joy/android_kernel_sony_sdm845
Watch
1
Fork
You've already forked android_kernel_sony_sdm845
 0
Code Issues Pull requests Projects Releases Wiki Activity
android_kernel_sony_sdm845/net/mac80211
History
Repository files (latest commit first)
Filename Latest commit message Latest commit date
Linus Lüssing a3e733886b mac80211: mesh: fix discovery timer re-arming issue / crash 
commit e2d4a80f93fcfaf72e2e20daf6a28e39c3b90677 upstream.

On a non-forwarding 802.11s link between two fairly busy
neighboring nodes (iperf with -P 16 at ~850MBit/s TCP;
1733.3 MBit/s VHT-MCS 9 80MHz short GI VHT-NSS 4), so with
frequent PREQ retries, usually after around 30-40 seconds the
following crash would occur:

[ 1110.822428] Unable to handle kernel read from unreadable memory at virtual address 00000000
[ 1110.830786] Mem abort info:
[ 1110.833573]   Exception class = IABT (current EL), IL = 32 bits
[ 1110.839494]   SET = 0, FnV = 0
[ 1110.842546]   EA = 0, S1PTW = 0
[ 1110.845678] user pgtable: 4k pages, 48-bit VAs, pgd = ffff800076386000
[ 1110.852204] [0000000000000000] *pgd=00000000f6322003, *pud=00000000f62de003, *pmd=0000000000000000
[ 1110.861167] Internal error: Oops: 86000004 [#1] PREEMPT SMP
[ 1110.866730] Modules linked in: pppoe ppp_async batman_adv ath10k_pci ath10k_core ath pppox ppp_generic nf_conntrack_ipv6 mac80211 iptable_nat ipt_REJECT ipt_MASQUERADE cfg80211 xt_time xt_tcpudp xt_state xt_nat xt_multiport xt_mark xt_mac xt_limit xt_conntrack xt_comment xt_TCPMSS xt_REDIRECT xt_LOG xt_FLOWOFFLOAD slhc nf_reject_ipv4 nf_nat_redirect nf_nat_masquerade_ipv4 nf_conntrack_ipv4 nf_nat_ipv4 nf_nat nf_log_ipv4 nf_flow_table_hw nf_flow_table nf_defrag_ipv6 nf_defrag_ipv4 nf_conntrack_rtcache nf_conntrack iptable_mangle iptable_filter ip_tables crc_ccitt compat nf_log_ipv6 nf_log_common ip6table_mangle ip6table_filter ip6_tables ip6t_REJECT x_tables nf_reject_ipv6 usb_storage xhci_plat_hcd xhci_pci xhci_hcd dwc3 usbcore usb_common
[ 1110.932190] Process swapper/3 (pid: 0, stack limit = 0xffff0000090c8000)
[ 1110.938884] CPU: 3 PID: 0 Comm: swapper/3 Not tainted 4.14.162 #0
[ 1110.944965] Hardware name: LS1043A RGW Board (DT)
[ 1110.949658] task: ffff8000787a81c0 task.stack: ffff0000090c8000
[ 1110.955568] PC is at 0x0
[ 1110.958097] LR is at call_timer_fn.isra.27+0x24/0x78
[ 1110.963055] pc : [<0000000000000000>] lr : [<ffff0000080ff29c>] pstate: 00400145
[ 1110.970440] sp : ffff00000801be10
[ 1110.973744] x29: ffff00000801be10 x28: ffff000008bf7018
[ 1110.979047] x27: ffff000008bf87c8 x26: ffff000008c160c0
[ 1110.984352] x25: 0000000000000000 x24: 0000000000000000
[ 1110.989657] x23: dead000000000200 x22: 0000000000000000
[ 1110.994959] x21: 0000000000000000 x20: 0000000000000101
[ 1111.000262] x19: ffff8000787a81c0 x18: 0000000000000000
[ 1111.005565] x17: ffff0000089167b0 x16: 0000000000000058
[ 1111.010868] x15: ffff0000089167b0 x14: 0000000000000000
[ 1111.016172] x13: ffff000008916788 x12: 0000000000000040
[ 1111.021475] x11: ffff80007fda9af0 x10: 0000000000000001
[ 1111.026777] x9 : ffff00000801bea0 x8 : 0000000000000004
[ 1111.032080] x7 : 0000000000000000 x6 : ffff80007fda9aa8
[ 1111.037383] x5 : ffff00000801bea0 x4 : 0000000000000010
[ 1111.042685] x3 : ffff00000801be98 x2 : 0000000000000614
[ 1111.047988] x1 : 0000000000000000 x0 : 0000000000000000
[ 1111.053290] Call trace:
[ 1111.055728] Exception stack(0xffff00000801bcd0 to 0xffff00000801be10)
[ 1111.062158] bcc0:                                   0000000000000000 0000000000000000
[ 1111.069978] bce0: 0000000000000614 ffff00000801be98 0000000000000010 ffff00000801bea0
[ 1111.077798] bd00: ffff80007fda9aa8 0000000000000000 0000000000000004 ffff00000801bea0
[ 1111.085618] bd20: 0000000000000001 ffff80007fda9af0 0000000000000040 ffff000008916788
[ 1111.093437] bd40: 0000000000000000 ffff0000089167b0 0000000000000058 ffff0000089167b0
[ 1111.101256] bd60: 0000000000000000 ffff8000787a81c0 0000000000000101 0000000000000000
[ 1111.109075] bd80: 0000000000000000 dead000000000200 0000000000000000 0000000000000000
[ 1111.116895] bda0: ffff000008c160c0 ffff000008bf87c8 ffff000008bf7018 ffff00000801be10
[ 1111.124715] bdc0: ffff0000080ff29c ffff00000801be10 0000000000000000 0000000000400145
[ 1111.132534] bde0: ffff8000787a81c0 ffff00000801bde8 0000ffffffffffff 000001029eb19be8
[ 1111.140353] be00: ffff00000801be10 0000000000000000
[ 1111.145220] [<          (null)>]           (null)
[ 1111.149917] [<ffff0000080ff77c>] run_timer_softirq+0x184/0x398
[ 1111.155741] [<ffff000008081938>] __do_softirq+0x100/0x1fc
[ 1111.161130] [<ffff0000080a2e28>] irq_exit+0x80/0xd8
[ 1111.166002] [<ffff0000080ea708>] __handle_domain_irq+0x88/0xb0
[ 1111.171825] [<ffff000008081678>] gic_handle_irq+0x68/0xb0
[ 1111.177213] Exception stack(0xffff0000090cbe30 to 0xffff0000090cbf70)
[ 1111.183642] be20:                                   0000000000000020 0000000000000000
[ 1111.191461] be40: 0000000000000001 0000000000000000 00008000771af000 0000000000000000
[ 1111.199281] be60: ffff000008c95180 0000000000000000 ffff000008c19360 ffff0000090cbef0
[ 1111.207101] be80: 0000000000000810 0000000000000400 0000000000000098 ffff000000000000
[ 1111.214920] bea0: 0000000000000001 ffff0000089167b0 0000000000000000 ffff0000089167b0
[ 1111.222740] bec0: 0000000000000000 ffff000008c198e8 ffff000008bf7018 ffff000008c19000
[ 1111.230559] bee0: 0000000000000000 0000000000000000 ffff8000787a81c0 ffff000008018000
[ 1111.238380] bf00: ffff00000801c000 ffff00000913ba34 ffff8000787a81c0 ffff0000090cbf70
[ 1111.246199] bf20: ffff0000080857cc ffff0000090cbf70 ffff0000080857d0 0000000000400145
[ 1111.254020] bf40: ffff000008018000 ffff00000801c000 ffffffffffffffff ffff0000080fa574
[ 1111.261838] bf60: ffff0000090cbf70 ffff0000080857d0
[ 1111.266706] [<ffff0000080832e8>] el1_irq+0xe8/0x18c
[ 1111.271576] [<ffff0000080857d0>] arch_cpu_idle+0x10/0x18
[ 1111.276880] [<ffff0000080d7de4>] do_idle+0xec/0x1b8
[ 1111.281748] [<ffff0000080d8020>] cpu_startup_entry+0x20/0x28
[ 1111.287399] [<ffff00000808f81c>] secondary_start_kernel+0x104/0x110
[ 1111.293662] Code: bad PC value
[ 1111.296710] ---[ end trace 555b6ca4363c3edd ]---
[ 1111.301318] Kernel panic - not syncing: Fatal exception in interrupt
[ 1111.307661] SMP: stopping secondary CPUs
[ 1111.311574] Kernel Offset: disabled
[ 1111.315053] CPU features: 0x0002000
[ 1111.318530] Memory Limit: none
[ 1111.321575] Rebooting in 3 seconds..

With some added debug output / delays we were able to push the crash from
the timer callback runner into the callback function and by that shedding
some light on which object holding the timer gets corrupted:

[  401.720899] Unable to handle kernel read from unreadable memory at virtual address 00000868
[...]
[  402.335836] [<ffff0000088fafa4>] _raw_spin_lock_bh+0x14/0x48
[  402.341548] [<ffff000000dbe684>] mesh_path_timer+0x10c/0x248 [mac80211]
[  402.348154] [<ffff0000080ff29c>] call_timer_fn.isra.27+0x24/0x78
[  402.354150] [<ffff0000080ff77c>] run_timer_softirq+0x184/0x398
[  402.359974] [<ffff000008081938>] __do_softirq+0x100/0x1fc
[  402.365362] [<ffff0000080a2e28>] irq_exit+0x80/0xd8
[  402.370231] [<ffff0000080ea708>] __handle_domain_irq+0x88/0xb0
[  402.376053] [<ffff000008081678>] gic_handle_irq+0x68/0xb0

The issue happens due to the following sequence of events:

1) mesh_path_start_discovery():
-> spin_unlock_bh(&mpath->state_lock) before mesh_path_sel_frame_tx()

2) mesh_path_free_rcu()
-> del_timer_sync(&mpath->timer)
   [...]
-> kfree_rcu(mpath)

3) mesh_path_start_discovery():
-> mod_timer(&mpath->timer, ...)
   [...]
-> rcu_read_unlock()

4) mesh_path_free_rcu()'s kfree_rcu():
-> kfree(mpath)

5) mesh_path_timer() starts after timeout, using freed mpath object

So a use-after-free issue due to a timer re-arming bug caused by an
early spin-unlocking.

This patch fixes this issue by re-checking if mpath is about to be
free'd and if so bails out of re-arming the timer.

Cc: stable@vger.kernel.org
Fixes: 050ac52cbe ("mac80211: code for on-demand Hybrid Wireless Mesh Protocol")
Cc: Simon Wunderlich <sw@simonwunderlich.de>
Signed-off-by: Linus Lüssing <ll@simonwunderlich.de>
Link: https://lore.kernel.org/r/20200522170413.14973-1-linus.luessing@c0d3.blue
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-06-03 08:16:43 +02:00
..
aes_ccm.c mac80211: move struct aead_req off the stack 2016-10-17 16:14:04 +02:00
aes_ccm.h mac80211: move struct aead_req off the stack 2016-10-17 16:14:04 +02:00
aes_cmac.c mac80211: remove ieee80211_aes_cmac_calculate_k1_k2() 2015-08-13 11:31:45 +02:00
aes_cmac.h
aes_gcm.c mac80211: move struct aead_req off the stack 2016-10-17 16:14:04 +02:00
aes_gcm.h mac80211: move struct aead_req off the stack 2016-10-17 16:14:04 +02:00
aes_gmac.c mac80211: move struct aead_req off the stack 2016-10-17 16:14:04 +02:00
aes_gmac.h mac80211: move struct aead_req off the stack 2016-10-17 16:14:04 +02:00
agg-rx.c mac80211: don't reorder frames with SN smaller than SSN 2017-03-15 10:02:47 +08:00
agg-tx.c mac80211: fix TX aggregation start/stop callback race 2018-11-10 07:42:47 -08:00
cfg.c mac80211: Do not send Layer 2 Update frame before authorization 2020-01-23 08:19:34 +01:00
chan.c mac80211: calculate min channel width correctly 2017-12-09 22:01:51 +01:00
debug.h
debugfs.c mac80211: Export fq memory limit information in debugfs 2016-09-30 13:29:31 +02:00
debugfs.h
debugfs_key.c mac80211: move TKIP TX IVs to public part of key struct 2016-02-24 09:04:38 +01:00
debugfs_key.h
debugfs_netdev.c mac80211: fix txq null pointer dereference 2019-10-29 09:15:03 +01:00
debugfs_netdev.h
debugfs_sta.c mac80211: fix tid_agg_rx NULL dereference 2017-01-12 11:39:23 +01:00
debugfs_sta.h
driver-ops.c mac80211: don't warn about CW params when not using them 2019-08-25 10:51:23 +02:00
driver-ops.h mac80211: do not call driver wake_tx_queue op during reconfig 2019-04-27 09:34:45 +02:00
ethtool.c mac80211: move station statistics into sub-structs 2015-10-21 10:08:22 +02:00
ht.c mac80211: fix TX aggregation start/stop callback race 2018-11-10 07:42:47 -08:00
ibss.c mac80211: shorten the IBSS debug messages 2018-10-10 08:53:20 +02:00
ieee80211_i.h mac80211: handle deauthentication/disassociation from TDLS peer 2019-10-05 12:30:09 +02:00
iface.c mac80211: Fix kernel panic due to use of txq after free 2019-05-25 18:26:55 +02:00
Kconfig mac80211: use DECLARE_EWMA 2015-08-14 17:49:53 +02:00
key.c mac80211: restrict delayed tailroom needed decrement 2018-09-26 08:36:33 +02:00
key.h mac80211: move TKIP TX IVs to public part of key struct 2016-02-24 09:04:38 +01:00
led.c mac80211: fix throughput LED trigger 2015-05-11 19:16:04 +02:00
led.h mac80211: make LED triggering depend on activation 2015-05-05 14:21:56 +02:00
main.c mac80211: fix a race between restart and CSA flows 2018-10-10 08:53:19 +02:00
Makefile mac80211: remove event.c 2015-10-14 18:40:26 +02:00
mesh.c mac80211: free peer keys before vif down in mesh 2019-07-21 09:05:52 +02:00
mesh.h mac80211: mesh: fix cleanup for mesh pathtable 2016-04-05 21:34:53 +02:00
mesh_hwmp.c mac80211: mesh: fix discovery timer re-arming issue / crash 2020-06-03 08:16:43 +02:00
mesh_pathtbl.c mac80211: fix unaligned access in mesh table hash function 2019-05-16 19:43:41 +02:00
mesh_plink.c mac80211: Fix possible sband related NULL pointer de-reference 2018-03-24 11:00:17 +01:00
mesh_ps.c mac80211: mesh: separate plid and aid concepts 2015-07-17 15:47:11 +02:00
mesh_sync.c mac80211: Remove invalid flag operations in mesh TSF synchronization 2017-11-30 08:39:13 +00:00
michael.c
michael.h
mlme.c mac80211: add ieee80211_is_any_nullfunc() 2020-05-10 10:28:03 +02:00
ocb.c mac80211: remove rx_stats.last_rx update after sta alloc 2016-04-06 13:18:15 +02:00
offchannel.c mac80211: flush hw_roc_start work before cancelling the ROC 2017-10-05 09:43:58 +02:00
pm.c mac80211: flush delayed work when entering suspend 2017-03-15 10:02:47 +08:00
rate.c mac80211: Fix clang warning about constant operand in logical operation 2018-04-08 12:12:46 +02:00
rate.h mac80211: remove sta_info debugfs sub-struct 2016-04-05 11:59:05 +02:00
rc80211_minstrel.c cfg80211: remove enum ieee80211_band 2016-04-12 15:56:15 +02:00
rc80211_minstrel.h mac80211: add standard deviation to Minstrel stats 2015-04-01 20:44:33 +02:00
rc80211_minstrel_debugfs.c mac80211: minstrel[_ht]: remove non-ascii debugfs characters 2015-09-29 15:56:47 +02:00
rc80211_minstrel_ht.c mac80211: minstrel_ht: fix per-group max throughput rate initialization 2020-01-29 10:24:30 +01:00
rc80211_minstrel_ht.h
rc80211_minstrel_ht_debugfs.c mac80211: minstrel[_ht]: remove non-ascii debugfs characters 2015-09-29 15:56:47 +02:00
rx.c mac80211: add ieee80211_is_any_nullfunc() 2020-05-10 10:28:03 +02:00
scan.c mac80211: fix scan completed tracing 2016-09-15 16:46:16 +02:00
spectmgmt.c mac80211: Do not disconnect on invalid operating class 2018-05-30 07:50:28 +02:00
sta_info.c mac80211: mark station unauthorized before key removal 2020-04-02 17:20:33 +02:00
sta_info.h mac80211: fix TX aggregation start/stop callback race 2018-11-10 07:42:47 -08:00
status.c mac80211: add ieee80211_is_any_nullfunc() 2020-05-10 10:28:03 +02:00
tdls.c mac80211: handle deauthentication/disassociation from TDLS peer 2019-10-05 12:30:09 +02:00
tkip.c mac80211: Fix TKIP replay protection immediately after key setup 2020-02-05 13:05:50 +00:00
tkip.h mac80211: move TKIP TX IVs to public part of key struct 2016-02-24 09:04:38 +01:00
trace.c mac80211: Move message tracepoints to their own header 2015-04-07 12:32:09 -04:00
trace.h mac80211: add offset_tsf driver op and use it for mesh 2016-09-30 13:45:44 +02:00
trace_msg.h mac80211: Move message tracepoints to their own header 2015-04-07 12:32:09 -04:00
tx.c mac80211: add ieee80211_is_any_nullfunc() 2020-05-10 10:28:03 +02:00
util.c mac80211: consider more elements in parsing CRC 2020-03-11 07:53:02 +01:00
vht.c mac80211: recalculate min channel width on VHT opmode changes 2017-07-05 14:40:24 +02:00
wep.c mac80211: Add RX flag to indicate ICV stripped 2018-01-17 09:38:49 +01:00
wep.h
wme.c
wme.h
wpa.c mac80211: Do not use stack memory with scatterlist for GMAC 2019-07-10 09:55:35 +02:00
wpa.h