Commit ec25acc4 authored Jul 22, 2010 by Johannes Berg Committed by John W. Linville Jul 26, 2010

mac80211: fix sta assignment



I just had the following:
WARNING: at drivers/net/wireless/iwlwifi/iwl-agn-tx.c:574 iwlagn_tx_skb+0x1576/0x15f0 [iwlagn]()
Call Trace:
 <IRQ>  [<ffffffff8105c5df>] warn_slowpath_common+0x7f/0xc0
 [<ffffffff8105c63a>] warn_slowpath_null+0x1a/0x20
 [<ffffffffa0290b46>] iwlagn_tx_skb+0x1576/0x15f0 [iwlagn]
 [<ffffffffa027076c>] iwl_mac_tx+0x5c/0x260 [iwlagn]
 [<ffffffffa01bdf5b>] __ieee80211_tx+0x10b/0x1a0 [mac80211]
 [<ffffffffa01bfb86>] ieee80211_tx_pending+0x186/0x2d0 [mac80211]
 [<ffffffff81062ea5>] tasklet_action+0x125/0x130
 [<ffffffff810634a6>] __do_softirq+0x106/0x270
 [<ffffffff8100c09c>] call_softirq+0x1c/0x30
iwlagn 0000:02:00.0: Attempting to modify non-existing station 107

Note that 107 == 0x6b which is slab poison.

The reason is that mac80211 passed a freed station
pointer to mac80211, because as it happened iwlwifi
reset itself while mac80211 was disconnecting from
the network.

It turns out that we do take care to look up the
station pointer in ieee80211_tx_pending_skb, but
then don't use it, which obviously is a bug. Fix
this by removing the ieee80211_tx_h_sta handler
and assigning the station pointer directly.

Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

parent bd75eb85

net/mac80211/tx.c

+5 −12

Original line number	Diff line number	Diff line
		@@ -575,17 +575,6 @@ ieee80211_tx_h_select_key(struct ieee80211_tx_data *tx)
		return TX_CONTINUE;
		}

		static ieee80211_tx_result debug_noinline
		ieee80211_tx_h_sta(struct ieee80211_tx_data *tx)
		{
		struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);

		if (tx->sta && tx->sta->uploaded)
		info->control.sta = &tx->sta->sta;

		return TX_CONTINUE;
		}

		static ieee80211_tx_result debug_noinline
		ieee80211_tx_h_rate_ctrl(struct ieee80211_tx_data *tx)
		{
		@@ -1307,6 +1296,11 @@ static int __ieee80211_tx(struct ieee80211_local *local,
		break;
		}

		if (sta && sta->uploaded)
		info->control.sta = &sta->sta;
		else
		info->control.sta = NULL;

		ret = drv_tx(local, skb);
		if (WARN_ON(ret != NETDEV_TX_OK && skb->len != len)) {
		dev_kfree_skb(skb);
		@@ -1346,7 +1340,6 @@ static int invoke_tx_handlers(struct ieee80211_tx_data *tx)
		CALL_TXH(ieee80211_tx_h_check_assoc);
		CALL_TXH(ieee80211_tx_h_ps_buf);
		CALL_TXH(ieee80211_tx_h_select_key);
		CALL_TXH(ieee80211_tx_h_sta);
		if (!(tx->local->hw.flags & IEEE80211_HW_HAS_RATE_CONTROL))
		CALL_TXH(ieee80211_tx_h_rate_ctrl);

Admin message