Skip to content
  • Zhu Yi's avatar
    mac80211: fix NULL pointer dereference when ftrace is enabled · 3092ad05
    Zhu Yi authored
    
    
    I got below kernel oops when I try to bring down the network interface if
    ftrace is enabled. The root cause is drv_ampdu_action() is passed with a
    NULL ssn pointer in the BA session tear down case. We need to check and
    avoid dereferencing it in trace entry assignment.
    
    BUG: unable to handle kernel NULL pointer dereference
    Modules linked in: at (null)
    IP: [<f98fe02a>] ftrace_raw_event_drv_ampdu_action+0x10a/0x160 [mac80211]
    *pde = 00000000
    Oops: 0000 [#1] SMP DEBUG_PAGEALLOC
    [...]
    Call Trace:
     [<f98fdf20>] ? ftrace_raw_event_drv_ampdu_action+0x0/0x160 [mac80211]
     [<f98dac4c>] ? __ieee80211_stop_rx_ba_session+0xfc/0x220 [mac80211]
     [<f98d97fb>] ? ieee80211_sta_tear_down_BA_sessions+0x3b/0x50 [mac80211]
     [<f98dc6f6>] ? ieee80211_set_disassoc+0xe6/0x230 [mac80211]
     [<f98dc6ac>] ? ieee80211_set_disassoc+0x9c/0x230 [mac80211]
     [<f98dcbb8>] ? ieee80211_mgd_deauth+0x158/0x170 [mac80211]
     [<f98e4bdb>] ? ieee80211_deauth+0x1b/0x20 [mac80211]
     [<f8987f49>] ? __cfg80211_mlme_deauth+0xe9/0x120 [cfg80211]
     [<f898b870>] ? __cfg80211_disconnect+0x170/0x1d0 [cfg80211]
    
    Cc: Johannes Berg <johannes@sipsolutions.net>
    Cc: stable@kernel.org
    Signed-off-by: default avatarZhu Yi <yi.zhu@intel.com>
    Signed-off-by: default avatarJohn W. Linville <linville@tuxdriver.com>
    3092ad05