| From 394aac1fb21fd3025d91f53c26b24c38f5e19f46 Mon Sep 17 00:00:00 2001 |
| From: Miaoqing Pan <miaoqing@codeaurora.org> |
| Date: Fri, 27 Sep 2019 10:03:16 +0800 |
| Subject: [PATCH] mac80211: fix txq null pointer dereference |
| MIME-Version: 1.0 |
| Content-Type: text/plain; charset=UTF-8 |
| Content-Transfer-Encoding: 8bit |
| |
| commit 8ed31a264065ae92058ce54aa3cc8da8d81dc6d7 upstream. |
| |
| If the interface type is P2P_DEVICE or NAN, read the file of |
| '/sys/kernel/debug/ieee80211/phyx/netdev:wlanx/aqm' will get a |
| NULL pointer dereference. As for those interface type, the |
| pointer sdata->vif.txq is NULL. |
| |
| Unable to handle kernel NULL pointer dereference at virtual address 00000011 |
| CPU: 1 PID: 30936 Comm: cat Not tainted 4.14.104 #1 |
| task: ffffffc0337e4880 task.stack: ffffff800cd20000 |
| PC is at ieee80211_if_fmt_aqm+0x34/0xa0 [mac80211] |
| LR is at ieee80211_if_fmt_aqm+0x34/0xa0 [mac80211] |
| [...] |
| Process cat (pid: 30936, stack limit = 0xffffff800cd20000) |
| [...] |
| [<ffffff8000b7cd00>] ieee80211_if_fmt_aqm+0x34/0xa0 [mac80211] |
| [<ffffff8000b7c414>] ieee80211_if_read+0x60/0xbc [mac80211] |
| [<ffffff8000b7ccc4>] ieee80211_if_read_aqm+0x28/0x30 [mac80211] |
| [<ffffff80082eff94>] full_proxy_read+0x2c/0x48 |
| [<ffffff80081eef00>] __vfs_read+0x2c/0xd4 |
| [<ffffff80081ef084>] vfs_read+0x8c/0x108 |
| [<ffffff80081ef494>] SyS_read+0x40/0x7c |
| |
| Signed-off-by: Miaoqing Pan <miaoqing@codeaurora.org> |
| Acked-by: Toke Høiland-Jørgensen <toke@redhat.com> |
| Link: https://lore.kernel.org/r/1569549796-8223-1-git-send-email-miaoqing@codeaurora.org |
| [trim useless data from commit message] |
| Signed-off-by: Johannes Berg <johannes.berg@intel.com> |
| Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> |
| |
| diff --git a/net/mac80211/debugfs_netdev.c b/net/mac80211/debugfs_netdev.c |
| index f1f2e1c7ac0c..df8046ed4cb6 100644 |
| --- a/net/mac80211/debugfs_netdev.c |
| +++ b/net/mac80211/debugfs_netdev.c |
| @@ -487,9 +487,14 @@ static ssize_t ieee80211_if_fmt_aqm( |
| const struct ieee80211_sub_if_data *sdata, char *buf, int buflen) |
| { |
| struct ieee80211_local *local = sdata->local; |
| - struct txq_info *txqi = to_txq_info(sdata->vif.txq); |
| + struct txq_info *txqi; |
| int len; |
| |
| + if (!sdata->vif.txq) |
| + return 0; |
| + |
| + txqi = to_txq_info(sdata->vif.txq); |
| + |
| spin_lock_bh(&local->fq.lock); |
| rcu_read_lock(); |
| |
| @@ -658,7 +663,9 @@ static void add_common_files(struct ieee80211_sub_if_data *sdata) |
| DEBUGFS_ADD(rc_rateidx_vht_mcs_mask_5ghz); |
| DEBUGFS_ADD(hw_queues); |
| |
| - if (sdata->local->ops->wake_tx_queue) |
| + if (sdata->local->ops->wake_tx_queue && |
| + sdata->vif.type != NL80211_IFTYPE_P2P_DEVICE && |
| + sdata->vif.type != NL80211_IFTYPE_NAN) |
| DEBUGFS_ADD(aqm); |
| } |
| |
| -- |
| 2.7.4 |
| |