我正在努力使它工作+-旧内核(3.4.113)上的新驱动程序...在检查数据包注入之前,一切似乎都很顺利...注入后,内核放下了.. .这是一段日志
[ 66.546989] Unable to handle kernel paging request at virtual address 00010031
[ 66.547267] pgd = c0004000
[ 66.547383] [00010031] *pgd=00000000
[ 66.547653] Internal error: Oops: 5 [#1] PREEMPT SMP ARM
[ 66.547870] Modules linked in:
[ 66.548096] CPU: 0 Not tainted (3.4.113-gf50fa015c89-dirty #12)
[ 66.548310] PC is at rtl8xxxu_tx+0x14/0x514
[ 66.548439] LR is at __ieee80211_tx+0x208/0x264
[ 66.548473] type=1325 audit(1637116075.966:111): table=filter family=2 entries=138
[ 66.548514] type=1320 audit(1637116075.966:111):
[ 66.548894] pc : [<c0502740>] lr : [<c0a43d0c>] psr: 60000013
[ 66.548899] sp : e6b89e20 ip : c050272c fp : 00000000
[ 66.549232] r10: e4650340 r9 : e4650340 r8 : e6b89eb0
[ 66.549448] r7 : 00000000 r6 : e5801968 r5 : e4651080 r4 : 00010001
[ 66.549571] r3 : 00000000 r2 : 00010001 r1 : e1819780 r0 : e4650340
[ 66.549789] Flags: nZCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment kernel
[ 66.550000] Control: 10c5387d Table: 2330806a DAC: 00000015
并追踪
[ 65.418637] [<c0502740>] (rtl8xxxu_tx+0x14/0x514) from [<c0a43d0c>] (__ieee80211_tx+0x208/0x264)
[ 65.418767] [<c0a43d0c>] (__ieee80211_tx+0x208/0x264) from [<c0a450c4>] (ieee80211_tx+0xac/0xc0)
[ 65.418979] [<c0a450c4>] (ieee80211_tx+0xac/0xc0) from [<c0a4585c>] (ieee80211_xmit+0x84/0x8c)
[ 65.419193] [<c0a4585c>] (ieee80211_xmit+0x84/0x8c) from [<c0a46574>] (ieee80211_tx_skb_tid+0x3c/0x48)
[ 65.419401] [<c0a46574>] (ieee80211_tx_skb_tid+0x3c/0x48) from [<c0a32d70>] (ieee80211_scan_work+0x368/0x524)
[ 65.419628] [<c0a32d70>] (ieee80211_scan_work+0x368/0x524) from [<c01a56d8>] (process_one_work+0x26c/0x3f4)
[ 65.419845] [<c01a56d8>] (process_one_work+0x26c/0x3f4) from [<c01a5a20>] (worker_thread+0x194/0x2c4)
[ 65.419976] [<c01a5a20>] (worker_thread+0x194/0x2c4) from [<c01aa164>] (kthread+0x80/0x8c)
[ 65.420196] [<c01aa164>] (kthread+0x80/0x8c) from [<c0105fc0>] (kernel_thread_exit+0x0/0x8)
[ 65.420410] Code: e24dd02c e590502c e1a04002 e1a0a000 (e5923030)
通过 addr2line 打孔地址后,它指向rtl8xxxu_core.c:5041
struct ieee80211_vif *vif = tx_info->control.vif;
在查看了ieee80211_tx_info结构的代码之后,我看到了一个相当有趣的评论,说 tx_info->control.vif 指针对于注入的数据包可以为 NULL ...这只是我的情况...当数据包被注入时驱动程序崩溃...
我检查了几次,在不同的时间,在无线适配器的不同模式下......结果总是一样的:除了这个驱动程序之外没有任何崩溃,只在这个地方,没有其他地方......
在互联网上他们说我的错误可能是由于使用了空的NULL指针或由于硬件内存错误......我希望我的内存是有序的,所以现在我只考虑指针的理论......但是,我可能是错的,所有这些带有指针的外壳都与它无关......
UPD:在评论中的讨论过程中,我们得出的结论是,是我造成了错误,而不是我分叉的驱动程序,因为它在当前内核上正常工作并在 3.4 上崩溃......
UPD2:添加对 NULL 的检查时
if(tx_info == NULL) goto error;
struct ieee80211_tx_info *tx_info = IEEE80211_SKB_CB(skb);
内核并没有停止崩溃,而是开始抱怨rtl8xxxu_core.c:5035
struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;