| Message ID | CAAnMG+OgtSzFXqLOoZ-JbOr7xnexC3P0+M0fFLWTBtWru=4SKg@mail.gmail.com (mailing list archive) |
|---|---|
| State | Changes Requested |
| Delegated to: | Johannes Berg |
| Headers | show |
diff --git a/net/mac80211/mesh_hwmp.c b/net/mac80211/mesh_hwmp.c index 214e63b..14e146e 100644 --- a/net/mac80211/mesh_hwmp.c +++ b/net/mac80211/mesh_hwmp.c @@ -1081,6 +1081,11 @@ int mesh_nexthop_resolve(struct ieee80211_sub_if_data *sdata, if (!err) goto endlookup; + if (err == -EPERM) { + mesh_path_discard_frame(sdata, skb); + goto endlookup; + } + /* no nexthop found, start resolving */ mpath = mesh_path_lookup(sdata, target_addr);
This patch fixes a NULL dereference in ath9k (and likely other drivers) when fixed mesh paths are used. The problem is that when a station comes up sta_info_alloc allocates ath_node implicitly via hw->sta_data_size. When it does that the ath_node is zeroed out. The ath_node isn’t actually initialized until the station becomes associated and ath9k_sta_state is called. Normally this is OK because paths won't be formed to a station that isn't authorized. But when the path is fixed the MAC thinks it knows how to route the packet, sends it down to ath9k, and winds up inducing reboots in places like ath_tx_start when tid->ac is dereferenced. Signed-off-by: Alexis Green <agreen@cococorp.com> CC: Jesse Jones <jjones@cococorp.com> --- if (!mpath) { @@ -1145,6 +1150,12 @@ int mesh_nexthop_lookup(struct ieee80211_sub_if_data *sdata, next_hop = rcu_dereference(mpath->next_hop); if (next_hop) { + if (mpath->flags & MESH_PATH_FIXED) { + if (next_hop->sta_state != IEEE80211_STA_AUTHORIZED) { + err = -EPERM; + goto endlookup; + } + } memcpy(hdr->addr1, next_hop->sta.addr, ETH_ALEN); memcpy(hdr->addr2, sdata->vif.addr, ETH_ALEN); ieee80211_mps_set_frame_flags(sdata, next_hop, hdr); -- To unsubscribe from this list: send the line "unsubscribe linux-wireless" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html