Bob Copeland fcc6cb0c13 cfg80211: fix looping soft lockup in find_ie() ... The find_ie() function uses a size_t for the len parameter, and directly uses len as a loop variable. If any received packets are malformed, it is possible for the decrease of len to overflow, and since the result is unsigned, the loop will not terminate. Change it to a signed int so the loop conditional works for negative values. This fixes the following soft lockup: [38573.102007] BUG: soft lockup - CPU#0 stuck for 61s! [phy0:2230] [38573.102007] Modules linked in: aes_i586 aes_generic fuse af_packet ipt_REJECT xt_tcpudp nf_conntrack_ipv4 nf_defrag_ipv4 xt_state iptable_filter ip_tables x_tables acpi_cpufreq binfmt_misc dm_mirror dm_region_hash dm_log dm_multipath dm_mod kvm_intel kvm uinput i915 arc4 ecb drm snd_hda_codec_idt ath5k snd_hda_intel hid_apple mac80211 usbhid appletouch snd_hda_codec snd_pcm ath cfg80211 snd_timer i2c_algo_bit ohci1394 video snd processor ieee1394 rfkill ehci_hcd sg sky2 backlight snd_page_alloc uhci_hcd joydev output ac thermal button battery sr_mod applesmc cdrom input_polldev evdev unix [last unloaded: scsi_wait_scan] [38573.102007] irq event stamp: 2547724535 [38573.102007] hardirqs last enabled at (2547724534): [<c1002ffc>] restore_all_notrace+0x0/0x18 [38573.102007] hardirqs last disabled at (2547724535): [<c10038f4>] apic_timer_interrupt+0x28/0x34 [38573.102007] softirqs last enabled at (92950144): [<c103ab48>] __do_softirq+0x108/0x210 [38573.102007] softirqs last disabled at (92950274): [<c1348e74>] _spin_lock_bh+0x14/0x80 [38573.102007] [38573.102007] Pid: 2230, comm: phy0 Tainted: G W (2.6.31-rc7-wl #8) MacBook1,1 [38573.102007] EIP: 0060:[<f8ea2d50>] EFLAGS: 00010292 CPU: 0 [38573.102007] EIP is at cmp_ies+0x30/0x180 [cfg80211] [38573.102007] EAX: 00000082 EBX: 00000000 ECX: ffffffc1 EDX: d8efd014 [38573.102007] ESI: ffffff7c EDI: 0000004d EBP: eee2dc50 ESP: eee2dc3c [38573.102007] DS: 007b ES: 007b FS: 00d8 GS: 0000 SS: 0068 [38573.102007] CR0: 8005003b CR2: d8efd014 CR3: 01694000 CR4: 000026d0 [38573.102007] DR0: 00000000 DR1: 00000000 DR2: 00000000 DR3: 00000000 [38573.102007] DR6: ffff0ff0 DR7: 00000400 [38573.102007] Call Trace: [38573.102007] [<f8ea2f8d>] cmp_bss+0xed/0x100 [cfg80211] [38573.102007] [<f8ea33e4>] cfg80211_bss_update+0x84/0x410 [cfg80211] [38573.102007] [<f8ea3884>] cfg80211_inform_bss_frame+0x114/0x180 [cfg80211] [38573.102007] [<f97255ff>] ieee80211_bss_info_update+0x4f/0x180 [mac80211] [38573.102007] [<f972b118>] ieee80211_rx_bss_info+0x88/0xf0 [mac80211] [38573.102007] [<f9739297>] ? ieee802_11_parse_elems+0x27/0x30 [mac80211] [38573.102007] [<f972b224>] ieee80211_rx_mgmt_probe_resp+0xa4/0x1c0 [mac80211] [38573.102007] [<f972bc59>] ieee80211_sta_rx_queued_mgmt+0x919/0xc50 [mac80211] [38573.102007] [<c1009707>] ? sched_clock+0x27/0xa0 [38573.102007] [<c1009707>] ? sched_clock+0x27/0xa0 [38573.102007] [<c105ffd0>] ? mark_held_locks+0x60/0x80 [38573.102007] [<c1348be5>] ? _spin_unlock_irqrestore+0x55/0x70 [38573.102007] [<c134baa5>] ? sub_preempt_count+0x85/0xc0 [38573.102007] [<c1348bce>] ? _spin_unlock_irqrestore+0x3e/0x70 [38573.102007] [<c12c1c0f>] ? skb_dequeue+0x4f/0x70 [38573.102007] [<f972c021>] ieee80211_sta_work+0x91/0xb80 [mac80211] [38573.102007] [<c1009707>] ? sched_clock+0x27/0xa0 [38573.102007] [<c134baa5>] ? sub_preempt_count+0x85/0xc0 [38573.102007] [<c10479af>] worker_thread+0x18f/0x320 [38573.102007] [<c104794e>] ? worker_thread+0x12e/0x320 [38573.102007] [<c1348be5>] ? _spin_unlock_irqrestore+0x55/0x70 [38573.102007] [<f972bf90>] ? ieee80211_sta_work+0x0/0xb80 [mac80211] [38573.102007] [<c104cbb0>] ? autoremove_wake_function+0x0/0x50 [38573.102007] [<c1047820>] ? worker_thread+0x0/0x320 [38573.102007] [<c104c854>] kthread+0x84/0x90 [38573.102007] [<c104c7d0>] ? kthread+0x0/0x90 [38573.102007] [<c1003ab7>] kernel_thread_helper+0x7/0x10 Cc: stable@kernel.org Signed-off-by: Bob Copeland <me@bobcopeland.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>		2009-09-02 15:29:04 -04:00
..
chan.c	cfg80211: fix locking for SIWFREQ	2009-08-14 09:13:51 -04:00
core.c	cfg80211: clean up properly on interface type change	2009-08-28 14:40:31 -04:00
core.h	cfg80211: clean up properly on interface type change	2009-08-28 14:40:31 -04:00
debugfs.c	cfg80211: clean up naming once and for all	2009-07-10 15:02:33 -04:00
debugfs.h	cfg80211: clean up naming once and for all	2009-07-10 15:02:33 -04:00
ibss.c	cfg80211: make spurious warnings less likely, configurable	2009-08-28 14:40:30 -04:00
Kconfig	wireless: update reg debug kconfig entry	2009-09-02 15:29:03 -04:00
lib80211_crypt_ccmp.c	lib80211: silence excessive crypto debugging messages	2009-03-16 18:01:58 -04:00
lib80211_crypt_tkip.c	lib80211: silence excessive crypto debugging messages	2009-03-16 18:01:58 -04:00
lib80211_crypt_wep.c	lib80211: absorb crypto bits from net/ieee80211	2008-11-21 11:08:17 -05:00
lib80211.c	lib80211: consolidate crypt init routines	2008-11-21 11:08:17 -05:00
Makefile	cfg80211: validate channel settings across interfaces	2009-08-14 09:13:42 -04:00
mlme.c	cfg80211: report userspace SME connected event properly	2009-08-20 11:35:57 -04:00
nl80211.c	nl80211: jump to out_err upon unsupported iftype	2009-08-28 14:40:41 -04:00
nl80211.h	cfg80211: fix locking	2009-07-10 15:02:32 -04:00
radiotap.c	wireless: use get/put_unaligned_* helpers	2008-05-14 16:29:32 -04:00
reg.c	trivial: remove duplicate "different" from comment	2009-08-14 09:14:02 -04:00
reg.h	Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6	2009-08-12 17:44:53 -07:00
scan.c	cfg80211: fix looping soft lockup in find_ie()	2009-09-02 15:29:04 -04:00
sme.c	cfg80211: make spurious warnings less likely, configurable	2009-08-28 14:40:30 -04:00
sysfs.c	cfg80211: rename cfg80211_registered_device's idx to wiphy_idx	2009-02-27 14:52:54 -05:00
sysfs.h
util.c	cfg80211: clean up properly on interface type change	2009-08-28 14:40:31 -04:00
wext-compat.c	cfg80211: clean up properly on interface type change	2009-08-28 14:40:31 -04:00
wext-compat.h	cfg80211: validate channel settings across interfaces	2009-08-14 09:13:42 -04:00
wext-sme.c	cfg80211: fix locking for SIWFREQ	2009-08-14 09:13:51 -04:00
wext.c	wext: remove extra return on wireless_nlevent_init()	2009-08-04 16:43:20 -04:00