==================================================================
BUG: KASAN: global-out-of-bounds in dmi_check_system+0x5a/0x70
Read of size 1 at addr ffffffffc16af750 by task NetworkManager/1913
CPU: 4 PID: 1913 Comm: NetworkManager Not tainted 5.12.0-rc1+ #10057
Hardware name: LENOVO 20THCTO1WW/20THCTO1WW, BIOS N2VET27W (1.12 ) 12/21/2020
Call Trace:
dump_stack+0x90/0xbe
print_address_description.constprop.0+0x1d/0x140
? dmi_check_system+0x5a/0x70
? dmi_check_system+0x5a/0x70
kasan_report.cold+0x7b/0xd4
? dmi_check_system+0x5a/0x70
__asan_load1+0x4d/0x50
dmi_check_system+0x5a/0x70
iwl_mvm_up+0x1360/0x1690 [iwlmvm]
? iwl_mvm_send_recovery_cmd+0x270/0x270 [iwlmvm]
? setup_object.isra.0+0x27/0xd0
? kasan_poison+0x20/0x50
? ___slab_alloc.constprop.0+0x483/0x5b0
? mempool_kmalloc+0x17/0x20
? ftrace_graph_ret_addr+0x2a/0xb0
? kasan_poison+0x3c/0x50
? cfg80211_iftype_allowed+0x2e/0x90 [cfg80211]
? __kasan_check_write+0x14/0x20
? mutex_lock+0x86/0xe0
? __mutex_lock_slowpath+0x20/0x20
__iwl_mvm_mac_start+0x49/0x290 [iwlmvm]
iwl_mvm_mac_start+0x37/0x50 [iwlmvm]
drv_start+0x73/0x1b0 [mac80211]
ieee80211_do_open+0x53e/0xf10 [mac80211]
? ieee80211_check_concurrent_iface+0x266/0x2e0 [mac80211]
ieee80211_open+0xb9/0x100 [mac80211]
__dev_open+0x1b8/0x280
? dev_set_rx_mode+0x40/0x40
__dev_change_flags+0x32f/0x3a0
? dev_set_allmulti+0x20/0x20
? is_bpf_text_address+0x24/0x30
? kernel_text_address+0xbb/0xd0
dev_change_flags+0x63/0xc0
do_setlink+0xb59/0x18c0
? rtnetlink_put_metrics+0x2e0/0x2e0
? stack_trace_consume_entry+0x90/0x90
? if6_seq_show+0xb0/0xb0
? kasan_save_stack+0x42/0x50
? kasan_save_stack+0x23/0x50
? kasan_set_track+0x20/0x30
? kasan_set_free_info+0x24/0x40
? __kasan_slab_free+0xea/0x120
? kfree+0x94/0x250
? memset+0x3c/0x50
? __nla_validate_parse+0xc1/0x12d0
? ____sys_sendmsg+0x430/0x450
? ___sys_sendmsg+0xf2/0x160
? __sys_sendmsg+0xc8/0x150
? __x64_sys_sendmsg+0x48/0x50
? do_syscall_64+0x32/0x80
? entry_SYSCALL_64_after_hwframe+0x44/0xae
? nla_get_range_signed+0x1c0/0x1c0
? nla_put_ifalias+0x86/0xf0
? __cgroup_bpf_run_filter_skb+0xc1/0x6f0
? memcpy+0x4e/0x60
? __kasan_check_read+0x11/0x20
__rtnl_newlink+0x905/0xde0
? ipv6_dev_get_saddr+0x4c0/0x4c0
? rtnl_setlink+0x250/0x250
? ftrace_graph_ret_addr+0x2a/0xb0
? entry_SYSCALL_64_after_hwframe+0x44/0xae
? bpf_ksym_find+0x94/0xe0
? __rcu_read_unlock+0x39/0x60
? is_bpf_text_address+0x24/0x30
? kernel_text_address+0xbb/0xd0
? __kernel_text_address+0x12/0x40
? unwind_get_return_address+0x36/0x50
? create_prof_cpu_mask+0x30/0x30
? arch_stack_walk+0x98/0xf0
? stack_trace_save+0x94/0xc0
? stack_trace_consume_entry+0x90/0x90
? arch_stack_walk+0x98/0xf0
? __kasan_kmalloc+0x81/0xa0
? kmem_cache_alloc_trace+0xf4/0x220
rtnl_newlink+0x55/0x80
rtnetlink_rcv_msg+0x22f/0x560
? __kasan_slab_alloc+0x5f/0x80
? rtnl_calcit.isra.0+0x1e0/0x1e0
? __x64_sys_sendmsg+0x48/0x50
? do_syscall_64+0x32/0x80
? entry_SYSCALL_64_after_hwframe+0x44/0xae
? kernel_text_address+0xbb/0xd0
? __kernel_text_address+0x12/0x40
? unwind_get_return_address+0x36/0x50
netlink_rcv_skb+0xe7/0x210
? rtnl_calcit.isra.0+0x1e0/0x1e0
? netlink_ack+0x580/0x580
? netlink_deliver_tap+0x68/0x3d0
rtnetlink_rcv+0x15/0x20
netlink_unicast+0x3a8/0x4f0
? netlink_attachskb+0x430/0x430
? __alloc_skb+0xd7/0x1e0
netlink_sendmsg+0x3ff/0x710
? __rcu_read_unlock+0x39/0x60
? netlink_unicast+0x4f0/0x4f0
? iovec_from_user+0x6c/0x170
? __import_iovec+0x137/0x1c0
? netlink_unicast+0x4f0/0x4f0
sock_sendmsg+0x74/0x80
____sys_sendmsg+0x430/0x450
? kernel_sendmsg+0x40/0x40
? do_recvmmsg+0x440/0x440
? kasan_save_stack+0x42/0x50
? kasan_save_stack+0x23/0x50
? kasan_record_aux_stack+0xac/0xc0
? call_rcu+0x5a/0x450
? __fput+0x1d7/0x3d0
? ____fput+0xe/0x10
___sys_sendmsg+0xf2/0x160
? sendmsg_copy_msghdr+0x120/0x120
? __kasan_check_write+0x14/0x20
? _raw_spin_lock+0x82/0xd0
? _raw_read_lock_irq+0x50/0x50
? __fget_files+0xce/0x110
? __fget_light+0x72/0x100
? __fdget+0x13/0x20
__sys_sendmsg+0xc8/0x150
? __sys_sendmsg_sock+0x20/0x20
? __kasan_check_read+0x11/0x20
? fpregs_assert_state_consistent+0x5a/0x70
__x64_sys_sendmsg+0x48/0x50
do_syscall_64+0x32/0x80
entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x7f752cc7312d
Code: 28 89 54 24 1c 48 89 74 24 10 89 7c 24 08 e8 ca ee ff ff 8b 54 24 1c 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 2f 44 89 c7 48 89 44 24 08 e8 fe ee ff ff 48
RSP: 002b:00007ffd1962bc70 EFLAGS: 00000293 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 000055e6574ba880 RCX: 00007f752cc7312d
RDX: 0000000000000000 RSI: 00007ffd1962bcc0 RDI: 000000000000000c
RBP: 00007ffd1962bcc0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000293 R12: 000055e6574ba880
R13: 00007ffd1962be78 R14: 00007ffd1962be6c R15: 0000000000000000
The buggy address belongs to the variable:
dmi_ppag_approved_list+0x570/0xffffffffffffde20 [iwlmvm]
Memory state around the buggy address:
ffffffffc16af600: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffffffffc16af680: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffffffffc16af700: 00 00 00 00 00 00 00 00 f9 f9 f9 f9 00 00 00 01
^
ffffffffc16af780: f9 f9 f9 f9 00 00 00 00 00 00 02 f9 f9 f9 f9 f9
ffffffffc16af800: 00 00 00 07 f9 f9 f9 f9 00 00 00 00 00 00 00 01
==================================================================
Fixes: a2ac0f48a07c ("iwlwifi: mvm: implement approved list for the PPAG feature")
Signed-off-by: Jens Axboe <axboe@kernel.dk>
---
@@ -1083,6 +1083,7 @@ static const struct dmi_system_id dmi_ppag_approved_list[] = {
DMI_MATCH(DMI_SYS_VENDOR, "ASUSTek COMPUTER INC."),
},
},
+ { },
};
static int iwl_mvm_ppag_init(struct iwl_mvm *mvm)