From patchwork Thu Jul 30 02:11:20 2015 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Larry Finger X-Patchwork-Id: 6897961 X-Patchwork-Delegate: kvalo@adurom.com Return-Path: X-Original-To: patchwork-linux-wireless@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork1.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.136]) by patchwork1.web.kernel.org (Postfix) with ESMTP id 2BAD79F358 for ; Thu, 30 Jul 2015 02:12:29 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id 3AD622056E for ; Thu, 30 Jul 2015 02:12:28 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id DDF2A2053D for ; Thu, 30 Jul 2015 02:12:26 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754494AbbG3CMY (ORCPT ); Wed, 29 Jul 2015 22:12:24 -0400 Received: from mail-ob0-f170.google.com ([209.85.214.170]:35072 "EHLO mail-ob0-f170.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754461AbbG3CMW (ORCPT ); Wed, 29 Jul 2015 22:12:22 -0400 Received: by obbop1 with SMTP id op1so21134197obb.2; Wed, 29 Jul 2015 19:12:21 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=sender:from:to:cc:subject:date:message-id:mime-version:content-type :content-transfer-encoding; bh=O/na6NyFabDK+Qt306F7Dd375DA1kgOCZmM9Fgp5vZk=; b=A4zXtdbi8EaNfEzFIGeM9C5yYPTvkHOE5PPlwNw4PHnal9NFmfRNeTrait4M/N8ZRh boWvEa6IlAzphgUXNG5noruKNuH8kAwhCvVwQ/J0dES2xL8Bdd2IE8d6QZJ3e0yBlMSA HuNKCLMxzWMB+av35Fodr/rpnWcpkDQaIPFMwdgFFOlu8RR6fgDWwscyvwTiTcVAMlzS GbchUob0qtbniO2UFZ9Oq9cxiUYJfnNc8OOPhZRbR6QSzsa76K88KBo3MEhRoLqbJI8D dSXvKQoOHJLYagJ7hO03Vj+RIr40p6/z4TJQKzkpc0lveh+ZanNBiFDU0aLHuv6APN0i Cj7g== X-Received: by 10.60.178.33 with SMTP id cv1mr38138083oec.11.1438222341515; Wed, 29 Jul 2015 19:12:21 -0700 (PDT) Received: from linux.site (cpe-24-31-249-175.kc.res.rr.com. [24.31.249.175]) by smtp.gmail.com with ESMTPSA id s134sm13127787oie.2.2015.07.29.19.12.19 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Wed, 29 Jul 2015 19:12:20 -0700 (PDT) From: Larry Finger To: kvalo@codeaurora.org Cc: linux-wireless@vger.kernel.org, Luis Felipe Dominguez Vega , netdev@vger.kernel.org, Larry Finger , Stable Subject: [PATCH V4.2] rtlwifi: Fix NULL dereference when PCI driver used as an AP Date: Wed, 29 Jul 2015 21:11:20 -0500 Message-Id: <1438222280-4146-1-git-send-email-Larry.Finger@lwfinger.net> X-Mailer: git-send-email 2.1.4 MIME-Version: 1.0 Sender: linux-wireless-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-wireless@vger.kernel.org X-Spam-Status: No, score=-8.2 required=5.0 tests=BAYES_00,DKIM_SIGNED, RCVD_IN_DNSWL_HI,RP_MATCHES_RCVD,T_DKIM_INVALID,UNPARSEABLE_RELAY autolearn=ham version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP From: Luis Felipe Dominguez Vega In commit 33511b157bbcebaef853cc1811992b664a2e5862 ("rtlwifi: add support to send beacon frame"), the mechanism for sending beacons was established. That patch works correctly for rtl8192cu, but there is a possibility of getting the following warnings in the PCI drivers: WARNING: CPU: 1 PID: 2439 at net/mac80211/driver-ops.h:12 ieee80211_bss_info_change_notify+0x179/0x1d0 [mac80211]() wlp5s0: Failed check-sdata-in-driver check, flags: 0x0 The warning is followed by a NULL pointer dereference as follows: BUG: unable to handle kernel NULL pointer dereference at 0000000000000006 IP: [] rtl_get_tcb_desc+0x5e/0x760 [rtlwifi] This problem was reported at http://thread.gmane.org/gmane.linux.kernel.wireless.general/138645, but no solution was found at that time. The problem was also reported at https://bugzilla.kernel.org/show_bug.cgi?id=9744 and this solution was developed and tested there. The USB driver works with a NULL final argument in the adapter_tx() callback; however, the PCI drivers need a struct rtl_tcb_desc in that position. Signed-off-by: Luis Felipe Dominguez Vega Signed-off-by: Larry Finger Cc: Stable [3.19+] --- Kalle, I have marked this fix for V4.2, and I hope it will make it. Thanks, Larry --- drivers/net/wireless/rtlwifi/core.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/drivers/net/wireless/rtlwifi/core.c b/drivers/net/wireless/rtlwifi/core.c index 3b3a88b..585d088 100644 --- a/drivers/net/wireless/rtlwifi/core.c +++ b/drivers/net/wireless/rtlwifi/core.c @@ -1015,9 +1015,12 @@ static void send_beacon_frame(struct ieee80211_hw *hw, { struct rtl_priv *rtlpriv = rtl_priv(hw); struct sk_buff *skb = ieee80211_beacon_get(hw, vif); + struct rtl_tcb_desc tcb_desc; - if (skb) - rtlpriv->intf_ops->adapter_tx(hw, NULL, skb, NULL); + if (skb) { + memset(&tcb_desc, 0, sizeof(struct rtl_tcb_desc)); + rtlpriv->intf_ops->adapter_tx(hw, NULL, skb, &tcb_desc); + } } static void rtl_op_bss_info_changed(struct ieee80211_hw *hw,