wifi: mac80211: Don't finalize CSA in IBSS mode if state is disconnected
Subsystems (4)
PATCH 1/1 wifi: mac80211: Don't finalize CSA in IBSS mode if state is disconnected
When we are not connected to a channel, sending channel "switch" announcement doesn't make any sense.
The BSS list is empty in that case. This causes the for loop in cfg80211_get_bss() to be bypassed, so the function returns NULL (check line 1424 of net/wireless/scan.c), causing the WARN_ON() in ieee80211_ibss_csa_beacon() to get triggered (check line 500 of net/mac80211/ibss.c), which was consequently reported on the syzkaller dashboard.
Thus, check if we have an existing connection before generating the CSA beacon in ieee80211_ibss_finish_csa().
Bug report: https://syzkaller.appspot.com/bug?id=05603ef4ae8926761b678d2939a3b2ad28ab9ca6
---
The fixes commit is old, and syzkaller shows the problem exists for 4.19 and 4.14 as well, so CC'd stable list.
net/mac80211/ibss.c | 4 ++++ 1 file changed, 4 insertions(+)
net/mac80211/ibss.c +4 -0
@@ -530,6 +530,10 @@ int ieee80211_ibss_finish_csa(struct ieee80211_sub_if_data *sdata)sdata_assert_lock (sdata); +/* When not connected/joined, sending CSA doesn't make sense. */ +if (ifibss->state !=IEEE80211_IBSS_MLME_JOINED ) +return -ENOLINK ; +/* update cfg80211 bss information with the new channel */ if (!is_zero_ether_addr (ifibss->bssid)) { cbss = cfg80211_get_bss(sdata->local->hw.wiphy,
Signature · 7 lines
2.35.1 _______________________________________________ Linux-kernel-mentees mailing list [email protected] https://lists.linuxfoundation.org/mailman/listinfo/linux-kernel-mentees
Greg KH
maintainerQuoted 13 lines · Siddh Raman Pant via Linux-kernel-mentees
When we are not connected to a channel, sending channel "switch" announcement doesn't make any sense.
The BSS list is empty in that case. This causes the for loop in
cfg80211_get_bss()to be bypassed, so the function returns NULL (check line 1424 ofnet/wireless/scan.c), causing theWARN_ON()inieee80211_ibss_csa_beacon()to get triggered (check line 500 ofnet/mac80211/ibss.c), which was consequently reported on the syzkaller dashboard.Thus, check if we have an existing connection before generating the CSA beacon in
ieee80211_ibss_finish_csa().
Quoted 6 lines
Fixes cd7760e62c2a ("mac80211: add support for CSA in IBSS mode")Bug report: https://syzkaller.appspot.com/bug?id=05603ef4ae8926761b678d2939a3b2ad28ab9ca6
Reported-by [email protected]Signed-off-by Siddh Raman Pant <[email protected]>
Please no blank line before your signed-off-by line or the tools will not like it.
And did sysbot verify that this change solved the problem?
thanks,
greg k-h
_______________________________________________
Linux-kernel-mentees mailing list
[email protected]
https://lists.linuxfoundation.org/mailman/listinfo/linux-kernel-mentees
Quoted 2 lines · On Mon, 15 Aug 2022 12:30:13 +0530 Greg KH wrote:
Please no blank line before your signed-off-by line or the tools will not like it.
Oh okay, noted.
Quoted 1 line
And did sysbot verify that this change solved the problem?
Syzbot was failing to boot for reasons unrelated to the patch. I tried testing three times, and every time the boot was failing. It was taking more than 5 hours for syzbot to pick up the patch from pending state every time, so I now posted it.
You can look at the syzkaller group page here:
https://groups.google.com/g/syzkaller-bugs/c/bGZwWS4Q3ek/m/dQ3pdAVSAAAJ
(Pardon the atrocious HTML email at the end, I used a mobile app to email and forgot it doesn't send in plaintext.)
I have locally tested this with the reproducer syzbot gave.
Thanks,
Siddh
_______________________________________________
Linux-kernel-mentees mailing list
[email protected]
https://lists.linuxfoundation.org/mailman/listinfo/linux-kernel-mentees
Quoted 10 lines · On Sun, 14 Aug 2022 20:45:12 +0530 Siddh Raman Pant wrote:
When we are not connected to a channel, sending channel "switch" announcement doesn't make any sense.
The BSS list is empty in that case. This causes the for loop in
cfg80211_get_bss()to be bypassed, so the function returns NULL (check line 1424 ofnet/wireless/scan.c), causing theWARN_ON()inieee80211_ibss_csa_beacon()to get triggered (check line 500 ofnet/mac80211/ibss.c), which was consequently reported on the syzkaller dashboard.
Quoted 7 lines
Thus, check if we have an existing connection before generating the CSA beacon in
ieee80211_ibss_finish_csa().Fixes cd7760e62c2a ("mac80211: add support for CSA in IBSS mode")Bug report: https://syzkaller.appspot.com/bug?id=05603ef4ae8926761b678d2939a3b2ad28ab9ca6
Reported-by [email protected]
Syzbot is now booting properly and the test ran successfully.
Thanks,
Siddh
Quoted 25 lines
Signed-off-by Siddh Raman Pant <[email protected]>---
The fixes commit is old, and syzkaller shows the problem exists for 4.19 and 4.14 as well, so CC'd stable list.net/mac80211/ibss.c | 4 ++++ 1 file changed, 4 insertions(+)net/mac80211/ibss.c +4
-0@@ -530,6 +530,10 @@ int ieee80211_ibss_finish_csa(struct ieee80211_sub_if_data *sdata)sdata_assert_lock (sdata); +/* When not connected/joined, sending CSA doesn't make sense. */ +if (ifibss->state !=IEEE80211_IBSS_MLME_JOINED ) +return -ENOLINK ; +/* update cfg80211 bss information with the new channel */ if (!is_zero_ether_addr (ifibss->bssid)) { cbss = cfg80211_get_bss(sdata->local->hw.wiphy,Signature · 1 line
2.35.1
_______________________________________________
Linux-kernel-mentees mailing list
[email protected]
https://lists.linuxfoundation.org/mailman/listinfo/linux-kernel-mentees