[moderation] [wireless?] general protection fault in mac80211_hwsim_tx_frame_no_nl (2)
0 views
Skip to first unread message
syzbot
12:34 PM (23 minutes ago) 12:34 PM
to syzkaller-upst...@googlegroups.com
Hello,
syzbot found the following issue on:
HEAD commit: 7475ea8b5861 Linux 7.4-rc2
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=1092303d580000
kernel config: https://syzkaller.appspot.com/x/.config?x=1cf189394a856f11
dashboard link: https://syzkaller.appspot.com/bug?extid=87abc552a237461a0cdf
compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44
CC: [joha...@sipsolutions.net linux-...@vger.kernel.org linux-w...@vger.kernel.org net...@vger.kernel.org]
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/d900f083ada3/non_bootable_disk-7475ea8b.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/db4e8a9a4461/vmlinux-7475ea8b.xz
kernel image: https://storage.googleapis.com/syzbot-assets/2abcfcabee20/bzImage-7475ea8b.xz
AI-generated root cause summary:
In `mac80211_hwsim_tx_frame_no_nl`, the driver iterates over virtual radios
using `list_for_each_entry(data2, &hwsim_radios, list)` while holding
`hwsim_radio_lock`. During iteration, the `data2` pointer (held in `%r14`)
evaluated to `0xffffffffffffffff` (-1) due to list corruption of
`hwsim_radios.next` or an entry's `list.next`. When initializing `struct
tx_iter_data tx_iter_data = { .hw = data2->hw, ... }`, the kernel attempts to
dereference `data2->hw` at offset `0x18` (evaluating to address `0x17`),
triggering a KASAN null-ptr-deref / non-canonical GPF in softirq context.
full analysis: https://syzkaller.appspot.com/x/ai_root_cause?x=87abc552a237461a0cdf
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+87abc5...@syzkaller.appspotmail.com
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000002: 0000 [#1] SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017]
CPU: 3 UID: 0 PID: 8630 Comm: syz.5.514 Tainted: G L syzkaller #0 PREEMPT(full)
Tainted: [L]=SOFTLOCKUP
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
RIP: 0010:mac80211_hwsim_tx_frame_no_nl+0x856/0x1840 drivers/net/wireless/virtual/mac80211_hwsim_main.c:1974
Code: 0f 84 a4 04 00 00 e8 09 a4 94 fa 48 8b 04 24 49 8d 7e 18 4c 89 bc 24 98 00 00 00 48 89 84 24 a0 00 00 00 48 89 f8 48 c1 e8 03 <80> 3c 18 00 0f 85 43 0d 00 00 49 8b 46 18 4c 89 ac 24 b0 00 00 00
RSP: 0018:ffffc90000718b40 EFLAGS: 00010203
RAX: 0000000000000002 RBX: dffffc0000000000 RCX: 0000000000000102
RDX: ffff88802d7d0000 RSI: ffffffff8779dcf7 RDI: 0000000000000017
RBP: ffff88805acf32c0 R08: 0000000000000004 R09: 00000000ffffffff
R10: 0000000000000001 R11: 0000000000000001 R12: 00000000ffffffff
R13: ffff888026f57e00 R14: ffffffffffffffff R15: ffff88805acf3558
FS: 00007f3e550b56c0(0000) GS:ffff8880d4771000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000110c395fab CR3: 00000000293a2000 CR4: 0000000000352ef0
Call Trace:
<IRQ>
mac80211_hwsim_tx_frame+0x1b7/0x250 drivers/net/wireless/virtual/mac80211_hwsim_main.c:2440
__mac80211_hwsim_beacon_tx drivers/net/wireless/virtual/mac80211_hwsim_main.c:2453 [inline]
mac80211_hwsim_beacon_tx+0x56d/0xa00 drivers/net/wireless/virtual/mac80211_hwsim_main.c:2516
__iterate_interfaces+0x2e6/0x650 net/mac80211/util.c:775
ieee80211_iterate_active_interfaces_atomic+0x71/0x1b0 net/mac80211/util.c:811
mac80211_hwsim_beacon+0xe5/0x2a0 drivers/net/wireless/virtual/mac80211_hwsim_main.c:2548
__run_hrtimer kernel/time/hrtimer.c:2079 [inline]
__hrtimer_run_queues+0x448/0x9a0 kernel/time/hrtimer.c:2136
hrtimer_run_softirq+0x1ca/0x360 kernel/time/hrtimer.c:2153
handle_softirqs+0x216/0xa20 kernel/softirq.c:669
__do_softirq kernel/softirq.c:703 [inline]
invoke_softirq kernel/softirq.c:542 [inline]
__irq_exit_rcu+0x178/0x220 kernel/softirq.c:786
irq_exit_rcu+0x9/0x30 kernel/softirq.c:809
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline]
sysvec_apic_timer_interrupt+0xa3/0xc0 arch/x86/kernel/apic/apic.c:1062
</IRQ>
<TASK>
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674
RIP: 0010:__raw_spin_unlock_irq include/linux/spinlock_api_smp.h:220 [inline]
RIP: 0010:_raw_spin_unlock_irq+0x29/0x50 kernel/locking/spinlock.c:229
Code: 90 f3 0f 1e fa 53 48 8b 74 24 08 48 89 fb 48 83 c7 18 e8 7a fe f6 f5 48 89 df e8 02 55 f7 f5 e8 ed 69 24 f6 fb bf 01 00 00 00 <e8> 52 1b e6 f5 65 48 83 3d c1 82 c8 09 00 74 06 5b c3 cc cc cc cc
RSP: 0018:ffffc9000617fc28 EFLAGS: 00000206
RAX: 0000000000000393 RBX: ffffffff90cc4bc0 RCX: 0000000000000080
RDX: 0000000000000001 RSI: ffffffff8e629a5f RDI: 0000000000000001
RBP: 0000000000000060 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000000 R12: ffff888024d23000
R13: 0000000054b508cd R14: ffffffff8be3bfb0 R15: 0000000000000054
pci_user_write_config_dword+0x150/0x230 drivers/pci/access.c:278
proc_bus_pci_write+0x531/0x5e0 drivers/pci/proc.c:173
pde_write fs/proc/inode.c:330 [inline]
proc_reg_write+0x240/0x330 fs/proc/inode.c:342
vfs_write+0x2aa/0x1040 fs/read_write.c:685
ksys_write+0x12a/0x250 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
do_syscall_64+0x123/0x7b0 arch/x86/entry/syscall_64.c:89
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f3e5419fb19
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f3e550b5028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007f3e54426090 RCX: 00007f3e5419fb19
RDX: 000000000000007f RSI: 0000200000000200 RDI: 0000000000000008
RBP: 00007f3e54237b70 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f3e54426128 R14: 00007f3e54426090 R15: 00007ffd874ac108
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:mac80211_hwsim_tx_frame_no_nl+0x856/0x1840 drivers/net/wireless/virtual/mac80211_hwsim_main.c:1974
Code: 0f 84 a4 04 00 00 e8 09 a4 94 fa 48 8b 04 24 49 8d 7e 18 4c 89 bc 24 98 00 00 00 48 89 84 24 a0 00 00 00 48 89 f8 48 c1 e8 03 <80> 3c 18 00 0f 85 43 0d 00 00 49 8b 46 18 4c 89 ac 24 b0 00 00 00
RSP: 0018:ffffc90000718b40 EFLAGS: 00010203
RAX: 0000000000000002 RBX: dffffc0000000000 RCX: 0000000000000102
RDX: ffff88802d7d0000 RSI: ffffffff8779dcf7 RDI: 0000000000000017
RBP: ffff88805acf32c0 R08: 0000000000000004 R09: 00000000ffffffff
R10: 0000000000000001 R11: 0000000000000001 R12: 00000000ffffffff
R13: ffff888026f57e00 R14: ffffffffffffffff R15: ffff88805acf3558
FS: 00007f3e550b56c0(0000) GS:ffff8880d4771000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000110c395fab CR3: 00000000293a2000 CR4: 0000000000352ef0
----------------
Code disassembly (best guess):
0: 0f 84 a4 04 00 00 je 0x4aa
6: e8 09 a4 94 fa call 0xfa94a414
b: 48 8b 04 24 mov (%rsp),%rax
f: 49 8d 7e 18 lea 0x18(%r14),%rdi
13: 4c 89 bc 24 98 00 00 mov %r15,0x98(%rsp)
1a: 00
1b: 48 89 84 24 a0 00 00 mov %rax,0xa0(%rsp)
22: 00
23: 48 89 f8 mov %rdi,%rax
26: 48 c1 e8 03 shr $0x3,%rax
* 2a: 80 3c 18 00 cmpb $0x0,(%rax,%rbx,1) <-- trapping instruction
2e: 0f 85 43 0d 00 00 jne 0xd77
34: 49 8b 46 18 mov 0x18(%r14),%rax
38: 4c 89 ac 24 b0 00 00 mov %r13,0xb0(%rsp)
3f: 00
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
syzbot found the following issue on:
HEAD commit: 7475ea8b5861 Linux 7.4-rc2
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=1092303d580000
kernel config: https://syzkaller.appspot.com/x/.config?x=1cf189394a856f11
dashboard link: https://syzkaller.appspot.com/bug?extid=87abc552a237461a0cdf
compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44
CC: [joha...@sipsolutions.net linux-...@vger.kernel.org linux-w...@vger.kernel.org net...@vger.kernel.org]
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/d900f083ada3/non_bootable_disk-7475ea8b.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/db4e8a9a4461/vmlinux-7475ea8b.xz
kernel image: https://storage.googleapis.com/syzbot-assets/2abcfcabee20/bzImage-7475ea8b.xz
AI-generated root cause summary:
In `mac80211_hwsim_tx_frame_no_nl`, the driver iterates over virtual radios
using `list_for_each_entry(data2, &hwsim_radios, list)` while holding
`hwsim_radio_lock`. During iteration, the `data2` pointer (held in `%r14`)
evaluated to `0xffffffffffffffff` (-1) due to list corruption of
`hwsim_radios.next` or an entry's `list.next`. When initializing `struct
tx_iter_data tx_iter_data = { .hw = data2->hw, ... }`, the kernel attempts to
dereference `data2->hw` at offset `0x18` (evaluating to address `0x17`),
triggering a KASAN null-ptr-deref / non-canonical GPF in softirq context.
full analysis: https://syzkaller.appspot.com/x/ai_root_cause?x=87abc552a237461a0cdf
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+87abc5...@syzkaller.appspotmail.com
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000002: 0000 [#1] SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017]
CPU: 3 UID: 0 PID: 8630 Comm: syz.5.514 Tainted: G L syzkaller #0 PREEMPT(full)
Tainted: [L]=SOFTLOCKUP
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
RIP: 0010:mac80211_hwsim_tx_frame_no_nl+0x856/0x1840 drivers/net/wireless/virtual/mac80211_hwsim_main.c:1974
Code: 0f 84 a4 04 00 00 e8 09 a4 94 fa 48 8b 04 24 49 8d 7e 18 4c 89 bc 24 98 00 00 00 48 89 84 24 a0 00 00 00 48 89 f8 48 c1 e8 03 <80> 3c 18 00 0f 85 43 0d 00 00 49 8b 46 18 4c 89 ac 24 b0 00 00 00
RSP: 0018:ffffc90000718b40 EFLAGS: 00010203
RAX: 0000000000000002 RBX: dffffc0000000000 RCX: 0000000000000102
RDX: ffff88802d7d0000 RSI: ffffffff8779dcf7 RDI: 0000000000000017
RBP: ffff88805acf32c0 R08: 0000000000000004 R09: 00000000ffffffff
R10: 0000000000000001 R11: 0000000000000001 R12: 00000000ffffffff
R13: ffff888026f57e00 R14: ffffffffffffffff R15: ffff88805acf3558
FS: 00007f3e550b56c0(0000) GS:ffff8880d4771000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000110c395fab CR3: 00000000293a2000 CR4: 0000000000352ef0
Call Trace:
<IRQ>
mac80211_hwsim_tx_frame+0x1b7/0x250 drivers/net/wireless/virtual/mac80211_hwsim_main.c:2440
__mac80211_hwsim_beacon_tx drivers/net/wireless/virtual/mac80211_hwsim_main.c:2453 [inline]
mac80211_hwsim_beacon_tx+0x56d/0xa00 drivers/net/wireless/virtual/mac80211_hwsim_main.c:2516
__iterate_interfaces+0x2e6/0x650 net/mac80211/util.c:775
ieee80211_iterate_active_interfaces_atomic+0x71/0x1b0 net/mac80211/util.c:811
mac80211_hwsim_beacon+0xe5/0x2a0 drivers/net/wireless/virtual/mac80211_hwsim_main.c:2548
__run_hrtimer kernel/time/hrtimer.c:2079 [inline]
__hrtimer_run_queues+0x448/0x9a0 kernel/time/hrtimer.c:2136
hrtimer_run_softirq+0x1ca/0x360 kernel/time/hrtimer.c:2153
handle_softirqs+0x216/0xa20 kernel/softirq.c:669
__do_softirq kernel/softirq.c:703 [inline]
invoke_softirq kernel/softirq.c:542 [inline]
__irq_exit_rcu+0x178/0x220 kernel/softirq.c:786
irq_exit_rcu+0x9/0x30 kernel/softirq.c:809
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline]
sysvec_apic_timer_interrupt+0xa3/0xc0 arch/x86/kernel/apic/apic.c:1062
</IRQ>
<TASK>
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674
RIP: 0010:__raw_spin_unlock_irq include/linux/spinlock_api_smp.h:220 [inline]
RIP: 0010:_raw_spin_unlock_irq+0x29/0x50 kernel/locking/spinlock.c:229
Code: 90 f3 0f 1e fa 53 48 8b 74 24 08 48 89 fb 48 83 c7 18 e8 7a fe f6 f5 48 89 df e8 02 55 f7 f5 e8 ed 69 24 f6 fb bf 01 00 00 00 <e8> 52 1b e6 f5 65 48 83 3d c1 82 c8 09 00 74 06 5b c3 cc cc cc cc
RSP: 0018:ffffc9000617fc28 EFLAGS: 00000206
RAX: 0000000000000393 RBX: ffffffff90cc4bc0 RCX: 0000000000000080
RDX: 0000000000000001 RSI: ffffffff8e629a5f RDI: 0000000000000001
RBP: 0000000000000060 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000000 R12: ffff888024d23000
R13: 0000000054b508cd R14: ffffffff8be3bfb0 R15: 0000000000000054
pci_user_write_config_dword+0x150/0x230 drivers/pci/access.c:278
proc_bus_pci_write+0x531/0x5e0 drivers/pci/proc.c:173
pde_write fs/proc/inode.c:330 [inline]
proc_reg_write+0x240/0x330 fs/proc/inode.c:342
vfs_write+0x2aa/0x1040 fs/read_write.c:685
ksys_write+0x12a/0x250 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
do_syscall_64+0x123/0x7b0 arch/x86/entry/syscall_64.c:89
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f3e5419fb19
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f3e550b5028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007f3e54426090 RCX: 00007f3e5419fb19
RDX: 000000000000007f RSI: 0000200000000200 RDI: 0000000000000008
RBP: 00007f3e54237b70 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f3e54426128 R14: 00007f3e54426090 R15: 00007ffd874ac108
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:mac80211_hwsim_tx_frame_no_nl+0x856/0x1840 drivers/net/wireless/virtual/mac80211_hwsim_main.c:1974
Code: 0f 84 a4 04 00 00 e8 09 a4 94 fa 48 8b 04 24 49 8d 7e 18 4c 89 bc 24 98 00 00 00 48 89 84 24 a0 00 00 00 48 89 f8 48 c1 e8 03 <80> 3c 18 00 0f 85 43 0d 00 00 49 8b 46 18 4c 89 ac 24 b0 00 00 00
RSP: 0018:ffffc90000718b40 EFLAGS: 00010203
RAX: 0000000000000002 RBX: dffffc0000000000 RCX: 0000000000000102
RDX: ffff88802d7d0000 RSI: ffffffff8779dcf7 RDI: 0000000000000017
RBP: ffff88805acf32c0 R08: 0000000000000004 R09: 00000000ffffffff
R10: 0000000000000001 R11: 0000000000000001 R12: 00000000ffffffff
R13: ffff888026f57e00 R14: ffffffffffffffff R15: ffff88805acf3558
FS: 00007f3e550b56c0(0000) GS:ffff8880d4771000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000110c395fab CR3: 00000000293a2000 CR4: 0000000000352ef0
----------------
Code disassembly (best guess):
0: 0f 84 a4 04 00 00 je 0x4aa
6: e8 09 a4 94 fa call 0xfa94a414
b: 48 8b 04 24 mov (%rsp),%rax
f: 49 8d 7e 18 lea 0x18(%r14),%rdi
13: 4c 89 bc 24 98 00 00 mov %r15,0x98(%rsp)
1a: 00
1b: 48 89 84 24 a0 00 00 mov %rax,0xa0(%rsp)
22: 00
23: 48 89 f8 mov %rdi,%rax
26: 48 c1 e8 03 shr $0x3,%rax
* 2a: 80 3c 18 00 cmpb $0x0,(%rax,%rbx,1) <-- trapping instruction
2e: 0f 85 43 0d 00 00 jne 0xd77
34: 49 8b 46 18 mov 0x18(%r14),%rax
38: 4c 89 ac 24 b0 00 00 mov %r13,0xb0(%rsp)
3f: 00
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
Reply all
Reply to author
Forward
0 new messages