2012-08-07 07:18:45

by Srinivasan B

[permalink] [raw]
Subject: [PATCH] cfg80211: Fix for crash in cfg80211

Patch Description:
cfg80211 module crashes when cfg80211 & mac80211
loaded and unloading lmac driver.

Scenario Explanation:
(Step 1) : cfg80211, mac80211 and lmac driver
modules are loaded initially.
(Step 2) : unload the lmac driver.
then any dev calls to stack causes
the crash.
Code Changes:
dev->ethtools_ops is assigned during
NETDEV_REGISTER and the same can be cleared during NETDEV_UNREGISTER.

Signed-off-by: Srinivasan Chandrasekaran <[email protected]>
---

diff --git a/net/wireless/core.c b/net/wireless/core.c
index dcd64d5..74bb7c4 100755
--- a/net/wireless/core.c
+++ b/net/wireless/core.c
@@ -944,6 +944,10 @@ static int cfg80211_netdev_notifier_call(struct
notifier_block *nb,
#endif
}
mutex_unlock(&rdev->devlist_mtx);
+
+ if (dev->ethtool_ops)
+ dev->ethtool_ops = NULL;
+
/*
* synchronise (so that we won't find this netdev
* from other code any more) and then clear the list


2012-08-07 16:20:36

by Johannes Berg

[permalink] [raw]
Subject: Re: [PATCH] cfg80211: Fix for crash in cfg80211

On Tue, 2012-08-07 at 18:52 +0530, Mahesh Palivela wrote:

> >> dev->ethtools_ops is assigned during
> >> NETDEV_REGISTER and the same can be cleared during NETDEV_UNREGISTER.
> >
> > This doesn't make any sense to me at all.
> >
> cleanup of ethtools_ops pointer is required upon netdev_unreg
> notification. we are assigning this pointer to cfg80211_ethtool_ops on
> netdev_reg notification. Is it not required?
>
> we have seen crash when keeping cfg80211 and mac80211 loaded and lmac
> driver unloaded. With this fix, we didn't see crash. Crash doesn't
> happen right away. Only when some operation trying to access ethtool_ops.

I don't see how anything could access ethtool_ops after the netdev is
unregistered.

johannes


2012-08-07 11:42:40

by Johannes Berg

[permalink] [raw]
Subject: Re: [PATCH] cfg80211: Fix for crash in cfg80211

On Tue, 2012-08-07 at 12:40 +0530, Srinivasan B wrote:
> Patch Description:
> cfg80211 module crashes when cfg80211 & mac80211
> loaded and unloading lmac driver.
>
> Scenario Explanation:
> (Step 1) : cfg80211, mac80211 and lmac driver
> modules are loaded initially.
> (Step 2) : unload the lmac driver.
> then any dev calls to stack causes
> the crash.
> Code Changes:
> dev->ethtools_ops is assigned during
> NETDEV_REGISTER and the same can be cleared during NETDEV_UNREGISTER.

This doesn't make any sense to me at all.

johannes


2012-08-07 13:22:38

by Mahesh Palivela

[permalink] [raw]
Subject: Re: [PATCH] cfg80211: Fix for crash in cfg80211

On 8/7/2012 5:12 PM, Johannes Berg wrote:
> On Tue, 2012-08-07 at 12:40 +0530, Srinivasan B wrote:
>> Patch Description:
>> cfg80211 module crashes when cfg80211 & mac80211
>> loaded and unloading lmac driver.
>>
>> Scenario Explanation:
>> (Step 1) : cfg80211, mac80211 and lmac driver
>> modules are loaded initially.
>> (Step 2) : unload the lmac driver.
>> then any dev calls to stack causes
>> the crash.
>> Code Changes:
>> dev->ethtools_ops is assigned during
>> NETDEV_REGISTER and the same can be cleared during NETDEV_UNREGISTER.
>
> This doesn't make any sense to me at all.
>
cleanup of ethtools_ops pointer is required upon netdev_unreg
notification. we are assigning this pointer to cfg80211_ethtool_ops on
netdev_reg notification. Is it not required?

we have seen crash when keeping cfg80211 and mac80211 loaded and lmac
driver unloaded. With this fix, we didn't see crash. Crash doesn't
happen right away. Only when some operation trying to access ethtool_ops.

> johannes
>
> --
> To unsubscribe from this list: send the line "unsubscribe linux-wireless" in
> the body of a message to [email protected]
> More majordomo info at http://vger.kernel.org/majordomo-info.html
>