Commit 3a33cc10 authored by Ian Schram's avatar Ian Schram Committed by David S. Miller

mac80211_hwsim.c: fix: BUG: unable to handle kernel NULL pointer dereference at 0000000000000370

I was looking at this out of interest, but I'm in no way familiar with
the code.

Looks to me that the error handling code in mac80211_hwsim is awkward.
Which leads to it calling ieee80211_unregister_hw even when
ieee80211_register_hw failed.

The function has a for loop where it generates all simulated radios.
when something fails, the error handling will call mac80211_hwsim_free
which frees all simulated radios who's pointer isn't zero. However the
information stored is insufficient to determine whether or not the call
to ieee80211_register_hw succeeded or not for a specific radio. The
included patch makes init_mac80211_hwsim clean up the current simulated
radio, and then calls into mac80211_hwsim_free to clean up all the
radios that did succeed.

This however doesn't explain why the rate control registration failed..
build tested this, but had some problems reproducing the original
problem.
Signed-off-by: default avatarIan Schram <ischram@telenet.be>
Signed-off-by: default avatarIngo Molnar <mingo@elte.hu>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 5547cd0a
...@@ -364,8 +364,7 @@ static void mac80211_hwsim_free(void) ...@@ -364,8 +364,7 @@ static void mac80211_hwsim_free(void)
struct mac80211_hwsim_data *data; struct mac80211_hwsim_data *data;
data = hwsim_radios[i]->priv; data = hwsim_radios[i]->priv;
ieee80211_unregister_hw(hwsim_radios[i]); ieee80211_unregister_hw(hwsim_radios[i]);
if (!IS_ERR(data->dev)) device_unregister(data->dev);
device_unregister(data->dev);
ieee80211_free_hw(hwsim_radios[i]); ieee80211_free_hw(hwsim_radios[i]);
} }
} }
...@@ -437,7 +436,7 @@ static int __init init_mac80211_hwsim(void) ...@@ -437,7 +436,7 @@ static int __init init_mac80211_hwsim(void)
"mac80211_hwsim: device_create_drvdata " "mac80211_hwsim: device_create_drvdata "
"failed (%ld)\n", PTR_ERR(data->dev)); "failed (%ld)\n", PTR_ERR(data->dev));
err = -ENOMEM; err = -ENOMEM;
goto failed; goto failed_drvdata;
} }
data->dev->driver = &mac80211_hwsim_driver; data->dev->driver = &mac80211_hwsim_driver;
...@@ -461,7 +460,7 @@ static int __init init_mac80211_hwsim(void) ...@@ -461,7 +460,7 @@ static int __init init_mac80211_hwsim(void)
if (err < 0) { if (err < 0) {
printk(KERN_DEBUG "mac80211_hwsim: " printk(KERN_DEBUG "mac80211_hwsim: "
"ieee80211_register_hw failed (%d)\n", err); "ieee80211_register_hw failed (%d)\n", err);
goto failed; goto failed_hw;
} }
printk(KERN_DEBUG "%s: hwaddr %s registered\n", printk(KERN_DEBUG "%s: hwaddr %s registered\n",
...@@ -479,9 +478,9 @@ static int __init init_mac80211_hwsim(void) ...@@ -479,9 +478,9 @@ static int __init init_mac80211_hwsim(void)
rtnl_lock(); rtnl_lock();
err = dev_alloc_name(hwsim_mon, hwsim_mon->name); err = dev_alloc_name(hwsim_mon, hwsim_mon->name);
if (err < 0) { if (err < 0)
goto failed_mon; goto failed_mon;
}
err = register_netdevice(hwsim_mon); err = register_netdevice(hwsim_mon);
if (err < 0) if (err < 0)
...@@ -494,7 +493,14 @@ static int __init init_mac80211_hwsim(void) ...@@ -494,7 +493,14 @@ static int __init init_mac80211_hwsim(void)
failed_mon: failed_mon:
rtnl_unlock(); rtnl_unlock();
free_netdev(hwsim_mon); free_netdev(hwsim_mon);
mac80211_hwsim_free();
return err;
failed_hw:
device_unregister(data->dev);
failed_drvdata:
ieee80211_free_hw(hw);
hwsim_radios[i] = 0;
failed: failed:
mac80211_hwsim_free(); mac80211_hwsim_free();
return err; return err;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment