iwlwifi: ensure that DMI scan table is properly terminated

Commit Message

Jens Axboe March 2, 2021, 6:14 p.m. UTC

My laptop crashes at boot, and I ran the same kernel with KASAN enabled.
Turns out the DMI addition for iwlwifi is broken (and untested?), since
it doesn't properly terminate the scan table. Ensure that we do so.

==================================================================
BUG: KASAN: global-out-of-bounds in dmi_check_system+0x5a/0x70
Read of size 1 at addr ffffffffc16af750 by task NetworkManager/1913

CPU: 4 PID: 1913 Comm: NetworkManager Not tainted 5.12.0-rc1+ #10057
Hardware name: LENOVO 20THCTO1WW/20THCTO1WW, BIOS N2VET27W (1.12 ) 12/21/2020
Call Trace:
 dump_stack+0x90/0xbe
 print_address_description.constprop.0+0x1d/0x140
 ? dmi_check_system+0x5a/0x70
 ? dmi_check_system+0x5a/0x70
 kasan_report.cold+0x7b/0xd4
 ? dmi_check_system+0x5a/0x70
 __asan_load1+0x4d/0x50
 dmi_check_system+0x5a/0x70
 iwl_mvm_up+0x1360/0x1690 [iwlmvm]
 ? iwl_mvm_send_recovery_cmd+0x270/0x270 [iwlmvm]
 ? setup_object.isra.0+0x27/0xd0
 ? kasan_poison+0x20/0x50
 ? ___slab_alloc.constprop.0+0x483/0x5b0
 ? mempool_kmalloc+0x17/0x20
 ? ftrace_graph_ret_addr+0x2a/0xb0
 ? kasan_poison+0x3c/0x50
 ? cfg80211_iftype_allowed+0x2e/0x90 [cfg80211]
 ? __kasan_check_write+0x14/0x20
 ? mutex_lock+0x86/0xe0
 ? __mutex_lock_slowpath+0x20/0x20
 __iwl_mvm_mac_start+0x49/0x290 [iwlmvm]
 iwl_mvm_mac_start+0x37/0x50 [iwlmvm]
 drv_start+0x73/0x1b0 [mac80211]
 ieee80211_do_open+0x53e/0xf10 [mac80211]
 ? ieee80211_check_concurrent_iface+0x266/0x2e0 [mac80211]
 ieee80211_open+0xb9/0x100 [mac80211]
 __dev_open+0x1b8/0x280
 ? dev_set_rx_mode+0x40/0x40
 __dev_change_flags+0x32f/0x3a0
 ? dev_set_allmulti+0x20/0x20
 ? is_bpf_text_address+0x24/0x30
 ? kernel_text_address+0xbb/0xd0
 dev_change_flags+0x63/0xc0
 do_setlink+0xb59/0x18c0
 ? rtnetlink_put_metrics+0x2e0/0x2e0
 ? stack_trace_consume_entry+0x90/0x90
 ? if6_seq_show+0xb0/0xb0
 ? kasan_save_stack+0x42/0x50
 ? kasan_save_stack+0x23/0x50
 ? kasan_set_track+0x20/0x30
 ? kasan_set_free_info+0x24/0x40
 ? __kasan_slab_free+0xea/0x120
 ? kfree+0x94/0x250
 ? memset+0x3c/0x50
 ? __nla_validate_parse+0xc1/0x12d0
 ? ____sys_sendmsg+0x430/0x450
 ? ___sys_sendmsg+0xf2/0x160
 ? __sys_sendmsg+0xc8/0x150
 ? __x64_sys_sendmsg+0x48/0x50
 ? do_syscall_64+0x32/0x80
 ? entry_SYSCALL_64_after_hwframe+0x44/0xae
 ? nla_get_range_signed+0x1c0/0x1c0
 ? nla_put_ifalias+0x86/0xf0
 ? __cgroup_bpf_run_filter_skb+0xc1/0x6f0
 ? memcpy+0x4e/0x60
 ? __kasan_check_read+0x11/0x20
 __rtnl_newlink+0x905/0xde0
 ? ipv6_dev_get_saddr+0x4c0/0x4c0
 ? rtnl_setlink+0x250/0x250
 ? ftrace_graph_ret_addr+0x2a/0xb0
 ? entry_SYSCALL_64_after_hwframe+0x44/0xae
 ? bpf_ksym_find+0x94/0xe0
 ? __rcu_read_unlock+0x39/0x60
 ? is_bpf_text_address+0x24/0x30
 ? kernel_text_address+0xbb/0xd0
 ? __kernel_text_address+0x12/0x40
 ? unwind_get_return_address+0x36/0x50
 ? create_prof_cpu_mask+0x30/0x30
 ? arch_stack_walk+0x98/0xf0
 ? stack_trace_save+0x94/0xc0
 ? stack_trace_consume_entry+0x90/0x90
 ? arch_stack_walk+0x98/0xf0
 ? __kasan_kmalloc+0x81/0xa0
 ? kmem_cache_alloc_trace+0xf4/0x220
 rtnl_newlink+0x55/0x80
 rtnetlink_rcv_msg+0x22f/0x560
 ? __kasan_slab_alloc+0x5f/0x80
 ? rtnl_calcit.isra.0+0x1e0/0x1e0
 ? __x64_sys_sendmsg+0x48/0x50
 ? do_syscall_64+0x32/0x80
 ? entry_SYSCALL_64_after_hwframe+0x44/0xae
 ? kernel_text_address+0xbb/0xd0
 ? __kernel_text_address+0x12/0x40
 ? unwind_get_return_address+0x36/0x50
 netlink_rcv_skb+0xe7/0x210
 ? rtnl_calcit.isra.0+0x1e0/0x1e0
 ? netlink_ack+0x580/0x580
 ? netlink_deliver_tap+0x68/0x3d0
 rtnetlink_rcv+0x15/0x20
 netlink_unicast+0x3a8/0x4f0
 ? netlink_attachskb+0x430/0x430
 ? __alloc_skb+0xd7/0x1e0
 netlink_sendmsg+0x3ff/0x710
 ? __rcu_read_unlock+0x39/0x60
 ? netlink_unicast+0x4f0/0x4f0
 ? iovec_from_user+0x6c/0x170
 ? __import_iovec+0x137/0x1c0
 ? netlink_unicast+0x4f0/0x4f0
 sock_sendmsg+0x74/0x80
 ____sys_sendmsg+0x430/0x450
 ? kernel_sendmsg+0x40/0x40
 ? do_recvmmsg+0x440/0x440
 ? kasan_save_stack+0x42/0x50
 ? kasan_save_stack+0x23/0x50
 ? kasan_record_aux_stack+0xac/0xc0
 ? call_rcu+0x5a/0x450
 ? __fput+0x1d7/0x3d0
 ? ____fput+0xe/0x10
 ___sys_sendmsg+0xf2/0x160
 ? sendmsg_copy_msghdr+0x120/0x120
 ? __kasan_check_write+0x14/0x20
 ? _raw_spin_lock+0x82/0xd0
 ? _raw_read_lock_irq+0x50/0x50
 ? __fget_files+0xce/0x110
 ? __fget_light+0x72/0x100
 ? __fdget+0x13/0x20
 __sys_sendmsg+0xc8/0x150
 ? __sys_sendmsg_sock+0x20/0x20
 ? __kasan_check_read+0x11/0x20
 ? fpregs_assert_state_consistent+0x5a/0x70
 __x64_sys_sendmsg+0x48/0x50
 do_syscall_64+0x32/0x80
 entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x7f752cc7312d
Code: 28 89 54 24 1c 48 89 74 24 10 89 7c 24 08 e8 ca ee ff ff 8b 54 24 1c 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 2f 44 89 c7 48 89 44 24 08 e8 fe ee ff ff 48
RSP: 002b:00007ffd1962bc70 EFLAGS: 00000293 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 000055e6574ba880 RCX: 00007f752cc7312d
RDX: 0000000000000000 RSI: 00007ffd1962bcc0 RDI: 000000000000000c
RBP: 00007ffd1962bcc0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000293 R12: 000055e6574ba880
R13: 00007ffd1962be78 R14: 00007ffd1962be6c R15: 0000000000000000

The buggy address belongs to the variable:
 dmi_ppag_approved_list+0x570/0xffffffffffffde20 [iwlmvm]

Memory state around the buggy address:
 ffffffffc16af600: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffffffffc16af680: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffffffffc16af700: 00 00 00 00 00 00 00 00 f9 f9 f9 f9 00 00 00 01
                                                 ^
 ffffffffc16af780: f9 f9 f9 f9 00 00 00 00 00 00 02 f9 f9 f9 f9 f9
 ffffffffc16af800: 00 00 00 07 f9 f9 f9 f9 00 00 00 00 00 00 00 01
==================================================================

Fixes: a2ac0f48a07c ("iwlwifi: mvm: implement approved list for the PPAG feature")
Signed-off-by: Jens Axboe <[e-mail]>

---

Patch

diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
index 15e2773ce7e7..71e5306bd695 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
@@ -1083,6 +1083,7 @@  static const struct dmi_system_id dmi_ppag_approved_list[] = {
 			DMI_MATCH(DMI_SYS_VENDOR, "ASUSTek COMPUTER INC."),
 		},
 	},
+	{ },
 };
 
 static int iwl_mvm_ppag_init(struct iwl_mvm *mvm)