2011-07-19 21:42:58

by Pavel Roskin

[permalink] [raw]
Subject: Kernel oops in code added by "cfg80211: allow userspace to control supported rates in scan"

Hello!

The current wireless-testing.git has a problem. I'm trying to run
wpa_supplicant on an interface created by carl9170 (with nl80211
driver), and it oopses in nl80211_trigger_scan(). It turns out it
oopses here:

for (i = 0; i < IEEE80211_NUM_BANDS; i++)
request->rates[i] = (1 << wiphy->bands[i]->n_bitrates) - 1;

Here's the self-explanatory debug output I added:

[ 460.190157] IEEE80211_NUM_BANDS = 2
[ 460.193636] request = ffff8801246dc500
[ 460.197373] request->rates = ffff8801246dc520
[ 460.201748] wiphy = ffff8800b78b84e0
[ 460.205317] wiphy->bands = ffff8800b78b8590
[ 460.209489] i = 0, wiphy->bands[i] = ffffffffa00a80a0
[ 460.214559] i = 1, wiphy->bands[i] = (null)

wiphy->bands[1] is NULL, so wiphy->bands[1]->n_bitrates is invalid.

Likewise, if I run "iwconfig wlanX scan", I get an oops in
cfg80211_wext_siwscan() on line 866:

for (i = 0; i < IEEE80211_NUM_BANDS; i++)
creq->rates[i] = (1 << wiphy->bands[i]->n_bitrates) - 1;

Both pieces of code were added by:

commit 58389c69150e6032504dfcd3edca6b1975c8b5bc
Author: Johannes Berg <[email protected]>
Date: Mon Jul 18 18:08:35 2011 +0200

cfg80211: allow userspace to control supported rates in scan

--
Regards,
Pavel Roskin


2011-07-19 21:55:21

by Johannes Berg

[permalink] [raw]
Subject: Re: Kernel oops in code added by "cfg80211: allow userspace to control supported rates in scan"

On Tue, 2011-07-19 at 17:42 -0400, Pavel Roskin wrote:

> for (i = 0; i < IEEE80211_NUM_BANDS; i++)
> request->rates[i] = (1 << wiphy->bands[i]->n_bitrates) - 1;

Ah crap, I didn't pay attention and never tested a single-band card.
Below change should fix it.

johannes
---
net/wireless/nl80211.c | 4 +++-
net/wireless/scan.c | 3 ++-
net/wireless/util.c | 3 +++
3 files changed, 8 insertions(+), 2 deletions(-)

--- a/net/wireless/nl80211.c 2011-07-19 23:52:44.000000000 +0200
+++ b/net/wireless/nl80211.c 2011-07-19 23:53:26.000000000 +0200
@@ -3454,7 +3454,9 @@ static int nl80211_trigger_scan(struct s
}

for (i = 0; i < IEEE80211_NUM_BANDS; i++)
- request->rates[i] = (1 << wiphy->bands[i]->n_bitrates) - 1;
+ if (wiphy->bands[i])
+ request->rates[i] =
+ (1 << wiphy->bands[i]->n_bitrates) - 1;

if (info->attrs[NL80211_ATTR_SCAN_SUPP_RATES]) {
nla_for_each_nested(attr,
--- a/net/wireless/scan.c 2011-07-19 23:52:45.000000000 +0200
+++ b/net/wireless/scan.c 2011-07-19 23:53:21.000000000 +0200
@@ -864,7 +864,8 @@ int cfg80211_wext_siwscan(struct net_dev
}

for (i = 0; i < IEEE80211_NUM_BANDS; i++)
- creq->rates[i] = (1 << wiphy->bands[i]->n_bitrates) - 1;
+ if (wiphy->bands[i])
+ creq->rates[i] = (1 << wiphy->bands[i]->n_bitrates) - 1;

rdev->scan_req = creq;
err = rdev->ops->scan(wiphy, dev, creq);
--- a/net/wireless/util.c 2011-07-19 23:53:39.000000000 +0200
+++ b/net/wireless/util.c 2011-07-19 23:53:57.000000000 +0200
@@ -1013,6 +1013,9 @@ int ieee80211_get_ratemask(struct ieee80
{
int i, j;

+ if (!sband)
+ return -EINVAL;
+
if (n_rates == 0 || n_rates > NL80211_MAX_SUPP_RATES)
return -EINVAL;




2011-07-19 22:01:25

by Pavel Roskin

[permalink] [raw]
Subject: Re: Kernel oops in code added by "cfg80211: allow userspace to control supported rates in scan"

On 07/19/2011 05:55 PM, Johannes Berg wrote:
> On Tue, 2011-07-19 at 17:42 -0400, Pavel Roskin wrote:
>
>> for (i = 0; i< IEEE80211_NUM_BANDS; i++)
>> request->rates[i] = (1<< wiphy->bands[i]->n_bitrates) - 1;
>
> Ah crap, I didn't pay attention and never tested a single-band card.
> Below change should fix it.

Tested-by: Pavel Roskin <[email protected]>

The ultimate test - sending via the wireless connection :)

--
Regards,
Pavel Roskin

2011-07-19 22:26:52

by Johannes Berg

[permalink] [raw]
Subject: Re: Kernel oops in code added by "cfg80211: allow userspace to control supported rates in scan"

On Tue, 2011-07-19 at 18:01 -0400, Pavel Roskin wrote:
> On 07/19/2011 05:55 PM, Johannes Berg wrote:
> > On Tue, 2011-07-19 at 17:42 -0400, Pavel Roskin wrote:
> >
> >> for (i = 0; i< IEEE80211_NUM_BANDS; i++)
> >> request->rates[i] = (1<< wiphy->bands[i]->n_bitrates) - 1;
> >
> > Ah crap, I didn't pay attention and never tested a single-band card.
> > Below change should fix it.
>
> Tested-by: Pavel Roskin <[email protected]>
>
> The ultimate test - sending via the wireless connection :)

:)
I'll run another test to see if it actually _works_ on single-band cards
and submit it, sorry about that!

johannes