From: Siddh Raman Pant <code@siddh.me> To: Johannes Berg <johannes@sipsolutions.net>, "David S. Miller" <davem@davemloft.net>, Eric Dumazet <edumazet@google.com>, Jakub Kicinski <kuba@kernel.org>, Paolo Abeni <pabeni@redhat.com> Cc: linux-wireless <linux-wireless@vger.kernel.org>, netdev <netdev@vger.kernel.org>, linux-kernel <linux-kernel@vger.kernel.org>, linux-kernel-mentees <linux-kernel-mentees@lists.linuxfoundation.org>, syzbot+b6c9fe29aefe68e4ad34@syzkaller.appspotmail.com, stable@vger.kernel.org Subject: [PATCH] wifi: mac80211: Don't finalize CSA in IBSS mode if state is disconnected Date: Sun, 14 Aug 2022 20:45:12 +0530 [thread overview] Message-ID: <20220814151512.9985-1-code@siddh.me> (raw) When we are not connected to a channel, sending channel "switch" announcement doesn't make any sense. The BSS list is empty in that case. This causes the for loop in cfg80211_get_bss() to be bypassed, so the function returns NULL (check line 1424 of net/wireless/scan.c), causing the WARN_ON() in ieee80211_ibss_csa_beacon() to get triggered (check line 500 of net/mac80211/ibss.c), which was consequently reported on the syzkaller dashboard. Thus, check if we have an existing connection before generating the CSA beacon in ieee80211_ibss_finish_csa(). Fixes: cd7760e62c2a ("mac80211: add support for CSA in IBSS mode") Bug report: https://syzkaller.appspot.com/bug?id=05603ef4ae8926761b678d2939a3b2ad28ab9ca6 Reported-by: syzbot+b6c9fe29aefe68e4ad34@syzkaller.appspotmail.com Cc: stable@vger.kernel.org Signed-off-by: Siddh Raman Pant <code@siddh.me> --- The fixes commit is old, and syzkaller shows the problem exists for 4.19 and 4.14 as well, so CC'd stable list. net/mac80211/ibss.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/net/mac80211/ibss.c b/net/mac80211/ibss.c index d56890e3fabb..9b283bbc7bb4 100644 --- a/net/mac80211/ibss.c +++ b/net/mac80211/ibss.c @@ -530,6 +530,10 @@ int ieee80211_ibss_finish_csa(struct ieee80211_sub_if_data *sdata) sdata_assert_lock(sdata); + /* When not connected/joined, sending CSA doesn't make sense. */ + if (ifibss->state != IEEE80211_IBSS_MLME_JOINED) + return -ENOLINK; + /* update cfg80211 bss information with the new channel */ if (!is_zero_ether_addr(ifibss->bssid)) { cbss = cfg80211_get_bss(sdata->local->hw.wiphy, -- 2.35.1
WARNING: multiple messages have this Message-ID (diff)
From: Siddh Raman Pant via Linux-kernel-mentees <linux-kernel-mentees@lists.linuxfoundation.org> To: Johannes Berg <johannes@sipsolutions.net>, "David S. Miller" <davem@davemloft.net>, Eric Dumazet <edumazet@google.com>, Jakub Kicinski <kuba@kernel.org>, Paolo Abeni <pabeni@redhat.com> Cc: netdev <netdev@vger.kernel.org>, linux-wireless <linux-wireless@vger.kernel.org>, linux-kernel <linux-kernel@vger.kernel.org>, stable@vger.kernel.org, linux-kernel-mentees <linux-kernel-mentees@lists.linuxfoundation.org>, syzbot+b6c9fe29aefe68e4ad34@syzkaller.appspotmail.com Subject: [PATCH] wifi: mac80211: Don't finalize CSA in IBSS mode if state is disconnected Date: Sun, 14 Aug 2022 20:45:12 +0530 [thread overview] Message-ID: <20220814151512.9985-1-code@siddh.me> (raw) When we are not connected to a channel, sending channel "switch" announcement doesn't make any sense. The BSS list is empty in that case. This causes the for loop in cfg80211_get_bss() to be bypassed, so the function returns NULL (check line 1424 of net/wireless/scan.c), causing the WARN_ON() in ieee80211_ibss_csa_beacon() to get triggered (check line 500 of net/mac80211/ibss.c), which was consequently reported on the syzkaller dashboard. Thus, check if we have an existing connection before generating the CSA beacon in ieee80211_ibss_finish_csa(). Fixes: cd7760e62c2a ("mac80211: add support for CSA in IBSS mode") Bug report: https://syzkaller.appspot.com/bug?id=05603ef4ae8926761b678d2939a3b2ad28ab9ca6 Reported-by: syzbot+b6c9fe29aefe68e4ad34@syzkaller.appspotmail.com Cc: stable@vger.kernel.org Signed-off-by: Siddh Raman Pant <code@siddh.me> --- The fixes commit is old, and syzkaller shows the problem exists for 4.19 and 4.14 as well, so CC'd stable list. net/mac80211/ibss.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/net/mac80211/ibss.c b/net/mac80211/ibss.c index d56890e3fabb..9b283bbc7bb4 100644 --- a/net/mac80211/ibss.c +++ b/net/mac80211/ibss.c @@ -530,6 +530,10 @@ int ieee80211_ibss_finish_csa(struct ieee80211_sub_if_data *sdata) sdata_assert_lock(sdata); + /* When not connected/joined, sending CSA doesn't make sense. */ + if (ifibss->state != IEEE80211_IBSS_MLME_JOINED) + return -ENOLINK; + /* update cfg80211 bss information with the new channel */ if (!is_zero_ether_addr(ifibss->bssid)) { cbss = cfg80211_get_bss(sdata->local->hw.wiphy, -- 2.35.1 _______________________________________________ Linux-kernel-mentees mailing list Linux-kernel-mentees@lists.linuxfoundation.org https://lists.linuxfoundation.org/mailman/listinfo/linux-kernel-mentees
next reply other threads:[~2022-08-14 15:16 UTC|newest] Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top 2022-08-14 15:15 Siddh Raman Pant [this message] 2022-08-14 15:15 ` [PATCH] wifi: mac80211: Don't finalize CSA in IBSS mode if state is disconnected Siddh Raman Pant via Linux-kernel-mentees 2022-08-15 7:00 ` Greg KH 2022-08-15 7:00 ` Greg KH 2022-08-15 7:24 ` Siddh Raman Pant 2022-08-15 7:24 ` Siddh Raman Pant via Linux-kernel-mentees 2022-08-24 20:11 ` Siddh Raman Pant 2022-08-24 20:11 ` Siddh Raman Pant via Linux-kernel-mentees
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=20220814151512.9985-1-code@siddh.me \ --to=code@siddh.me \ --cc=davem@davemloft.net \ --cc=edumazet@google.com \ --cc=johannes@sipsolutions.net \ --cc=kuba@kernel.org \ --cc=linux-kernel-mentees@lists.linuxfoundation.org \ --cc=linux-kernel@vger.kernel.org \ --cc=linux-wireless@vger.kernel.org \ --cc=netdev@vger.kernel.org \ --cc=pabeni@redhat.com \ --cc=stable@vger.kernel.org \ --cc=syzbot+b6c9fe29aefe68e4ad34@syzkaller.appspotmail.com \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.