| From 3092ad054406f069991ca561adc74f2d9fbb6867 Mon Sep 17 00:00:00 2001 |
| From: Zhu Yi <yi.zhu@intel.com> |
| Date: Tue, 26 Jan 2010 15:58:57 +0800 |
| Subject: mac80211: fix NULL pointer dereference when ftrace is enabled |
| |
| From: Zhu Yi <yi.zhu@intel.com> |
| |
| commit 3092ad054406f069991ca561adc74f2d9fbb6867 upstream. |
| |
| I got below kernel oops when I try to bring down the network interface if |
| ftrace is enabled. The root cause is drv_ampdu_action() is passed with a |
| NULL ssn pointer in the BA session tear down case. We need to check and |
| avoid dereferencing it in trace entry assignment. |
| |
| BUG: unable to handle kernel NULL pointer dereference |
| Modules linked in: at (null) |
| IP: [<f98fe02a>] ftrace_raw_event_drv_ampdu_action+0x10a/0x160 [mac80211] |
| *pde = 00000000 |
| Oops: 0000 [#1] SMP DEBUG_PAGEALLOC |
| [...] |
| Call Trace: |
| [<f98fdf20>] ? ftrace_raw_event_drv_ampdu_action+0x0/0x160 [mac80211] |
| [<f98dac4c>] ? __ieee80211_stop_rx_ba_session+0xfc/0x220 [mac80211] |
| [<f98d97fb>] ? ieee80211_sta_tear_down_BA_sessions+0x3b/0x50 [mac80211] |
| [<f98dc6f6>] ? ieee80211_set_disassoc+0xe6/0x230 [mac80211] |
| [<f98dc6ac>] ? ieee80211_set_disassoc+0x9c/0x230 [mac80211] |
| [<f98dcbb8>] ? ieee80211_mgd_deauth+0x158/0x170 [mac80211] |
| [<f98e4bdb>] ? ieee80211_deauth+0x1b/0x20 [mac80211] |
| [<f8987f49>] ? __cfg80211_mlme_deauth+0xe9/0x120 [cfg80211] |
| [<f898b870>] ? __cfg80211_disconnect+0x170/0x1d0 [cfg80211] |
| |
| Cc: Johannes Berg <johannes@sipsolutions.net> |
| Signed-off-by: Zhu Yi <yi.zhu@intel.com> |
| Signed-off-by: John W. Linville <linville@tuxdriver.com> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> |
| |
| --- |
| net/mac80211/driver-trace.h | 2 +- |
| 1 file changed, 1 insertion(+), 1 deletion(-) |
| |
| --- a/net/mac80211/driver-trace.h |
| +++ b/net/mac80211/driver-trace.h |
| @@ -655,7 +655,7 @@ TRACE_EVENT(drv_ampdu_action, |
| __entry->ret = ret; |
| __entry->action = action; |
| __entry->tid = tid; |
| - __entry->ssn = *ssn; |
| + __entry->ssn = ssn ? *ssn : 0; |
| ), |
| |
| TP_printk( |
