From: Pavel Roskin <proski@gnu.org>
To: Larry Finger <Larry.Finger@lwfinger.net>
Cc: Johannes Berg <johannes@sipsolutions.net>,
John Linville <linville@tuxdriver.com>,
wireless <linux-wireless@vger.kernel.org>
Subject: Re: BUG in latest wireless-testing pull - 2.6.31-rc4
Date: Sat, 25 Jul 2009 00:21:55 -0400 [thread overview]
Message-ID: <1248495715.2391.7.camel@ct> (raw)
In-Reply-To: <4A6A7D95.1080103@lwfinger.net>
On Fri, 2009-07-24 at 22:35 -0500, Larry Finger wrote:
> I pulled from the wireless-testing (git describe yields
> v2.6.31-rc4-29133-g1addf37) and get the following BUG:
>
> BUG: unable to handle kernel NULL pointer dereference at 000000000000000c
> IP: [<ffffffffa0267fc1>] ieee80211_scan_work+0x18a/0x426 [mac80211]
I got it too :-(
> chan = local->scan_req->channels[local->scan_channel_idx];
>
> in ieee80211_scan_state_set_channel().
The same thing here.
The oops happens when local->scan_channel_idx reaches 14, which is
local->scan_req->n_channels.
I tried this patch:
--- a/net/mac80211/scan.c
+++ b/net/mac80211/scan.c
@@ -588,6 +588,10 @@ static void ieee80211_scan_state_set_channel(struct ieee80211_local *local,
struct ieee80211_sub_if_data *sdata = local->scan_sdata;
skip = 0;
+
+ if (local->scan_channel_idx >= local->scan_req->n_channels)
+ return;
+
chan = local->scan_req->channels[local->scan_channel_idx];
if (chan->flags & IEEE80211_CHAN_DISABLED ||
It prevents the oops, but now udev hangs on startup. Perhaps
ieee80211_scan_state_set_channel() shouldn't set local->scan_channel_idx
to an invalid value in the first place. Or maybe if it happens,
something else should be done to stop the scan.
--
Regards,
Pavel Roskin
prev parent reply other threads:[~2009-07-25 4:23 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2009-07-25 3:35 BUG in latest wireless-testing pull - 2.6.31-rc4 Larry Finger
2009-07-25 4:21 ` Pavel Roskin [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1248495715.2391.7.camel@ct \
--to=proski@gnu.org \
--cc=Larry.Finger@lwfinger.net \
--cc=johannes@sipsolutions.net \
--cc=linux-wireless@vger.kernel.org \
--cc=linville@tuxdriver.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).