This patch fixes a NULL dereference in ath9k (and likely other drivers) when
fixed mesh paths are used. The problem is that when a station comes up
sta_info_alloc allocates ath_node implicitly via hw->sta_data_size. When it
does that the ath_node is zeroed out. The ath_node isn’t actually initialized
until the station becomes associated and ath9k_sta_state is called.
Normally this is OK because paths won't be formed to a station that isn't
authorized. But when the path is fixed the MAC thinks it knows how to
route the packet, sends it down to ath9k, and winds up inducing reboots
in places like ath_tx_start when tid->ac is dereferenced.
Signed-off-by: Alexis Green <agreen@xxxxxxxxxxxx>
CC: Jesse Jones <jjones@xxxxxxxxxxxx>
---
diff --git a/net/mac80211/mesh_hwmp.c b/net/mac80211/mesh_hwmp.c
index 214e63b..14e146e 100644
--- a/net/mac80211/mesh_hwmp.c
+++ b/net/mac80211/mesh_hwmp.c
@@ -1081,6 +1081,11 @@ int mesh_nexthop_resolve(struct
ieee80211_sub_if_data *sdata,
if (!err)
goto endlookup;
+ if (err == -EPERM) {
+ mesh_path_discard_frame(sdata, skb);
+ goto endlookup;
+ }
+
/* no nexthop found, start resolving */
mpath = mesh_path_lookup(sdata, target_addr);
if (!mpath) {
@@ -1145,6 +1150,12 @@ int mesh_nexthop_lookup(struct
ieee80211_sub_if_data *sdata,
next_hop = rcu_dereference(mpath->next_hop);
if (next_hop) {
+ if (mpath->flags & MESH_PATH_FIXED) {
+ if (next_hop->sta_state != IEEE80211_STA_AUTHORIZED) {
+ err = -EPERM;
+ goto endlookup;
+ }
+ }
memcpy(hdr->addr1, next_hop->sta.addr, ETH_ALEN);
memcpy(hdr->addr2, sdata->vif.addr, ETH_ALEN);
ieee80211_mps_set_frame_flags(sdata, next_hop, hdr);
--
To unsubscribe from this list: send the line "unsubscribe linux-wireless" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
