From patchwork Fri Apr 19 09:20:42 2013 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: voncken X-Patchwork-Id: 2463731 Return-Path: X-Original-To: patchwork-linux-wireless@patchwork.kernel.org Delivered-To: patchwork-process-083081@patchwork1.kernel.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by patchwork1.kernel.org (Postfix) with ESMTP id 4DEEE3FD1A for ; Fri, 19 Apr 2013 09:20:49 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1757858Ab3DSJUr (ORCPT ); Fri, 19 Apr 2013 05:20:47 -0400 Received: from smtp08.msg.oleane.net ([62.161.4.8]:55365 "EHLO smtp08.msg.oleane.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1757809Ab3DSJUr (ORCPT ); Fri, 19 Apr 2013 05:20:47 -0400 Received: from acksys.fr ([195.6.104.67]) (authenticated) by smtp08.msg.oleane.net (MTA) with ESMTP id r3J9Kicm021758 for ; Fri, 19 Apr 2013 11:20:44 +0200 Received: from localhost.localdomain ([192.168.1.29]) by acksys.fr with Microsoft SMTPSVC(6.0.3790.4675); Fri, 19 Apr 2013 11:21:22 +0200 From: cedric voncken To: linux-wireless@vger.kernel.org Cc: cedric voncken Subject: [PATCH] mac80211: Fix driver crash when STA_NOTIFY_AWAKE occures Date: Fri, 19 Apr 2013 11:20:42 +0200 Message-Id: <1366363242-29481-1-git-send-email-cedric.voncken@acksys.fr> X-Mailer: git-send-email 1.7.2.5 X-OriginalArrivalTime: 19 Apr 2013 09:21:22.0015 (UTC) FILETIME=[41D49EF0:01CE3CDF] X-Spam-Flag: NO X-PMX-Spam: Probability=8% X-PFSI-Info: PMX 5.6.0.2009776, Antispam-Engine: 2.7.2.376379, Antispam-Data: 2013.4.19.90617 (no antivirus check) X-Orange-Auth: bWMxNDg4LTg= Sender: linux-wireless-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-wireless@vger.kernel.org If the device uses the HT mode and receives a frame from a sta whith state < IEEE80211_STA_ASSOC then the null pointer exception crashes the Linnux kernel. In the case of ath9k, the function ath_tx_node_init is indirectly called by drv_sta_state (in net/mac80211/driver-ops.h) only when the sta_state goes to IEEE80211_STA_ASSOC from IEEE80211_STA_AUTH. Signed-off-by: cedric VONCKEN --- net/mac80211/sta_info.c | 3 ++- 1 files changed, 2 insertions(+), 1 deletions(-) diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c index 11216bc..bcfd7b0 100644 --- a/net/mac80211/sta_info.c +++ b/net/mac80211/sta_info.c @@ -1040,7 +1040,8 @@ void ieee80211_sta_ps_deliver_wakeup(struct sta_info *sta) BUILD_BUG_ON(BITS_TO_LONGS(IEEE80211_NUM_TIDS) > 1); sta->driver_buffered_tids = 0; - if (!(local->hw.flags & IEEE80211_HW_AP_LINK_PS)) + if (!(local->hw.flags & IEEE80211_HW_AP_LINK_PS && + sta->sta_state >= IEEE80211_STA_ASSOC)) drv_sta_notify(local, sdata, STA_NOTIFY_AWAKE, &sta->sta); skb_queue_head_init(&pending);