From: syzbot <syzbot+864a269c27ee06b58374@syzkaller.appspotmail.com>
To: benjamin.berg@intel.com, davem@davemloft.net,
edumazet@google.com, johannes.berg@intel.com,
johannes@sipsolutions.net, kuba@kernel.org,
linux-kernel@vger.kernel.org, linux-wireless@vger.kernel.org,
miriam.rachel.korenblit@intel.com, netdev@vger.kernel.org,
pabeni@redhat.com, syzkaller-bugs@googlegroups.com
Subject: [syzbot] [wireless?] WARNING: suspicious RCU usage in __cfg80211_bss_update
Date: Wed, 03 Jan 2024 03:04:36 -0800 [thread overview]
Message-ID: <0000000000009fa770060e089409@google.com> (raw)
Hello,
syzbot found the following issue on:
HEAD commit: 954fb2d2d49f Merge branch 'remove-retired-tc-uapi'
git tree: net-next
console+strace: https://syzkaller.appspot.com/x/log.txt?x=16774b7ee80000
kernel config: https://syzkaller.appspot.com/x/.config?x=a4e9ca8e3c104d2a
dashboard link: https://syzkaller.appspot.com/bug?extid=864a269c27ee06b58374
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=15890ef9e80000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1764956ee80000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/4bca0ab1d263/disk-954fb2d2.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/d2766905a2c7/vmlinux-954fb2d2.xz
kernel image: https://storage.googleapis.com/syzbot-assets/d12ee4a13afb/bzImage-954fb2d2.xz
The issue was bisected to:
commit 32af9a9e1069e55bc02741fb00ac9d0ca1a2eaef
Author: Benjamin Berg <benjamin.berg@intel.com>
Date: Wed Dec 20 11:41:41 2023 +0000
wifi: cfg80211: free beacon_ies when overridden from hidden BSS
bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=1496b32de80000
final oops: https://syzkaller.appspot.com/x/report.txt?x=1696b32de80000
console output: https://syzkaller.appspot.com/x/log.txt?x=1296b32de80000
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+864a269c27ee06b58374@syzkaller.appspotmail.com
Fixes: 32af9a9e1069 ("wifi: cfg80211: free beacon_ies when overridden from hidden BSS")
wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
=============================
WARNING: suspicious RCU usage
6.7.0-rc6-syzkaller-01863-g954fb2d2d49f #0 Not tainted
-----------------------------
net/wireless/scan.c:1867 suspicious rcu_dereference_check() usage!
other info that might help us debug this:
rcu_scheduler_active = 2, debug_locks = 1
4 locks held by kworker/u4:2/35:
#0: ffff888013071938 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x789/0x15d0 kernel/workqueue.c:2602
#1: ffffc90000abfd80 ((work_completion)(&rdev->wiphy_work)){+.+.}-{0:0}, at: process_one_work+0x7eb/0x15d0 kernel/workqueue.c:2603
#2: ffff88807b0f8768 (&rdev->wiphy.mtx){+.+.}-{3:3}, at: wiphy_lock include/net/cfg80211.h:5928 [inline]
#2: ffff88807b0f8768 (&rdev->wiphy.mtx){+.+.}-{3:3}, at: cfg80211_wiphy_work+0x2b/0x330 net/wireless/core.c:424
#3: ffff88807b0f8168 (&rdev->bss_lock){+...}-{2:2}, at: spin_lock_bh include/linux/spinlock.h:356 [inline]
#3: ffff88807b0f8168 (&rdev->bss_lock){+...}-{2:2}, at: cfg80211_inform_single_bss_frame_data+0x8e4/0x12c0 net/wireless/scan.c:3014
stack backtrace:
CPU: 0 PID: 35 Comm: kworker/u4:2 Not tainted 6.7.0-rc6-syzkaller-01863-g954fb2d2d49f #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023
Workqueue: events_unbound cfg80211_wiphy_work
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x125/0x1b0 lib/dump_stack.c:106
lockdep_rcu_suspicious+0x20c/0x3b0 kernel/locking/lockdep.c:6712
__cfg80211_bss_update+0x17fb/0x25f0 net/wireless/scan.c:1867
cfg80211_inform_single_bss_frame_data+0x91e/0x12c0 net/wireless/scan.c:3015
cfg80211_inform_bss_frame_data+0x14c/0x340 net/wireless/scan.c:3050
__ieee80211_sta_join_ibss+0xcf3/0x1880 net/mac80211/ibss.c:376
ieee80211_sta_create_ibss+0x206/0x470 net/mac80211/ibss.c:1320
ieee80211_sta_find_ibss net/mac80211/ibss.c:1449 [inline]
ieee80211_ibss_work+0xbbb/0x14c0 net/mac80211/ibss.c:1666
ieee80211_iface_work+0xbeb/0xda0 net/mac80211/iface.c:1665
cfg80211_wiphy_work+0x24e/0x330 net/wireless/core.c:437
process_one_work+0x886/0x15d0 kernel/workqueue.c:2627
process_scheduled_works kernel/workqueue.c:2700 [inline]
worker_thread+0x8b9/0x1290 kernel/workqueue.c:2781
kthread+0x2c6/0x3a0 kernel/kthread.c:388
ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:242
</TASK>
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
For information about bisection process see: https://goo.gl/tpsmEJ#bisection
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
next reply other threads:[~2024-01-03 11:04 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-01-03 11:04 syzbot [this message]
2024-01-03 11:33 ` [syzbot] [wireless?] WARNING: suspicious RCU usage in __cfg80211_bss_update Edward Adam Davis
2024-01-03 11:58 ` syzbot
2024-01-03 12:13 ` [PATCH net-next] wifi: fix warning " Edward Adam Davis
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=0000000000009fa770060e089409@google.com \
--to=syzbot+864a269c27ee06b58374@syzkaller.appspotmail.com \
--cc=benjamin.berg@intel.com \
--cc=davem@davemloft.net \
--cc=edumazet@google.com \
--cc=johannes.berg@intel.com \
--cc=johannes@sipsolutions.net \
--cc=kuba@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-wireless@vger.kernel.org \
--cc=miriam.rachel.korenblit@intel.com \
--cc=netdev@vger.kernel.org \
--cc=pabeni@redhat.com \
--cc=syzkaller-bugs@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.