0033-mac80211-fix-crash-when-using-mesh-11s-VIF-together-with-another-VIF.patch 2.9 KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576777879808182
  1. From: Matthias Schiffer <mschiffer@universe-factory.net>
  2. Date: Sat, 24 Oct 2015 21:53:10 +0200
  3. Subject: mac80211: fix crash when using mesh (11s) VIF together with another VIF
  4. Using a 802.11s mesh VIF together with a different VIF (e.g. IBSS) led to
  5. a panic.
  6. Steps to reproduce:
  7. rmmod mac80211_hwsim
  8. insmod /lib/modules/3.18.21/mac80211_hwsim.ko channels=2
  9. iw phy phy2 interface add ibss2 type ibss
  10. iw phy phy2 interface add mesh2 type mp
  11. iw phy phy3 interface add ibss3 type ibss
  12. iw phy phy3 interface add mesh3 type mp
  13. ip link set ibss2 up
  14. ip link set mesh2 up
  15. ip link set ibss3 up
  16. ip link set mesh3 up
  17. iw dev ibss2 ibss join foo 2412
  18. iw dev ibss3 ibss join foo 2412
  19. # Ensure that ibss2 and ibss3 are associated, otherwise leave and join
  20. # on ibss3 again
  21. iw dev mesh2 mesh join bar
  22. iw dev mesh3 mesh join bar
  23. The patch has also been submitted upstream.
  24. Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
  25. diff --git a/package/kernel/mac80211/patches/339-mac80211-fix-crash-on-mesh-local-link-ID-generation-.patch b/package/kernel/mac80211/patches/339-mac80211-fix-crash-on-mesh-local-link-ID-generation-.patch
  26. new file mode 100644
  27. index 0000000..5784b98
  28. --- /dev/null
  29. +++ b/package/kernel/mac80211/patches/339-mac80211-fix-crash-on-mesh-local-link-ID-generation-.patch
  30. @@ -0,0 +1,46 @@
  31. +From 604f8b1964b8380eddf1f03dbdafa7a1c13d80d6 Mon Sep 17 00:00:00 2001
  32. +Message-Id: <604f8b1964b8380eddf1f03dbdafa7a1c13d80d6.1445716231.git.mschiffer@universe-factory.net>
  33. +From: Matthias Schiffer <mschiffer@universe-factory.net>
  34. +Date: Sat, 24 Oct 2015 21:25:51 +0200
  35. +Subject: [PATCH] mac80211: fix crash on mesh local link ID generation with
  36. + VIFs
  37. +
  38. +llid_in_use needs to be limited to stations of the same VIF, otherwise it
  39. +will cause a NULL deref as the sta_info of non-mesh-VIFs don't have
  40. +sta->mesh set.
  41. +
  42. +Steps to reproduce:
  43. +
  44. + modprobe mac80211_hwsim channels=2
  45. + iw phy phy0 interface add ibss0 type ibss
  46. + iw phy phy0 interface add mesh0 type mp
  47. + iw phy phy1 interface add ibss1 type ibss
  48. + iw phy phy1 interface add mesh1 type mp
  49. + ip link set ibss0 up
  50. + ip link set mesh0 up
  51. + ip link set ibss1 up
  52. + ip link set mesh1 up
  53. + iw dev ibss0 ibss join foo 2412
  54. + iw dev ibss1 ibss join foo 2412
  55. + # Ensure that ibss0 and ibss1 are actually associated; I often need to
  56. + # leave and join the cell on ibss1 a second time.
  57. + iw dev mesh0 mesh join bar
  58. + iw dev mesh1 mesh join bar # crash
  59. +
  60. +Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
  61. +---
  62. + net/mac80211/mesh_plink.c | 3 +++
  63. + 1 file changed, 3 insertions(+)
  64. +
  65. +--- a/net/mac80211/mesh_plink.c
  66. ++++ b/net/mac80211/mesh_plink.c
  67. +@@ -646,6 +646,9 @@ static bool llid_in_use(struct ieee80211
  68. +
  69. + rcu_read_lock();
  70. + list_for_each_entry_rcu(sta, &local->sta_list, list) {
  71. ++ if (sdata != sta->sdata)
  72. ++ continue;
  73. ++
  74. + if (!memcmp(&sta->mesh->llid, &llid, sizeof(llid))) {
  75. + in_use = true;
  76. + break;