https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=297184
Bug ID: 297184
Summary: LinuxKPI: do not rate-adjust a torn-down vap on tx
completion
Product: Base System
Version: CURRENT
Hardware: amd64
OS: Any
Status: New
Severity: Affects Some People
Priority: ---
Component: kern
Assignee: [email protected]
Reporter: [email protected]
Created attachment 273336
--> https://bugs.freebsd.org/bugzilla/attachment.cgi?id=273336&action=edit
guard call to ieee80211_ratectl_rate
linuxkpi_ieee80211_tx_status_ext() guards its rate-control work with "ni !=
NULL", but then dereferences one level deeper:
ieee80211_ratectl_rate(ni->ni_vap->iv_bss, NULL, 0);
A tx completion can be delivered from the driver's NAPI/rx-completion thread
after the vap has been destroyed, once net80211 has driven it to INIT and
cleared iv_bss, while frames were still in flight. The node itself is still
referenced and valid, so the existing check passes and we fault on the NULL bss
node:
panic: page fault
ieee80211_ratectl_rate (ni=0x0)
linuxkpi_ieee80211_tx_status_ext
ath10k_txrx_tx_unref / ath10k_htt_t2h_msg_handler
ath10k_pci_napi_poll / lkpi_napi_task
Confirmed in the dump: ni and ni->ni_vap valid, iv_bss NULL, and iv_state
already IEEE80211_S_INIT.
--
You are receiving this mail because:
You are the assignee for the bug.
