WARNING in wiphy_register

Status: fixed on 2018/01/22 13:19
Subsystems: wireless
[Documentation on labels]
Reported-by: syzbot+8dd9051ff19940290931@syzkaller.appspotmail.com
Fix commit: 51a1aaa631c9 mac80211_hwsim: validate number of different channels
First crash: 3113d, last: 3111d
▶ ▼ Discussions (5)
Title Replies (including bot) Last reply
[PATCH 3.16 000/254] 3.16.55-rc1 review 261 (261) 2018/03/03 15:48
[PATCH 4.14 000/159] 4.14.22-stable review 164 (164) 2018/02/24 17:57
WARNING in wiphy_register 5 (5) 2018/01/15 09:00
[PATCH] mac80211_hwsim: validate number of different channels 1 (1) 2018/01/15 08:40
WARNING in wiphy_register 0 (1) 2018/01/13 22:37
▶ ▼ Similar bugs (4)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream WARNING in wiphy_register (3) wireless -1 syz 31 2732d 2763d 11/29 fixed on 2019/03/06 07:43
upstream WARNING in wiphy_register (5) prio:low wireless -1 C error 6 78d 77d 29/29 fixed on 2026/07/15 08:27
upstream WARNING in wiphy_register (4) wireless -1 syz error 3 2658d 2687d 12/29 fixed on 2019/05/27 12:48
upstream WARNING in wiphy_register (2) wireless -1 C 8 2898d 2899d 10/29 fixed on 2018/09/11 03:32

Sample crash report:
audit: type=1400 audit(1515870599.842:7): avc:  denied  { map } for  pid=3649 comm="syzkaller283614" path="/root/syzkaller283614583" dev="sda1" ino=16481 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=1
netlink: 'syzkaller283614': attribute type 9 has an invalid length.
WARNING: CPU: 1 PID: 3649 at net/wireless/core.c:549 wiphy_verify_combinations net/wireless/core.c:548 [inline]
WARNING: CPU: 1 PID: 3649 at net/wireless/core.c:549 wiphy_register+0xfc3/0x2050 net/wireless/core.c:728
Kernel panic - not syncing: panic_on_warn set ...

CPU: 1 PID: 3649 Comm: syzkaller283614 Not tainted 4.15.0-rc7+ #260
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:17 [inline]
 dump_stack+0x194/0x257 lib/dump_stack.c:53
 panic+0x1e4/0x41c kernel/panic.c:183
 __warn+0x1dc/0x200 kernel/panic.c:547
 report_bug+0x211/0x2d0 lib/bug.c:184
 fixup_bug.part.11+0x37/0x80 arch/x86/kernel/traps.c:178
 fixup_bug arch/x86/kernel/traps.c:247 [inline]
 do_error_trap+0x2d7/0x3e0 arch/x86/kernel/traps.c:296
 do_invalid_op+0x1b/0x20 arch/x86/kernel/traps.c:315
 invalid_op+0x22/0x40 arch/x86/entry/entry_64.S:1079
RIP: 0010:wiphy_verify_combinations net/wireless/core.c:548 [inline]
RIP: 0010:wiphy_register+0xfc3/0x2050 net/wireless/core.c:728
RSP: 0018:ffff8801bc307080 EFLAGS: 00010293
RAX: ffff8801bc19c040 RBX: 000000000000000c RCX: ffffffff8517dd33
RDX: 0000000000000000 RSI: ffff8801c2963246 RDI: ffff8801c2963230
RBP: ffff8801bc307200 R08: ffffed003852c115 R09: ffffed003852c115
R10: 0000000000000001 R11: ffffed003852c114 R12: ffff8801c2963234
R13: dffffc0000000000 R14: ffff8801c29608a0 R15: ffff8801c29608d0
 ieee80211_register_hw+0x1162/0x3100 net/mac80211/main.c:1038
 mac80211_hwsim_new_radio+0x1b2e/0x2b90 drivers/net/wireless/mac80211_hwsim.c:2700
 hwsim_new_radio_nl+0x5b7/0x7c0 drivers/net/wireless/mac80211_hwsim.c:3152
 genl_family_rcv_msg+0x7b7/0xfb0 net/netlink/genetlink.c:599
 genl_rcv_msg+0xb2/0x140 net/netlink/genetlink.c:624
 netlink_rcv_skb+0x224/0x470 net/netlink/af_netlink.c:2408
 genl_rcv+0x28/0x40 net/netlink/genetlink.c:635
 netlink_unicast_kernel net/netlink/af_netlink.c:1275 [inline]
 netlink_unicast+0x4ee/0x700 net/netlink/af_netlink.c:1301
 netlink_sendmsg+0xa4a/0xe60 net/netlink/af_netlink.c:1864
 sock_sendmsg_nosec net/socket.c:638 [inline]
 sock_sendmsg+0xca/0x110 net/socket.c:648
 ___sys_sendmsg+0x767/0x8b0 net/socket.c:2028
 __sys_sendmsg+0xe5/0x210 net/socket.c:2062
 SYSC_sendmsg net/socket.c:2073 [inline]
 SyS_sendmsg+0x2d/0x50 net/socket.c:2069
 entry_SYSCALL_64_fastpath+0x23/0x9a
RIP: 0033:0x43fd79
RSP: 002b:00007ffeea412a48 EFLAGS: 00000203 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 000000000043fd79
RDX: 0000000000000000 RSI: 0000000020b3dfc8 RDI: 0000000000000003
RBP: 00000000006ca018 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000203 R12: 00000000004016e0
R13: 0000000000401770 R14: 0000000000000000 R15: 0000000000000000
Dumping ftrace buffer:
   (ftrace buffer empty)
Kernel Offset: disabled
Rebooting in 86400 seconds..

Crashes (15):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2018/01/13 19:11 upstream c92a9a461dff c9e7aeae .config console log report syz C ci-upstream-kasan-gce
2018/01/13 17:56 upstream c92a9a461dff c9e7aeae .config console log report syz C ci-upstream-kasan-gce
2018/01/13 19:28 upstream c92a9a461dff c9e7aeae .config console log report syz C ci-upstream-kasan-gce-386
2018/01/13 18:43 upstream c92a9a461dff c9e7aeae .config console log report syz C ci-upstream-kasan-gce-386
2018/01/13 18:37 net-next-old 6bd39bc3da0f c9e7aeae .config console log report syz C ci-upstream-net-kasan-gce
2018/01/13 18:27 net-next-old 6bd39bc3da0f c9e7aeae .config console log report syz C ci-upstream-net-kasan-gce
2018/01/13 20:16 linux-next 3e53c7415294 c9e7aeae .config console log report syz C ci-upstream-next-kasan-gce
2018/01/13 19:34 linux-next 3e53c7415294 c9e7aeae .config console log report syz C ci-upstream-next-kasan-gce
2018/01/13 19:28 mmots ce3c209f6733 c9e7aeae .config console log report syz C ci-upstream-mmots-kasan-gce
2018/01/13 18:46 mmots ce3c209f6733 c9e7aeae .config console log report syz C ci-upstream-mmots-kasan-gce
2018/01/13 17:39 upstream c92a9a461dff c9e7aeae .config console log report ci-upstream-kasan-gce
2018/01/13 18:39 upstream c92a9a461dff c9e7aeae .config console log report ci-upstream-kasan-gce-386
2018/01/15 13:22 linux-next b625c1ff8227 66d492a6 .config console log report ci-upstream-next-kasan-gce
2018/01/14 10:58 mmots ce3c209f6733 c9e7aeae .config console log report ci-upstream-mmots-kasan-gce
2018/01/14 07:47 mmots ce3c209f6733 c9e7aeae .config console log report ci-upstream-mmots-kasan-gce
* Struck through repros no longer work on HEAD.