Re: Null pointer dereference when station associates [introduced by 4.0.5?]

[Tom Hughes <tom@compton.nu>]

On 29/06/15 11:24, Tom Hughes wrote:

> So I think this happens when hostapd switches the interface
> to AP mode, which causes the netdev to be torn down and then
> recreated, and the debugfs directory along with it.
>
> Except that if the netlink message to change the mode was
> sent from a daemon whose selinux context prevents searching
> debugfs the recreation somehow fails and leaves an invalid
> state that later causes the null pointer deref.

Think I have it...

The teardown runs ieee80211_debugfs_remove_netdev
which clears sdata->vif.debugfs_dir but does not clear 
sdata->debugfs.subdir_stations so that when ieee80211_debugfs_add_netdev 
later fails to create the top level
netdev directory we are left with a bogus pointer for the stations 
directory.

Then when we try and add an entry to the stations directory things blow up.

Tom

-- 
Tom Hughes (tom@compton.nu)
http://compton.nu/