Kernel oops in code added by "cfg80211: allow userspace to control supported rates in scan"

Hello!

The current wireless-testing.git has a problem. I'm trying to run wpa_supplicant on an interface created by carl9170 (with nl80211 driver), and it oopses in nl80211_trigger_scan(). It turns out it oopses here:

for (i = 0; i < IEEE80211_NUM_BANDS; i++)

      request->rates[i] = (1 << wiphy->bands[i]->n_bitrates) - 1;

Here's the self-explanatory debug output I added:

[  460.190157] IEEE80211_NUM_BANDS = 2
[  460.193636] request = ffff8801246dc500
[  460.197373] request->rates = ffff8801246dc520
[  460.201748] wiphy = ffff8800b78b84e0
[  460.205317] wiphy->bands = ffff8800b78b8590
[  460.209489] i = 0, wiphy->bands[i] = ffffffffa00a80a0
[  460.214559] i = 1, wiphy->bands[i] =           (null)

wiphy->bands[1] is NULL, so wiphy->bands[1]->n_bitrates is invalid.

Likewise, if I run "iwconfig wlanX scan", I get an oops in cfg80211_wext_siwscan() on line 866:

for (i = 0; i < IEEE80211_NUM_BANDS; i++)

     creq->rates[i] = (1 << wiphy->bands[i]->n_bitrates) - 1;

Both pieces of code were added by:

commit 58389c69150e6032504dfcd3edca6b1975c8b5bc

Author: Johannes Berg <[email protected]>
Date:   Mon Jul 18 18:08:35 2011 +0200

cfg80211: allow userspace to control supported rates in scan

Regards,
Pavel Roskin

Ah crap, I didn't pay attention and never tested a single-band card. Below change should fix it.

johannes

---
 net/wireless/nl80211.c |    4 +++-
 net/wireless/scan.c    |    3 ++-
 net/wireless/util.c    |    3 +++
 3 files changed, 8 insertions(+), 2 deletions(-)

@@ -3454,7 +3454,9 @@ static int nl80211_trigger_scan(struct s
 	}
 
 	for (i = 0; i < IEEE80211_NUM_BANDS; i++)
-		request->rates[i] = (1 << wiphy->bands[i]->n_bitrates) - 1;
+		if (wiphy->bands[i])
+			request->rates[i] =
+				(1 << wiphy->bands[i]->n_bitrates) - 1;
 
 	if (info->attrs[NL80211_ATTR_SCAN_SUPP_RATES]) {
 		nla_for_each_nested(attr,

@@ -864,7 +864,8 @@ int cfg80211_wext_siwscan(struct net_dev
 	}
 
 	for (i = 0; i < IEEE80211_NUM_BANDS; i++)
-		creq->rates[i] = (1 << wiphy->bands[i]->n_bitrates) - 1;
+		if (wiphy->bands[i])
+			creq->rates[i] = (1 << wiphy->bands[i]->n_bitrates) - 1;
 
 	rdev->scan_req = creq;
 	err = rdev->ops->scan(wiphy, dev, creq);

@@ -1013,6 +1013,9 @@ int ieee80211_get_ratemask(struct ieee80
 {
 	int i, j;
 
+	if (!sband)
+		return -EINVAL;
+
 	if (n_rates == 0 || n_rates > NL80211_MAX_SUPP_RATES)
 		return -EINVAL;
 

The ultimate test - sending via the wireless connection :)

Regards,
Pavel Roskin

:)
I'll run another test to see if it actually _works_ on single-band cards and submit it, sorry about that!

johannes