Commit 3a492ce1 authored by Vasyl Vavrychuk's avatar Vasyl Vavrychuk Committed by Greg Kroah-Hartman

mac80211_hwsim: Timer should be initialized before device registered

commit a1881c9b8a1edef0a5ae1d5c1b61406fe3402114 upstream.

Otherwise if network manager starts configuring Wi-Fi interface
immidiatelly after getting notification of its creation, we will get
NULL pointer dereference:

  BUG: unable to handle kernel NULL pointer dereference at           (null)
  IP: [<ffffffff95ae94c8>] hrtimer_active+0x28/0x50
  ...
  Call Trace:
   [<ffffffff95ae9997>] ? hrtimer_try_to_cancel+0x27/0x110
   [<ffffffff95ae9a95>] ? hrtimer_cancel+0x15/0x20
   [<ffffffffc0803bf0>] ? mac80211_hwsim_config+0x140/0x1c0 [mac80211_hwsim]

Cc: stable@vger.kernel.org
Signed-off-by: default avatarVasyl Vavrychuk <vasyl.vavrychuk@globallogic.com>
Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 6d861927
...@@ -2633,6 +2633,10 @@ static int mac80211_hwsim_new_radio(struct genl_info *info, ...@@ -2633,6 +2633,10 @@ static int mac80211_hwsim_new_radio(struct genl_info *info,
if (param->no_vif) if (param->no_vif)
ieee80211_hw_set(hw, NO_AUTO_VIF); ieee80211_hw_set(hw, NO_AUTO_VIF);
tasklet_hrtimer_init(&data->beacon_timer,
mac80211_hwsim_beacon,
CLOCK_MONOTONIC, HRTIMER_MODE_ABS);
err = ieee80211_register_hw(hw); err = ieee80211_register_hw(hw);
if (err < 0) { if (err < 0) {
printk(KERN_DEBUG "mac80211_hwsim: ieee80211_register_hw failed (%d)\n", printk(KERN_DEBUG "mac80211_hwsim: ieee80211_register_hw failed (%d)\n",
...@@ -2657,10 +2661,6 @@ static int mac80211_hwsim_new_radio(struct genl_info *info, ...@@ -2657,10 +2661,6 @@ static int mac80211_hwsim_new_radio(struct genl_info *info,
data->debugfs, data->debugfs,
data, &hwsim_simulate_radar); data, &hwsim_simulate_radar);
tasklet_hrtimer_init(&data->beacon_timer,
mac80211_hwsim_beacon,
CLOCK_MONOTONIC, HRTIMER_MODE_ABS);
spin_lock_bh(&hwsim_radio_lock); spin_lock_bh(&hwsim_radio_lock);
list_add_tail(&data->list, &hwsim_radios); list_add_tail(&data->list, &hwsim_radios);
spin_unlock_bh(&hwsim_radio_lock); spin_unlock_bh(&hwsim_radio_lock);
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment