leandrof/linux
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
749329594b
linux/net/mac80211
History
Bob Copeland 749329594b mac80211: mesh: fix crash in mesh_path_timer 
The mesh_path_reclaim() function, called from an rcu callback, cancels
the mesh_path_timer associated with a mesh path.  Unfortunately, this
call can happen much later, perhaps after the hash table itself is
destroyed.

Such a situation led to the following crash in mesh_path_send_to_gates()
when dereferencing the tbl pointer:

[   23.901661] BUG: unable to handle kernel NULL pointer dereference at 0000000000000008
[   23.905516] IP: [<ffffffff814c910b>] mesh_path_send_to_gates+0x2b/0x740
[   23.908757] PGD 99ca067 PUD 99c4067 PMD 0
[   23.910789] Oops: 0000 [] PREEMPT SMP DEBUG_PAGEALLOC
[   23.913485] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 4.5.0-rc6-wt+ 
[   23.916675] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Debian-1.8.2-1 04/01/2014
[   23.920471] task: ffffffff81685500 ti: ffffffff81678000 task.ti: ffffffff81678000
[   23.922619] RIP: 0010:[<ffffffff814c910b>]  [<ffffffff814c910b>] mesh_path_send_to_gates+0x2b/0x740
[   23.925237] RSP: 0018:ffff88000b403d30  EFLAGS: 00010286
[   23.926739] RAX: 0000000000000000 RBX: ffff880009bc0d20 RCX: 0000000000000102
[   23.928796] RDX: 000000000000002e RSI: 0000000000000001 RDI: ffff880009bc0d20
[   23.930895] RBP: ffff88000b403e18 R08: 0000000000000001 R09: 0000000000000001
[   23.932917] R10: 0000000000000000 R11: 0000000000000001 R12: ffff880009c20940
[   23.936370] R13: ffff880009bc0e70 R14: ffff880009c21c40 R15: ffff880009bc0d20
[   23.939823] FS:  0000000000000000(0000) GS:ffff88000b400000(0000) knlGS:0000000000000000
[   23.943688] CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
[   23.946429] CR2: 0000000000000008 CR3: 00000000099c5000 CR4: 00000000000006b0
[   23.949861] Stack:
[   23.950840]  000000000000002e ffff880009c20940 ffff88000b403da8 ffffffff8109e551
[   23.954467]  ffffffff82711be2 000000000000002e 0000000000000000 ffffffff8166a5f5
[   23.958141]  0000000000685ce8 0000000000000246 ffff880009bc0d20 ffff880009c20940
[   23.961801] Call Trace:
[   23.962987]  <IRQ>
[   23.963963]  [<ffffffff8109e551>] ? vprintk_emit+0x351/0x5e0
[   23.966782]  [<ffffffff8109e8ff>] ? vprintk_default+0x1f/0x30
[   23.969529]  [<ffffffff810ffa41>] ? printk+0x48/0x50
[   23.971956]  [<ffffffff814ceef3>] mesh_path_timer+0x133/0x160
[   23.974707]  [<ffffffff814cedc0>] ? mesh_nexthop_resolve+0x230/0x230
[   23.977775]  [<ffffffff810b04ee>] call_timer_fn+0xce/0x330
[   23.980448]  [<ffffffff810b0425>] ? call_timer_fn+0x5/0x330
[   23.983126]  [<ffffffff814cedc0>] ? mesh_nexthop_resolve+0x230/0x230
[   23.986091]  [<ffffffff810b097c>] run_timer_softirq+0x22c/0x390

Instead of cancelling in the RCU callback, set a new flag to prevent the
timer from being rearmed, and then cancel the timer synchronously when
freeing the mesh path.  This leaves mesh_path_reclaim() doing nothing
but kfree, so switch to kfree_rcu().

Fixes: 3b302ada7f0a ("mac80211: mesh: move path tables into if_mesh")
Signed-off-by: Bob Copeland <me@bobcopeland.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2016-04-05 21:34:49 +02:00
..
aes_ccm.c
aes_ccm.h
aes_cmac.c
aes_cmac.h
aes_gcm.c
aes_gcm.h
aes_gmac.c
aes_gmac.h
agg-rx.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2016-03-08 12:34:12 -05:00
agg-tx.c
cfg.c mac80211: track and tell driver about GO client P2P PS abilities 2016-04-05 21:34:49 +02:00
chan.c mac80211: Recalc min chandef when station is associated 2016-02-24 09:04:19 +01:00
debug.h
debugfs_key.c mac80211: move TKIP TX IVs to public part of key struct 2016-02-24 09:04:38 +01:00
debugfs_key.h
debugfs_netdev.c
debugfs_netdev.h
debugfs_sta.c mac80211: clean up station flags debugfs 2016-04-05 12:12:26 +02:00
debugfs_sta.h
debugfs.c Here's another round of updates for -next: 2016-03-01 17:03:27 -05:00
debugfs.h
driver-ops.c
driver-ops.h mac80211: synchronize driver rx queues before removing a station 2016-04-05 10:56:34 +02:00
ethtool.c
ht.c mac80211: limit the A-MSDU Tx based on peer's capabilities 2016-02-24 09:04:20 +01:00
ibss.c Here's another round of updates for -next: 2016-03-01 17:03:27 -05:00
ieee80211_i.h mac80211: mesh: convert path table to rhashtable 2016-04-05 10:56:33 +02:00
iface.c mac80211: expose txq queue depth and size to drivers 2016-02-24 09:04:30 +01:00
Kconfig
key.c mac80211: remove ieee80211_get_key_tx_seq/ieee80211_set_key_tx_seq 2016-02-24 09:04:39 +01:00
key.h mac80211: move TKIP TX IVs to public part of key struct 2016-02-24 09:04:38 +01:00
led.c
led.h
main.c mac80211: add NETIF_F_RXCSUM to features white list 2016-04-05 11:45:51 +02:00
Makefile
mesh_hwmp.c mac80211: mesh: fix crash in mesh_path_timer 2016-04-05 21:34:49 +02:00
mesh_pathtbl.c mac80211: mesh: fix crash in mesh_path_timer 2016-04-05 21:34:49 +02:00
mesh_plink.c mac80211: mesh_plink: remove redundant sta_info check 2016-02-24 09:04:25 +01:00
mesh_ps.c
mesh_sync.c
mesh.c mac80211: mesh: convert path table to rhashtable 2016-04-05 10:56:33 +02:00
mesh.h mac80211: mesh: fix crash in mesh_path_timer 2016-04-05 21:34:49 +02:00
michael.c
michael.h
mlme.c mac80211: avoid useless memory write on each frame RX 2016-04-05 21:34:21 +02:00
ocb.c
offchannel.c
pm.c
rate.c
rate.h mac80211: remove sta_info debugfs sub-struct 2016-04-05 11:59:05 +02:00
rc80211_minstrel_debugfs.c
rc80211_minstrel_ht_debugfs.c
rc80211_minstrel_ht.c mac80211: minstrel_ht: improve sample rate skip logic 2016-04-05 11:40:06 +02:00
rc80211_minstrel_ht.h
rc80211_minstrel.c mac80211: minstrel: Change expected throughput unit back to Kbps 2016-02-02 15:57:02 +01:00
rc80211_minstrel.h
rx.c mac80211: fix cipher scheme function name 2016-04-05 12:12:41 +02:00
scan.c mac80211: Support a scan request for a specific BSSID 2016-04-05 10:56:28 +02:00
spectmgmt.c
sta_info.c mac80211: track and tell driver about GO client P2P PS abilities 2016-04-05 21:34:49 +02:00
sta_info.h mac80211: clean up station flags debugfs 2016-04-05 12:12:26 +02:00
status.c mac80211: use reset to set header pointer 2016-03-04 22:45:13 -05:00
tdls.c
tkip.c mac80211: move TKIP TX IVs to public part of key struct 2016-02-24 09:04:38 +01:00
tkip.h mac80211: move TKIP TX IVs to public part of key struct 2016-02-24 09:04:38 +01:00
trace_msg.h
trace.c
trace.h mac80211: synchronize driver rx queues before removing a station 2016-04-05 10:56:34 +02:00
tx.c mac80211: do not pass injected frames without a valid rate to the driver 2016-04-05 10:58:21 +02:00
util.c mac80211: allow not sending MIC up from driver for HW crypto 2016-04-05 10:48:56 +02:00
vht.c mac80211: move MU_MIMO_OWNER flag to ieee80211_vif 2016-02-24 09:04:40 +01:00
wep.c
wep.h
wme.c
wme.h
wpa.c mac80211: allow not sending MIC up from driver for HW crypto 2016-04-05 10:48:56 +02:00
wpa.h