Received-SPF: pass (google.com: domain of linux-wireless-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
Message-ID: <23f8106d26ec9122a7ba4cbff60ae28e2c410ce9.camel@sipsolutions.net>
Subject: Re: [RFC 1/1] mac80211_hwsim: fix crash when receiving frame
From:   Johannes Berg <johannes@sipsolutions.net>
To:     James Prestwood <prestwoj@gmail.com>,
        linux-wireless@vger.kernel.org
Date:   Thu, 17 Sep 2020 11:46:02 +0200
In-Reply-To: <20200910235707.7732-2-prestwoj@gmail.com> (sfid-20200911_015725_167183_373D4325)
References: <20200910235707.7732-1-prestwoj@gmail.com>
         <20200910235707.7732-2-prestwoj@gmail.com>
         (sfid-20200911_015725_167183_373D4325)
Content-Type: text/plain; charset="UTF-8"
User-Agent: Evolution 3.36.5 (3.36.5-1.fc32) 
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Precedence: bulk

On Thu, 2020-09-10 at 16:57 -0700, James Prestwood wrote:
> This crash has rarely happened to me on bare metal, but when running
> in a virtual environment it happens much more frequently. It would
> appear that the mac80211_hwsim_data (data2) obtained from
> get_hwsim_data_ref_from_addr() is not fully initialized. When the
> crash happens the 'channel' member (ieee80211_channel*) is NULL. This
> is not checked for and eventually dereferenced which causes the
> segmentation fault.

Seems reasonable to me. I guess data2 is somehow getting packets
delivered but never even started operating.

johannes