Bug 211073 - kernel NULL pointer dereference when connecting to 802.1x network
Summary: kernel NULL pointer dereference when connecting to 802.1x network
Status: NEW
Alias: None
Product: Networking
Classification: Unclassified
Component: Wireless (show other bugs)
Hardware: Intel Linux
: P1 normal
Assignee: networking_wireless@kernel-bugs.osdl.org
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2021-01-07 11:21 UTC by wavexx
Modified: 2021-01-07 15:27 UTC (History)
1 user (show)

See Also:
Kernel Version: 5.10.4 (Debian 5.10.4-1 (2020-12-31) x86_64 GNU/Linux)
Subsystem:
Regression: No
Bisected commit-id:


Attachments

Description wavexx 2021-01-07 11:21:51 UTC
Lenovo Yoga X1 connecting to a 802.1x network through iwd with no CACert provided causes the following:

[  228.838588] BUG: kernel NULL pointer dereference, address: 0000000000000000
[  228.838590] #PF: supervisor read access in kernel mode
[  228.838590] #PF: error_code(0x0000) - not-present page
[  228.838591] PGD 0 P4D 0
[  228.838593] Oops: 0000 [#1] SMP NOPTI
[  228.838595] CPU: 0 PID: 776 Comm: iwd Not tainted 5.10.0-1-amd64 #1 Debian 5.10.4-1
[  228.838596] Hardware name: LENOVO 20LES1BM00/20LES1BM00, BIOS N25ET55W (1. 41 ) 10/20/2020
[  228.838599] RIP: 0010:public_key_verify_signature+0x13d/0x3b0
[  228.838601] Code: 48 8b 40 d0 44 89 c2 4c 89 f6 4c 89 ff e8 7b d4 7f 00 85 c0 0f 85 6f 01 00 00 48 8b 75 30 48 c7 c7 12 23 d0 b5 b9 04 00 00 00 <f3> a6  0f 97 c0 1c 00 84 c0 75 0b 8b 45 50 85 c0 0f 85 d1 01 00 00
[  228.838602] RSP: 0018:ffffaf03409afd58 EFLAGS: 00010246
[  228.838603] RAX: 0000000000000000 RBX: ffff9c4fc5d26700 RCX:               0000000000000004
[  228.838603] RDX: ffff9c4fdaad9d00 RSI: 0000000000000000 RDI:               ffffffffb5d02312
[  228.838604] RBP: ffffaf03409afe88 R08: ffff9c4fd08a0400 R09:               0000000000000008
[  228.838604] R10: 0000000000000000 R11: 000000000000000a R12:               000000000000010e
[  228.838605] R13: ffff9c4fdaad9800 R14: ffff9c4fd0891000 R15:               ffff9c4fc43b1200
[  228.838606] FS:  00007f5f4762f640(0000) GS:ffff9c5107400000(0000) knlGS:   0000000000000000
[  228.838607] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  228.838607] CR2: 0000000000000000 CR3: 000000010356e002 CR4:               00000000003706f0
[  228.838608] Call Trace:
[  228.838612]  ? kfree+0xc3/0x3f0
[  228.838613]  ? software_key_query+0x94/0x180
[  228.838616]  ? keyctl_pkey_params_get+0xe9/0x120
[  228.838618]  asymmetric_key_verify_signature+0x5e/0x80
[  228.838620]  keyctl_pkey_verify+0xaf/0x100
[  228.838623]  do_syscall_64+0x33/0x80
[  228.838625]  entry_SYSCALL_64_after_hwframe+0x44/0xa9
[  228.838627] RIP: 0033:0x7f5f475619b9
[  228.838628] Code: 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d  01 f0 ff ff 73 01 c3 48 8b 0d a7 54 0c 00 f7 d8 64 89 01 48
[  228.838629] RSP: 002b:00007ffc58e94348 EFLAGS: 00000246 ORIG_RAX:          00000000000000fa
[  228.838630] RAX: ffffffffffffffda RBX: 00007ffc58e943d0 RCX:               00007f5f475619b9
[  228.838630] RDX: 000055722015b790 RSI: 00007ffc58e94350 RDI:               000000000000001c
[  228.838631] RBP: 000055722015b790 R08: 000055722015dd4d R09:               000000203673a149
[  228.838632] R10: 00007ffc58e943d0 R11: 0000000000000246 R12:               000055722015dd4d
[  228.838632] R13: 000055721f9a8b30 R14: 000055722015dd04 R15:               00007ffc58e943d0
[  228.838634] Modules linked in: cdc_ether usbnet snd_hda_codec_hdmi         snd_hda_codec_realtek snd_hda_codec_generic r8152 mii bnep typec_displayport  btusb btrtl btbcm btintel ccm bluetooth algif_aead cbc uvcvideo des_generic   libdes ecb videobuf2_vmalloc jitterentropy_rng videobuf2_memops               videobuf2_v4l2 algif_skcipher drbg videobuf2_common ansi_cprng videodev       ecdh_generic mc sg ecc cmac sha512_ssse3 sha512_generic md4 algif_hash        intel_pmc_core_pltdrv af_alg intel_pmc_core snd_soc_skl snd_soc_hdac_hda      snd_hda_ext_core snd_soc_sst_ipc snd_soc_sst_dsp snd_soc_acpi_intel_match     snd_soc_acpi ip6table_nat snd_hda_intel snd_intel_dspcfg soundwire_intel      x86_pkg_temp_thermal soundwire_generic_allocation intel_powerclamp            binfmt_misc intel_rapl_msr coretemp snd_soc_core ip6table_filter kvm_intel    iwlmvm snd_compress ip6_tables kvm soundwire_cadence mac80211 irqbypass       libarc4 nls_ascii xt_REDIRECT snd_hda_codec nls_cp437 rapl intel_cstate       snd_hda_core vfat iptable_nat snd_hwdep iwlwifi i915 intel_uncore fat
[  228.838670]  nf_nat joydev evdev iTCO_wdt ipt_REJECT soundwire_bus         intel_pmc_bxt snd_pcm pcspkr nf_reject_ipv4 serio_raw iTCO_vendor_support     efi_pstore sparse_keymap xt_pkttype tpm_crb intel_wmi_thunderbolt wmi_bmof    cfg80211 watchdog snd_timer xt_tcpudp drm_kms_helper hid_sensor_accel_3d      hid_sensor_gyro_3d hid_sensor_als intel_xhci_usb_role_switch                  hid_sensor_trigger processor_thermal_device ucsi_acpi mei_me cec tpm_tis      hid_sensor_iio_common xt_state intel_rapl_common tpm_tis_core                 industrialio_triggered_buffer kfifo_buf xt_conntrack industrialio mei roles   i2c_algo_bit intel_soc_dts_iosf intel_pch_thermal tpm typec_ucsi              thinkpad_acpi typec rng_core nvram ledtrig_audio snd soundcore rfkill ac      int3403_thermal int3400_thermal acpi_pad int3402_thermal int340x_thermal_zone acpi_thermal_rel button iptable_filter sch_cake i2c_dev drm nf_conntrack      nf_defrag_ipv6 nf_defrag_ipv4 libcrc32c tcp_bbr fuse configfs efivarfs        ip_tables x_tables autofs4 ext4 crc16 mbcache jbd2 crc32c_generic             hid_plantronics
[  228.838705]  wacom usbhid sd_mod dm_crypt dm_mod hid_sensor_custom         hid_sensor_hub hid_generic intel_ishtp_hid hid uas usb_storage scsi_mod       crc32_pclmul crc32c_intel ghash_clmulni_intel xhci_pci nvme xhci_hcd          aesni_intel libaes crypto_simd cryptd usbcore glue_helper e1000e thunderbolt  nvme_core psmouse intel_ish_ipc intel_lpss_pci i2c_i801 ptp intel_lpss t10_pi idma64 pps_core crc_t10dif i2c_smbus crct10dif_generic usb_common             crct10dif_pclmul intel_ishtp crct10dif_common wmi battery video
[  228.838725] CR2: 0000000000000000
[  228.838726] ---[ end trace a6fa9e33fa541f14 ]---
Comment 1 wavexx 2021-01-07 11:23:18 UTC
This is new in 5.10 (5.9.15 connects without issues).
Comment 2 Salvatore Bonaccorso 2021-01-07 15:27:24 UTC
To make a cross-reference this seems to be the same as https://lore.kernel.org/keyrings/67250277-7903-2005-b94b-193bce0a3388@markus-regensburg.de/

(Downstream report in Debian as https://bugs.debian.org/979496)

Regards,
Salvatore

Note You need to log in before you can comment on or make changes to this bug.