netdev - Re: [syzbot] [fs?] KASAN: slab-use-after-free Read in lockref

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <b12aebd3b89bc0b96e11fc83d67aa697dffeb99d.camel@intel.com>
Date: Wed, 17 Jul 2024 08:31:03 +0000
From: "Berg, Benjamin" <benjamin.berg@...el.com>
To: "rafael@...nel.org" <rafael@...nel.org>, "gregkh@...uxfoundation.org"
	<gregkh@...uxfoundation.org>, "linux-fsdevel@...r.kernel.org"
	<linux-fsdevel@...r.kernel.org>,
	"syzbot+d5dc2801166df6d34774@...kaller.appspotmail.com"
	<syzbot+d5dc2801166df6d34774@...kaller.appspotmail.com>,
	"gregory.greenman@...el.com" <gregory.greenman@...el.com>,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>, "Korenblit,
 Miriam Rachel" <miriam.rachel.korenblit@...el.com>, "netdev@...r.kernel.org"
	<netdev@...r.kernel.org>, "hdanton@...a.com" <hdanton@...a.com>, "Berg,
 Johannes" <johannes.berg@...el.com>, "syzkaller-bugs@...glegroups.com"
	<syzkaller-bugs@...glegroups.com>
Subject: Re: [syzbot] [fs?] KASAN: slab-use-after-free Read in lockref_get

Hi,

we assume in ieee80211_debugfs_recreate_netdev that there are no
stations, as their debugfs entries will be removed but not recreated.

In this case, ieee80211_debugfs_recreate_netdev is called because the
mac address is changed and we do have a station.

My hunch right now would be that we should prevent changing the mac
address while we have a valid station on the interface. But, we can
also recreate the station entries and maybe we should do that either
way to ensure we cannot get into this bad state.

Benjamin

On Tue, 2024-07-16 at 05:48 -0700, syzbot wrote:
> syzbot has bisected this issue to:
> 
> commit 0a3d898ee9a8303d5b3982b97ef0703919c3ea76
> Author: Benjamin Berg <benjamin.berg@...el.com>
> Date:   Wed Dec 20 02:38:01 2023 +0000
> 
>     wifi: mac80211: add/remove driver debugfs entries as appropriate
> 
> bisection log: 
> https://syzkaller.appspot.com/x/bisect.txt?x=150e3cf1980000
> start commit:   58f9416d413a Merge branch 'ice-support-to-dump-phy-
> config-..
> git tree:       net-next
> final oops:    
> https://syzkaller.appspot.com/x/report.txt?x=170e3cf1980000
> console output:
> https://syzkaller.appspot.com/x/log.txt?x=130e3cf1980000
> kernel config: 
> https://syzkaller.appspot.com/x/.config?x=db697e01efa9d1d7
> dashboard link:
> https://syzkaller.appspot.com/bug?extid=d5dc2801166df6d34774
> syz repro:     
> https://syzkaller.appspot.com/x/repro.syz?x=1658c7dd980000
> C reproducer:  
> https://syzkaller.appspot.com/x/repro.c?x=16ed24b5980000
> 
> Reported-by: syzbot+d5dc2801166df6d34774@...kaller.appspotmail.com
> Fixes: 0a3d898ee9a8 ("wifi: mac80211: add/remove driver debugfs
> entries as appropriate")
> 
> For information about bisection process see:
> https://goo.gl/tpsmEJ#bisection

Intel Deutschland GmbH
Registered Address: Am Campeon 10, 85579 Neubiberg, Germany
Tel: +49 89 99 8853-0, www.intel.de
Managing Directors: Sean Fennelly, Jeffrey Schneiderman, Tiffany Doon Silva
Chairperson of the Supervisory Board: Nicole Lau
Registered Office: Munich
Commercial Register: Amtsgericht Muenchen HRB 186928