• Miaoqing Pan's avatar
    nl80211: fix null pointer dereference · b501426c
    Miaoqing Pan authored
    If the interface is not in MESH mode, the command 'iw wlanx mpath del'
    will cause kernel panic.
    
    The root cause is null pointer access in mpp_flush_by_proxy(), as the
    pointer 'sdata->u.mesh.mpp_paths' is NULL for non MESH interface.
    
    Unable to handle kernel NULL pointer dereference at virtual address 00000068
    [...]
    PC is at _raw_spin_lock_bh+0x20/0x5c
    LR is at mesh_path_del+0x1c/0x17c [mac80211]
    [...]
    Process iw (pid: 4537, stack limit = 0xd83e0238)
    [...]
    [<c021211c>] (_raw_spin_lock_bh) from [<bf8c7648>] (mesh_path_del+0x1c/0x17c [mac80211])
    [<bf8c7648>] (mesh_path_del [mac80211]) from [<bf6cdb7c>] (extack_doit+0x20/0x68 [compat])
    [<bf6cdb7c>] (extack_doit [compat]) from [<c05c309c>] (genl_rcv_msg+0x274/0x30c)
    [<c05c309c>] (genl_rcv_msg) from [<c05c25d8>] (netlink_rcv_skb+0x58/0xac)
    [<c05c25d8>] (netlink_rcv_skb) from [<c05c2e14>] (genl_rcv+0x20/0x34)
    [<c05c2e14>] (genl_rcv) from [<c05c1f90>] (netlink_unicast+0x11c/0x204)
    [<c05c1f90>] (netlink_unicast) from [<c05c2420>] (netlink_sendmsg+0x30c/0x370)
    [<c05c2420>] (netlink_sendmsg) from [<c05886d0>] (sock_sendmsg+0x70/0x84)
    [<c05886d0>] (sock_sendmsg) from [<c0589f4c>] (___sys_sendmsg.part.3+0x188/0x228)
    [<c0589f4c>] (___sys_sendmsg.part.3) from [<c058add4>] (__sys_sendmsg+0x4c/0x70)
    [<c058add4>] (__sys_sendmsg) from [<c0208c80>] (ret_fast_syscall+0x0/0x44)
    Code: e2822c02 e2822001 e5832004 f590f000 (e1902f9f)
    ---[ end trace bbd717600f8f884d ]---
    Signed-off-by: default avatarMiaoqing Pan <miaoqing@codeaurora.org>
    Link: https://lore.kernel.org/r/1569485810-761-1-git-send-email-miaoqing@codeaurora.org
    [trim useless data from commit message]
    Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
    b501426c
nl80211.c 456 KB