| Message ID | 20240926133446.25445-1-VEfanov@ispras.ru (mailing list archive) |
|---|---|
| State | Awaiting Upstream |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | cfg80211: Convert WARN_ON() to warning message | expand |
Vladislav Efanov <VEfanov@ispras.ru> writes: > syzkaller got the following warning: > ------------[ cut here ]------------ > WARNING: CPU: 0 PID: 9992 at net/wireless/ibss.c:36 __cfg80211_ibss > > This warning is the result of the race condition between the following > events: > > event1 event2 event3 > __ieee80211_sta_join_ibss() | | > creates new cgf80211_bss | | > structure. | | > Calls cfg80211_ibss_joined() | | > which will scheduled | | > new event_work. | | > ieee80211_ibss_disconnect() | > is called due to connection | > dropped/ibss leaves to | > remove cfg80211_bss structure. | > event_work starts. > __cfg80211_ibss_joined() > is called and WARNING is > detected due to > cfg80211_bss structure was > removed by event2. > > It is a normal situation when connection is dropped during handshaking. > So it looks reasonable to replace WARN_ON() with warning message to > prevent false alarm. > > Found by Linux Verification Center (linuxtesting.org) with syzkaller. > Fixes: 04a773ade068 ("cfg80211/nl80211: add IBSS API") > Signed-off-by: Vladislav Efanov <VEfanov@ispras.ru> > --- > net/wireless/ibss.c | 4 +++- > 1 file changed, 3 insertions(+), 1 deletion(-) > > diff --git a/net/wireless/ibss.c b/net/wireless/ibss.c > index e6fdb0b8187d..93c8bee12bdf 100644 > --- a/net/wireless/ibss.c > +++ b/net/wireless/ibss.c > @@ -34,8 +34,10 @@ void __cfg80211_ibss_joined(struct net_device *dev, const u8 *bssid, > bss = cfg80211_get_bss(wdev->wiphy, channel, bssid, NULL, 0, > IEEE80211_BSS_TYPE_IBSS, IEEE80211_PRIVACY_ANY); > > - if (WARN_ON(!bss)) > + if (!bss) { > + pr_warn("cfg80211: cfg80211_bss with bssid %s not found.\n", bssid); > return; > + } If it's a normal case (disclaimer: didn't investigate that) the warning message could be more descriptive. I suspect the user is just confused after seeing that. Also 'wifi:' missing from subject.
On Thu, 2024-09-26 at 16:34 +0300, Vladislav Efanov wrote: > syzkaller got the following warning: > ------------[ cut here ]------------ > WARNING: CPU: 0 PID: 9992 at net/wireless/ibss.c:36 __cfg80211_ibss > > This warning is the result of the race condition between the following > events: > > event1 event2 event3 > __ieee80211_sta_join_ibss() | | > creates new cgf80211_bss | | > structure. | | > Calls cfg80211_ibss_joined() | | > which will scheduled | | > new event_work. | | > ieee80211_ibss_disconnect() | > is called due to connection | > dropped/ibss leaves to | > remove cfg80211_bss structure. | > event_work starts. > __cfg80211_ibss_joined() > Seems almost better though to solve it by removing the pending work when disconnecting? johannes
diff --git a/net/wireless/ibss.c b/net/wireless/ibss.c index e6fdb0b8187d..93c8bee12bdf 100644 --- a/net/wireless/ibss.c +++ b/net/wireless/ibss.c @@ -34,8 +34,10 @@ void __cfg80211_ibss_joined(struct net_device *dev, const u8 *bssid, bss = cfg80211_get_bss(wdev->wiphy, channel, bssid, NULL, 0, IEEE80211_BSS_TYPE_IBSS, IEEE80211_PRIVACY_ANY); - if (WARN_ON(!bss)) + if (!bss) { + pr_warn("cfg80211: cfg80211_bss with bssid %s not found.\n", bssid); return; + } if (wdev->u.ibss.current_bss) { cfg80211_unhold_bss(wdev->u.ibss.current_bss);
syzkaller got the following warning: ------------[ cut here ]------------ WARNING: CPU: 0 PID: 9992 at net/wireless/ibss.c:36 __cfg80211_ibss This warning is the result of the race condition between the following events: event1 event2 event3 __ieee80211_sta_join_ibss() | | creates new cgf80211_bss | | structure. | | Calls cfg80211_ibss_joined() | | which will scheduled | | new event_work. | | ieee80211_ibss_disconnect() | is called due to connection | dropped/ibss leaves to | remove cfg80211_bss structure. | event_work starts. __cfg80211_ibss_joined() is called and WARNING is detected due to cfg80211_bss structure was removed by event2. It is a normal situation when connection is dropped during handshaking. So it looks reasonable to replace WARN_ON() with warning message to prevent false alarm. Found by Linux Verification Center (linuxtesting.org) with syzkaller. Fixes: 04a773ade068 ("cfg80211/nl80211: add IBSS API") Signed-off-by: Vladislav Efanov <VEfanov@ispras.ru> --- net/wireless/ibss.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)