Received-SPF: pass (google.com: best guess record for domain of linux-wireless-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
MIME-Version: 1.0
References: <00000000000073b469059bcde315@google.com> <b5d74ce6b6e3c4b39cfac7df6c2b65d0a43d4416.camel@sipsolutions.net>
In-Reply-To: <b5d74ce6b6e3c4b39cfac7df6c2b65d0a43d4416.camel@sipsolutions.net>
From:   Justin Capella <justincapella@gmail.com>
Date:   Fri, 10 Jan 2020 21:23:57 -0800
Message-ID: <CAMrEMU_a9evtp26tYB6VUxznmSmH98AmpP8xnejQr5bGTgE+8g@mail.gmail.com>
Subject: Re: BUG: unable to handle kernel NULL pointer dereference in cfg80211_wext_siwrts
To:     Johannes Berg <johannes@sipsolutions.net>
Cc:     syzbot <syzbot+34b582cf32c1db008f8e@syzkaller.appspotmail.com>,
        "David S. Miller" <davem@davemloft.net>,
        LKML <linux-kernel@vger.kernel.org>,
        linux-wireless@vger.kernel.org, netdev@vger.kernel.org,
        syzkaller-bugs@googlegroups.com,
        Cody Schuffelen <schuffelen@google.com>
Content-Type: text/plain; charset="UTF-8"
Sender: linux-wireless-owner@vger.kernel.org
Precedence: bulk

I noticed pfifo_qdisc_ops is exported as default_qdisc_ops is it
possible this is how rdev->ops is NULL

Seems unlikely, but thought I'd point it out.


On Fri, Jan 10, 2020 at 11:13 AM Johannes Berg
<johannes@sipsolutions.net> wrote:
>
> On Fri, 2020-01-10 at 11:11 -0800, syzbot wrote:
> > Hello,
> >
> > syzbot found the following crash on:
> >
> > HEAD commit:    2f806c2a Merge branch 'net-ungraft-prio'
> > git tree:       net
> > console output: https://syzkaller.appspot.com/x/log.txt?x=1032069ee00000
> > kernel config:  https://syzkaller.appspot.com/x/.config?x=5c90cac8f1f8c619
> > dashboard link: https://syzkaller.appspot.com/bug?extid=34b582cf32c1db008f8e
> > compiler:       gcc (GCC) 9.0.0 20181231 (experimental)
> >
> > Unfortunately, I don't have any reproducer for this crash yet.
>
> It's quite likely also in virt_wifi, evidently that has some issues.
>
> Cody, did you take a look at the previous report by any chance?
>
> johannes
>