On 29/06/15 11:24, Tom Hughes wrote:

So I think this happens when hostapd switches the interface
to AP mode, which causes the netdev to be torn down and then
recreated, and the debugfs directory along with it.

Except that if the netlink message to change the mode was
sent from a daemon whose selinux context prevents searching
debugfs the recreation somehow fails and leaves an invalid
state that later causes the null pointer deref.

Think I have it...

The teardown runs ieee80211_debugfs_remove_netdev
which clears sdata->vif.debugfs_dir but does not clear 
sdata->debugfs.subdir_stations so that when ieee80211_debugfs_add_netdev 
later fails to create the top level
netdev directory we are left with a bogus pointer for the stations 
directory.

Then when we try and add an entry to the stations directory things blow up.

Tom

-- 
Tom Hughes (tom@compton.nu)
http://compton.nu/