[syzbot] [wireless?] WARNING: suspicious RCU usage in __cfg80211_bss_update

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: 954fb2d2d49f Merge branch 'remove-retired-tc-uapi'
git tree: net-next
console+strace: https://syzkaller.appspot.com/x/log.txt?x=16774b7ee80000
kernel config: https://syzkaller.appspot.com/x/.config?x=a4e9ca8e3c104d2a
dashboard link: https://syzkaller.appspot.com/bug?extid=864a269c27ee06b58374
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=15890ef9e80000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1764956ee80000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/4bca0ab1d263/disk-954fb2d2.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/d2766905a2c7/vmlinux-954fb2d2.xz
kernel image: https://storage.googleapis.com/syzbot-assets/d12ee4a13afb/bzImage-954fb2d2.xz

The issue was bisected to:

commit 32af9a9e1069e55bc02741fb00ac9d0ca1a2eaef
Author: Benjamin Berg <benjam...@intel.com>
Date: Wed Dec 20 11:41:41 2023 +0000

wifi: cfg80211: free beacon_ies when overridden from hidden BSS

bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=1496b32de80000
final oops: https://syzkaller.appspot.com/x/report.txt?x=1696b32de80000
console output: https://syzkaller.appspot.com/x/log.txt?x=1296b32de80000

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+864a26...@syzkaller.appspotmail.com
Fixes: 32af9a9e1069 ("wifi: cfg80211: free beacon_ies when overridden from hidden BSS")

wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
=============================
WARNING: suspicious RCU usage
6.7.0-rc6-syzkaller-01863-g954fb2d2d49f #0 Not tainted
-----------------------------
net/wireless/scan.c:1867 suspicious rcu_dereference_check() usage!

other info that might help us debug this:


rcu_scheduler_active = 2, debug_locks = 1
4 locks held by kworker/u4:2/35:
#0: ffff888013071938 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x789/0x15d0 kernel/workqueue.c:2602
#1: ffffc90000abfd80 ((work_completion)(&rdev->wiphy_work)){+.+.}-{0:0}, at: process_one_work+0x7eb/0x15d0 kernel/workqueue.c:2603
#2: ffff88807b0f8768 (&rdev->wiphy.mtx){+.+.}-{3:3}, at: wiphy_lock include/net/cfg80211.h:5928 [inline]
#2: ffff88807b0f8768 (&rdev->wiphy.mtx){+.+.}-{3:3}, at: cfg80211_wiphy_work+0x2b/0x330 net/wireless/core.c:424
#3: ffff88807b0f8168 (&rdev->bss_lock){+...}-{2:2}, at: spin_lock_bh include/linux/spinlock.h:356 [inline]
#3: ffff88807b0f8168 (&rdev->bss_lock){+...}-{2:2}, at: cfg80211_inform_single_bss_frame_data+0x8e4/0x12c0 net/wireless/scan.c:3014

stack backtrace:
CPU: 0 PID: 35 Comm: kworker/u4:2 Not tainted 6.7.0-rc6-syzkaller-01863-g954fb2d2d49f #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023
Workqueue: events_unbound cfg80211_wiphy_work
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x125/0x1b0 lib/dump_stack.c:106
lockdep_rcu_suspicious+0x20c/0x3b0 kernel/locking/lockdep.c:6712
__cfg80211_bss_update+0x17fb/0x25f0 net/wireless/scan.c:1867
cfg80211_inform_single_bss_frame_data+0x91e/0x12c0 net/wireless/scan.c:3015
cfg80211_inform_bss_frame_data+0x14c/0x340 net/wireless/scan.c:3050
__ieee80211_sta_join_ibss+0xcf3/0x1880 net/mac80211/ibss.c:376
ieee80211_sta_create_ibss+0x206/0x470 net/mac80211/ibss.c:1320
ieee80211_sta_find_ibss net/mac80211/ibss.c:1449 [inline]
ieee80211_ibss_work+0xbbb/0x14c0 net/mac80211/ibss.c:1666
ieee80211_iface_work+0xbeb/0xda0 net/mac80211/iface.c:1665
cfg80211_wiphy_work+0x24e/0x330 net/wireless/core.c:437
process_one_work+0x886/0x15d0 kernel/workqueue.c:2627
process_scheduled_works kernel/workqueue.c:2700 [inline]
worker_thread+0x8b9/0x1290 kernel/workqueue.c:2781
kthread+0x2c6/0x3a0 kernel/kthread.c:388
ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:242
</TASK>


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
For information about bisection process see: https://goo.gl/tpsmEJ#bisection

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

[Edward Adam Davis]

please test WARNING: suspicious RCU usage in __cfg80211_bss_update

#syz test https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next.git 954fb2d2d49f

diff --git a/net/wireless/scan.c b/net/wireless/scan.c
index cf2131671eb6..7cb8ae87c369 100644
--- a/net/wireless/scan.c
+++ b/net/wireless/scan.c
@@ -1864,7 +1864,7 @@ __cfg80211_bss_update(struct cfg80211_registered_device *rdev,
&hidden->hidden_list);
hidden->refcount++;

- ies = (void *)rcu_dereference(new->pub.beacon_ies);
+ ies = (void *)rcu_access_pointer(new->pub.beacon_ies);
rcu_assign_pointer(new->pub.beacon_ies,
hidden->pub.beacon_ies);
if (ies)

[syzbot]

Hello,

syzbot has tested the proposed patch and the reproducer did not trigger any issue:

Reported-and-tested-by: syzbot+864a26...@syzkaller.appspotmail.com

Tested on:

commit: 954fb2d2 Merge branch 'remove-retired-tc-uapi'
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next.git
console output: https://syzkaller.appspot.com/x/log.txt?x=172b1455e80000

kernel config: https://syzkaller.appspot.com/x/.config?x=a4e9ca8e3c104d2a
dashboard link: https://syzkaller.appspot.com/bug?extid=864a269c27ee06b58374
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40

patch: https://syzkaller.appspot.com/x/patch.diff?x=13efebc9e80000

Note: testing is done by a robot and is best-effort only.

[Edward Adam Davis]

Replace rcu_dereference() with rcu_access_pointer() to avoid warnings.

Fixes: 32af9a9e1069 ("wifi: cfg80211: free beacon_ies when overridden from hidden BSS")

Reported-and-tested-by: syzbot+864a26...@syzkaller.appspotmail.com
Signed-off-by: Edward Adam Davis <ead...@qq.com>
---
net/wireless/scan.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/wireless/scan.c b/net/wireless/scan.c
index cf2131671..7cb8ae87c 100644

--- a/net/wireless/scan.c
+++ b/net/wireless/scan.c
@@ -1864,7 +1864,7 @@ __cfg80211_bss_update(struct cfg80211_registered_device *rdev,
&hidden->hidden_list);
hidden->refcount++;

- ies = (void *)rcu_dereference(new->pub.beacon_ies);
+ ies = (void *)rcu_access_pointer(new->pub.beacon_ies);
rcu_assign_pointer(new->pub.beacon_ies,
hidden->pub.beacon_ies);
if (ies)

--
2.43.0