mac80211: fix divide by zero when NOA update
authorJanusz.Dziedzic@tieto.com <Janusz.Dziedzic@tieto.com>
Tue, 27 Oct 2015 07:35:11 +0000 (08:35 +0100)
committerJohannes Berg <johannes.berg@intel.com>
Tue, 3 Nov 2015 09:40:57 +0000 (10:40 +0100)
In case of one shot NOA the interval can be 0, catch that
instead of potentially (depending on the driver) crashing
like this:

divide error: 0000 [#1] SMP
[...]
Call Trace:
<IRQ>
[<ffffffffc08e891c>] ieee80211_extend_absent_time+0x6c/0xb0 [mac80211]
[<ffffffffc08e8a17>] ieee80211_update_p2p_noa+0xb7/0xe0 [mac80211]
[<ffffffffc069cc30>] ath9k_p2p_ps_timer+0x170/0x190 [ath9k]
[<ffffffffc070adf8>] ath_gen_timer_isr+0xc8/0xf0 [ath9k_hw]
[<ffffffffc0691156>] ath9k_tasklet+0x296/0x2f0 [ath9k]
[<ffffffff8107ad65>] tasklet_action+0xe5/0xf0
[...]

Cc: stable@vger.kernel.org [3.16+, due to d463af4a1c34 using it]
Signed-off-by: Janusz Dziedzic <janusz.dziedzic@tieto.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
net/mac80211/util.c

index 8274c86296f990287962c06ba5dfd3b588e2f97c..c5ed42f2f667c8410337b5660d3c5a2ece8b1e8f 100644 (file)
@@ -2958,6 +2958,13 @@ ieee80211_extend_noa_desc(struct ieee80211_noa_data *data, u32 tsf, int i)
        if (end > 0)
                return false;
 
+       /* One shot NOA  */
+       if (data->count[i] == 1)
+               return false;
+
+       if (data->desc[i].interval == 0)
+               return false;
+
        /* End time is in the past, check for repetitions */
        skip = DIV_ROUND_UP(-end, data->desc[i].interval);
        if (data->count[i] < 255) {