diff options
| author |   Emmanuel Grumbach <emmanuel.grumbach@intel.com> | 2017-06-12 15:10:09 +0300 |
|---|---|---|
| committer |   Luca Coelho <luciano.coelho@intel.com> | 2017-07-21 12:26:37 +0300 |
| commit | 61dd8a8a6a0c3cbfb6b02ab652c4f4efb93f3d79 (patch) | |
| tree | 8c7d54f6a8661d448dbb9e6983a633f58b14afe7 /drivers | |
| parent | iwlwifi: pcie: fix unused txq NULL pointer dereference (diff) | |
| download | linux-dev-61dd8a8a6a0c3cbfb6b02ab652c4f4efb93f3d79.tar.xz linux-dev-61dd8a8a6a0c3cbfb6b02ab652c4f4efb93f3d79.zip | |
iwlwifi: mvm: fix a NULL pointer dereference of error in recovery
Sometimes, we can have an firmware crash while trying to
recover from a previous firmware problem.
When that happens, lots of things can go wrong. For example
the stations don't get added properly to mvm->fw_id_to_mac_id.
Mac80211 tries to stop A-MPDU upon reconfig but in case of
a firmware crash we will bail out fairly early and in the
end, we won't delete the A-MPDU Rx timeout.
When that timer expired after a double firmware crash,
we end up dereferencing mvm->fw_id_to_mac_id[sta_id]
which is NULL.
Fixes: 10b2b2019d81 ("iwlwifi: mvm: add infrastructure for tracking BA session in driver")
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/net/wireless/intel/iwlwifi/mvm/sta.c | 12 |
1 files changed, 12 insertions, 0 deletions
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c index 4df5f13fcdae..4a6df45b73df 100644 --- a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c +++ b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c @@ -277,6 +277,18 @@ static void iwl_mvm_rx_agg_session_expired(unsigned long data) /* Timer expired */ sta = rcu_dereference(ba_data->mvm->fw_id_to_mac_id[ba_data->sta_id]); + + /* + * sta should be valid unless the following happens: + * The firmware asserts which triggers a reconfig flow, but + * the reconfig fails before we set the pointer to sta into + * the fw_id_to_mac_id pointer table. Mac80211 can't stop + * A-MDPU and hence the timer continues to run. Then, the + * timer expires and sta is NULL. + */ + if (!sta) + goto unlock; + mvm_sta = iwl_mvm_sta_from_mac80211(sta); ieee80211_stop_rx_ba_session_offl(mvm_sta->vif, sta->addr, ba_data->tid); |