpf_run_filter_skb+0xc1/0x6f0
? memcpy+0x4e/0x60
? __kasan_check_read+0x11/0x20
__rtnl_newlink+0x905/0xde0
? ipv6_dev_get_saddr+0x4c0/0x4c0
? rtnl_setlink+0x250/0x250
? ftrace_graph_ret_addr+0x2a/0xb0
? entry_SYSCALL_64_after_hwframe+0x44/0xae
? bpf_ksym_find+0x94/0xe0
? __rcu_read_unlock+0x39/0x60
? is_bpf_text_address+0x24/0x30
? kernel_text_address+0xbb/0xd0
? __kernel_text_address+0x12/0x40
? unwind_get_return_address+0x36/0x50
? create_prof_cpu_mask+0x30/0x30
? arch_stack_walk+0x98/0xf0
? stack_trace_save+0x94/0xc0
? stack_trace_consume_entry+0x90/0x90
? arch_stack_walk+0x98/0xf0
? __kasan_kmalloc+0x81/0xa0
? kmem_cache_alloc_trace+0xf4/0x220
rtnl_newlink+0x55/0x80
rtnetlink_rcv_msg+0x22f/0x560
? __kasan_slab_alloc+0x5f/0x80
? rtnl_calcit.isra.0+0x1e0/0x1e0
? __x64_sys_sendmsg+0x48/0x50
? do_syscall_64+0x32/0x80
? entry_SYSCALL_64_after_hwframe+0x44/0xae
? kernel_text_address+0xbb/0xd0
? __kernel_text_address+0x12/0x40
? unwind_get_return_address+0x36/0x50
netlink_rcv_skb+0xe7/0x210
? rtnl_calcit.isra.0+0x1e0/0x1e0
? netlink_ack+0x580/0x580
? netlink_deliver_tap+0x68/0x3d0
rtnetlink_rcv+0x15/0x20
netlink_unicast+0x3a8/0x4f0
? netlink_attachskb+0x430/0x430
? __alloc_skb+0xd7/0x1e0
netlink_sendmsg+0x3ff/0x710
? __rcu_read_unlock+0x39/0x60
? netlink_unicast+0x4f0/0x4f0
? iovec_from_user+0x6c/0x170
? __import_iovec+0x137/0x1c0
? netlink_unicast+0x4f0/0x4f0
sock_sendmsg+0x74/0x80
____sys_sendmsg+0x430/0x450
? kernel_sendmsg+0x40/0x40
? do_recvmmsg+0x440/0x440
? kasan_save_stack+0x42/0x50
? kasan_save_stack+0x23/0x50
? kasan_record_aux_stack+0xac/0xc0
? call_rcu+0x5a/0x450
? __fput+0x1d7/0x3d0
? ____fput+0xe/0x10
___sys_sendmsg+0xf2/0x160
? sendmsg_copy_msghdr+0x120/0x120
? __kasan_check_write+0x14/0x20
? _raw_spin_lock+0x82/0xd0
? _raw_read_lock_irq+0x50/0x50
? __fget_files+0xce/0x110
? __fget_light+0x72/0x100
? __fdget+0x13/0x20
__sys_sendmsg+0xc8/0x150
? __sys_sendmsg_sock+0x20/0x20
? __kasan_check_read+0x11/0x20
? fpregs_assert_state_consistent+0x5a/0x70
__x64_sys_sendmsg+0x48/0x50
do_syscall_64+0x32/0x80
entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x7f752cc7312d
Code: 28 89 54 24 1c 48 89 74 24 10 89 7c 24 08 e8 ca ee ff ff 8b 54 24 1c 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 2f 44 89 c7 48 89 44 24 08 e8 fe ee ff ff 48
RSP: 002b:00007ffd1962bc70 EFLAGS: 00000293 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 000055e6574ba880 RCX: 00007f752cc7312d
RDX: 0000000000000000 RSI: 00007ffd1962bcc0 RDI: 000000000000000c
RBP: 00007ffd1962bcc0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000293 R12: 000055e6574ba880
R13: 00007ffd1962be78 R14: 00007ffd1962be6c R15: 0000000000000000
The buggy address belongs to the variable:
dmi_ppag_approved_list+0x570/0xffffffffffffde20 [iwlmvm]
Memory state around the buggy address:
ffffffffc16af600: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffffffffc16af680: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffffffffc16af700: 00 00 00 00 00 00 00 00 f9 f9 f9 f9 00 00 00 01
^
ffffffffc16af780: f9 f9 f9 f9 00 00 00 00 00 00 02 f9 f9 f9 f9 f9
ffffffffc16af800: 00 00 00 07 f9 f9 f9 f9 00 00 00 00 00 00 00 01
==================================================================
Fixes: a2ac0f48a07c ("iwlwifi: mvm: implement approved list for the PPAG feature")
Signed-off-by: Jens Axboe <axboe@...nel.dk>
---
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
index 15e2773ce7e7..71e5306bd695 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
@@ -1083,6 +1083,7 @@ static const struct dmi_system_id dmi_ppag_approved_list[] = {
DMI_MATCH(DMI_SYS_VENDOR, "ASUSTek COMPUTER INC."),
},
},
+ { },
};
static int iwl_mvm_ppag_init(struct iwl_mvm *mvm)
--
Jens Axboe
Powered by blists - more mailing lists