2022-11-09 15:28:11

by Oliver Neukum

[permalink] [raw]
Subject: warning upon association with latest kernel

Hi,

I am getting this warning when I connect to my home
wifi upon boot:

[ 1301.812048] Bluetooth: RFCOMM TTY layer initialized
[ 1301.812060] Bluetooth: RFCOMM socket layer initialized
[ 1301.812070] Bluetooth: RFCOMM ver 1.11
[ 1321.250549] wlan0: authenticate with cc:ce:1e:f4:37:95
[ 1321.250577] wlan0: bad VHT capabilities, disabling VHT
[ 1321.250579] wlan0: 80 MHz not supported, disabling VHT
[ 1321.257894] wlan0: send auth to cc:ce:1e:f4:37:95 (try 1/3)
[ 1321.304563] wlan0: authenticated
[ 1321.307142] wlan0: associate with cc:ce:1e:f4:37:95 (try 1/3)
[ 1321.318606] wlan0: RX AssocResp from cc:ce:1e:f4:37:95 (capab=0x1431 status=0 aid=2)
[ 1321.321870] wlan0: associated
[ 1321.321888] ------------[ cut here ]------------
[ 1321.321889] memcpy: detected field-spanning write (size 16) of single field "&compat_event->pointer" at net/wireless/wext-core.c:624 (size 4)
[ 1321.321900] WARNING: CPU: 7 PID: 3102 at net/wireless/wext-core.c:624 wireless_send_event+0x41c/0x480
[ 1321.321908] Modules linked in: rfcomm(E) af_packet(E) nft_fib_inet(E) nft_fib_ipv4(E) nft_fib_ipv6(E) nft_fib(E) nft_reject_inet(E) nft_reject(E) nft_ct(E) uvcvideo(E) videobuf2_vmalloc(E) videobuf2_memops(E) videobuf2_v4l2(E) videobuf2_common(E) videodev(E) nft_chain_nat(E) cmac(E) algif_hash(E) algif_skcipher(E) af_alg(E) bnep(E) nf_tables(E) ebtable_nat(E) ebtable_broute(E) ip6table_nat(E) ip6table_mangle(E) ip6table_raw(E) ip6table_security(E) iptable_nat(E) nf_nat(E) nf_conntrack(E) nf_defrag_ipv6(E) nf_defrag_ipv4(E) iptable_mangle(E) btusb(E) btrtl(E) iptable_raw(E) btbcm(E) btintel(E) btmtk(E) iptable_security(E) bluetooth(E) snd_usb_audio(E) snd_usbmidi_lib(E) snd_rawmidi(E) ecdh_generic(E) snd_seq_device(E) ecc(E) crc16(E) mc(E) ip_set(E) nfnetlink(E) ebtable_filter(E) ebtables(E) ip6table_filter(E) ip6_tables(E) iptable_filter(E) ip_tables(E) x_tables(E) bpfilter(E) snd_ctl_led(E) dmi_sysfs(E) snd_hda_codec_realtek(E) snd_hda_codec_generic(E) snd_hda_codec_hdmi(E)
[ 1321.321958] snd_hda_intel(E) snd_intel_dspcfg(E) snd_intel_sdw_acpi(E) snd_hda_codec(E) snd_hda_core(E) snd_pci_ps(E) snd_hwdep(E) snd_rn_pci_acp3x(E) snd_pcm(E) snd_acp_config(E) snd_soc_acpi(E) intel_rapl_msr(E) snd_pci_acp3x(E) snd_timer(E) intel_rapl_common(E) edac_mce_amd(E) iwlmvm(E) kvm_amd(E) ccp(E) mac80211(E) libarc4(E) kvm(E) nls_iso8859_1(E) nls_cp437(E) irqbypass(E) crc32_pclmul(E) vfat(E) fat(E) ghash_clmulni_intel(E) iwlwifi(E) xfs(E) sha512_ssse3(E) cfg80211(E) thinkpad_acpi(E) aesni_intel(E) r8169(E) ledtrig_audio(E) platform_profile(E) crypto_simd(E) ucsi_acpi(E) realtek(E) typec_ucsi(E) cryptd(E) mdio_devres(E) pcspkr(E) joydev(E) efi_pstore(E) ipmi_devintf(E) wmi_bmof(E) sp5100_tco(E) k10temp(E) typec(E) snd(E) i2c_piix4(E) rfkill(E) ipmi_msghandler(E) libphy(E) roles(E) soundcore(E) ac(E) i2c_scmi(E) acpi_cpufreq(E) button(E) fuse(E) configfs(E) hid_generic(E) btrfs(E) blake2b_generic(E) libcrc32c(E) xor(E) usbhid(E) amdgpu(E) raid6_pq(E) drm_ttm_helper(E) ttm(E)
[ 1321.322011] iommu_v2(E) gpu_sched(E) i2c_algo_bit(E) drm_buddy(E) drm_display_helper(E) rtsx_pci_sdmmc(E) mmc_core(E) drm_kms_helper(E) syscopyarea(E) sysfillrect(E) sysimgblt(E) crc32c_intel(E) nvme(E) fb_sys_fops(E) nvme_core(E) t10_pi(E) xhci_pci(E) drm(E) serio_raw(E) ehci_pci(E) xhci_hcd(E) cec(E) rtsx_pci(E) ehci_hcd(E) crc64_rocksoft(E) rc_core(E) mfd_core(E) usbcore(E) crc64(E) battery(E) video(E) wmi(E) sg(E) dm_multipath(E) dm_mod(E) scsi_dh_rdac(E) scsi_dh_emc(E) scsi_dh_alua(E) scsi_mod(E) scsi_common(E) msr(E) efivarfs(E)
[ 1321.322050] CPU: 7 PID: 3102 Comm: kworker/u32:3 Tainted: G E 6.0.0-59.40-default+ #302
[ 1321.322053] Hardware name: LENOVO 20NJS0KQ07/20NJS0KQ07, BIOS R12ET55W(1.25 ) 07/06/2020
[ 1321.322056] Workqueue: phy0 ieee80211_iface_work [mac80211]
[ 1321.322095] RIP: 0010:wireless_send_event+0x41c/0x480
[ 1321.322100] Code: a5 fd ff ff b9 04 00 00 00 48 c7 c2 98 4c 5e af 48 89 ee 48 c7 c7 98 d0 4f af 48 89 04 24 c6 05 0b d7 e4 00 01 e8 f4 97 66 ff <0f> 0b 48 8b 04 24 e9 59 fe ff ff 48 8b 7c 24 10 89 ea 48 c7 c6 c0
[ 1321.322102] RSP: 0018:ffffb01fc2c77830 EFLAGS: 00010282
[ 1321.322105] RAX: 0000000000000000 RBX: ffff956257857200 RCX: 0000000000000001
[ 1321.322107] RDX: 0000000080000001 RSI: ffffffffaf56d55d RDI: 00000000ffffffff
[ 1321.322109] RBP: 0000000000000010 R08: 0000000000000000 R09: c0000000ffffdfff
[ 1321.322111] R10: 0000000000000000 R11: ffffb01fc2c776c8 R12: ffffffffaf35681c
[ 1321.322112] R13: 0000000000000014 R14: ffff9561a94f6000 R15: ffff956257856100
[ 1321.322114] FS: 0000000000000000(0000) GS:ffff9563b0bc0000(0000) knlGS:0000000000000000
[ 1321.322116] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 1321.322118] CR2: 00007ed4e011400a CR3: 0000000104f8e000 CR4: 00000000003506e0
[ 1321.322121] Call Trace:
[ 1321.322124] <TASK>
[ 1321.322130] __cfg80211_connect_result+0x357/0x600 [cfg80211]
[ 1321.322186] ? cfg80211_rx_assoc_resp+0x1a2/0x230 [cfg80211]
[ 1321.322221] cfg80211_rx_assoc_resp+0x1a2/0x230 [cfg80211]
[ 1321.322257] ieee80211_rx_mgmt_assoc_resp+0xe01/0xff0 [mac80211]
[ 1321.322304] ieee80211_sta_rx_queued_mgmt+0x359/0xb70 [mac80211]
[ 1321.322342] ? newidle_balance+0x250/0x400
[ 1321.322345] ? dequeue_entity+0x115/0x3d0
[ 1321.322347] ? preempt_count_add+0x70/0xa0
[ 1321.322351] ieee80211_iface_work+0x304/0x420 [mac80211]
[ 1321.322382] process_one_work+0x226/0x440
[ 1321.322386] ? process_one_work+0x440/0x440
[ 1321.322388] worker_thread+0x2a/0x3b0
[ 1321.322391] ? process_one_work+0x440/0x440
[ 1321.322394] kthread+0xe8/0x110
[ 1321.322397] ? kthread_complete_and_exit+0x20/0x20
[ 1321.322400] ret_from_fork+0x22/0x30
[ 1321.322405] </TASK>
[ 1321.322406] ---[ end trace 0000000000000000 ]---
[ 1321.358996] wlan0: Limiting TX power to 20 (20 - 0) dBm as advertised by cc:ce:1e:f4:37:95
[ 1321.463963] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready

on this hardware:

1:00.0 0280: 8086:2526 (rev 29)
Subsystem: 8086:0014
Physical Slot: 0
Flags: bus master, fast devsel, latency 0, IRQ 80
Memory at d0a00000 (64-bit, non-prefetchable) [size=16K]
Capabilities: [c8] Power Management version 3
Capabilities: [d0] MSI: Enable- Count=1/1 Maskable- 64bit+
Capabilities: [40] Express Endpoint, MSI 00
Capabilities: [80] MSI-X: Enable+ Count=16 Masked-
Capabilities: [100] Advanced Error Reporting
Capabilities: [14c] Latency Tolerance Reporting
Capabilities: [154] L1 PM Substates
Kernel driver in use: iwlwifi
Kernel modules: iwlwifi

Head commit is:

commit f141df371335645ce29a87d9683a3f79fba7fd67 (origin/master, origin/HEAD)
Merge: f49b2d89fb10 986d93f55bde
Author: Linus Torvalds <[email protected]>
Date: Tue Nov 8 12:30:29 2022 -0800

Merge tag 'audit-pr-20221107' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit


Regards
Oliver


2022-11-22 04:38:53

by Kees Cook

[permalink] [raw]
Subject: Re: warning upon association with latest kernel

On Wed, Nov 09, 2022 at 04:26:39PM +0100, Oliver Neukum wrote:
> I am getting this warning when I connect to my home
> wifi upon boot:
>
> [...]
> [ 1321.321889] memcpy: detected field-spanning write (size 16) of single field "&compat_event->pointer" at net/wireless/wext-core.c:624 (size 4)

This should be fixed by commit e3e6e1d16a4c ("wifi: wext: use flex array
destination for memcpy()").

> [...]
> Head commit is:
>
> commit f141df371335645ce29a87d9683a3f79fba7fd67 (origin/master, origin/HEAD)
> Merge: f49b2d89fb10 986d93f55bde
> Author: Linus Torvalds <[email protected]>
> Date: Tue Nov 8 12:30:29 2022 -0800
>
> Merge tag 'audit-pr-20221107' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit

Are you sure that's the same kernel? The stated commit no longer has
"&compat_event->pointer" as a memcpy argument...

--
Kees Cook