From: "Nicolas Escande" <nico.escande@gmail.com>
To: "Remi Pommarel" <repk@triplefau.lt>,
"Johannes Berg" <johannes@sipsolutions.net>
Cc: "Antonio Quartulli" <antonio@open-mesh.com>,
<linux-wireless@vger.kernel.org>,
<b.a.t.m.a.n@lists.open-mesh.org>, <linux-kernel@vger.kernel.org>
Subject: Re: [PATCH] wifi: cfg80211: Lock wiphy in cfg80211_get_station
Date: Tue, 21 May 2024 09:01:08 +0200 [thread overview]
Message-ID: <D1F4NY5F73YD.1T55A9QAAA1N@gmail.com> (raw)
In-Reply-To: <983b24a6a176e0800c01aedcd74480d9b551cb13.1716046653.git.repk@triplefau.lt>
On Sat May 18, 2024 at 5:50 PM CEST, Remi Pommarel wrote:
> Wiphy should be locked before calling rdev_get_station() (see lockdep
> assert in ieee80211_get_station()).
>
> This fixes the following kernel NULL dereference:
>
> Unable to handle kernel NULL pointer dereference at virtual address 0000000000000050
> Mem abort info:
> ESR = 0x0000000096000006
> EC = 0x25: DABT (current EL), IL = 32 bits
> SET = 0, FnV = 0
> EA = 0, S1PTW = 0
> FSC = 0x06: level 2 translation fault
> Data abort info:
> ISV = 0, ISS = 0x00000006
> CM = 0, WnR = 0
> user pgtable: 4k pages, 48-bit VAs, pgdp=0000000003001000
> [0000000000000050] pgd=0800000002dca003, p4d=0800000002dca003, pud=08000000028e9003, pmd=0000000000000000
> Internal error: Oops: 0000000096000006 [#1] SMP
> Modules linked in: netconsole dwc3_meson_g12a dwc3_of_simple dwc3 ip_gre gre ath10k_pci ath10k_core ath9k ath9k_common ath9k_hw ath
> CPU: 0 PID: 1091 Comm: kworker/u8:0 Not tainted 6.4.0-02144-g565f9a3a7911-dirty #705
> Hardware name: RPT (r1) (DT)
> Workqueue: bat_events batadv_v_elp_throughput_metric_update
> pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
> pc : ath10k_sta_statistics+0x10/0x2dc [ath10k_core]
> lr : sta_set_sinfo+0xcc/0xbd4
> sp : ffff000007b43ad0
> x29: ffff000007b43ad0 x28: ffff0000071fa900 x27: ffff00000294ca98
> x26: ffff000006830880 x25: ffff000006830880 x24: ffff00000294c000
> x23: 0000000000000001 x22: ffff000007b43c90 x21: ffff800008898acc
> x20: ffff00000294c6e8 x19: ffff000007b43c90 x18: 0000000000000000
> x17: 445946354d552d78 x16: 62661f7200000000 x15: 57464f445946354d
> x14: 0000000000000000 x13: 00000000000000e3 x12: d5f0acbcebea978e
> x11: 00000000000000e3 x10: 000000010048fe41 x9 : 0000000000000000
> x8 : ffff000007b43d90 x7 : 000000007a1e2125 x6 : 0000000000000000
> x5 : ffff0000024e0900 x4 : ffff800000a0250c x3 : ffff000007b43c90
> x2 : ffff00000294ca98 x1 : ffff000006831920 x0 : 0000000000000000
> Call trace:
> ath10k_sta_statistics+0x10/0x2dc [ath10k_core]
> sta_set_sinfo+0xcc/0xbd4
> ieee80211_get_station+0x2c/0x44
> cfg80211_get_station+0x80/0x154
> batadv_v_elp_get_throughput+0x138/0x1fc
> batadv_v_elp_throughput_metric_update+0x1c/0xa4
> process_one_work+0x1ec/0x414
> worker_thread+0x70/0x46c
> kthread+0xdc/0xe0
> ret_from_fork+0x10/0x20
> Code: a9bb7bfd 910003fd a90153f3 f9411c40 (f9402814)
>
> Fixes: 7406353d43c8 ("cfg80211: implement cfg80211_get_station cfg80211 API")
> Signed-off-by: Remi Pommarel <repk@triplefau.lt>
Reviewed-by: Nicolas Escande <nico.escande@gmail.com>
next prev parent reply other threads:[~2024-05-21 7:01 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-05-18 15:50 [PATCH] wifi: cfg80211: Lock wiphy in cfg80211_get_station Remi Pommarel
2024-05-21 19:47 ` [PATCH v2] " Remi Pommarel
2024-05-21 7:01 ` Nicolas Escande [this message]
2024-05-21 7:12 ` [PATCH] " Johannes Berg
2024-05-21 7:43 ` Antonio Quartulli
2024-05-21 12:15 ` Remi Pommarel
2024-05-21 14:51 ` Antonio Quartulli
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=D1F4NY5F73YD.1T55A9QAAA1N@gmail.com \
--to=nico.escande@gmail.com \
--cc=antonio@open-mesh.com \
--cc=b.a.t.m.a.n@lists.open-mesh.org \
--cc=johannes@sipsolutions.net \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-wireless@vger.kernel.org \
--cc=repk@triplefau.lt \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.