| Message ID | 20181108004035.136050-1-briannorris@chromium.org (mailing list archive) |
|---|---|
| State | Accepted |
| Commit | d987f783a4808ce0636f58e2412addd453cba88c |
| Delegated to: | Kalle Valo |
| Headers | show |
| Series | [4.20] ath10k: don't assume 'vif' is non-NULL in flush() | expand |
Brian Norris <briannorris@chromium.org> wrote: > mac80211 may call us with vif == NULL, if the station is not currently > active (e.g., not associated). It is trivially easy to reproduce a crash > by suspending the system when not connected to an AP: > > [ 65.533934] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 > ... > [ 65.574521] pc : ath10k_flush+0x30/0xd0 [ath10k_core] > [ 65.574538] lr : __ieee80211_flush_queues+0x180/0x244 [mac80211] > [ 65.599680] Process kworker/u12:1 (pid: 57, stack limit = 0x(____ptrval____)) > [ 65.599682] Call trace: > [ 65.599695] ath10k_flush+0x30/0xd0 [ath10k_core] > [ 65.642064] __ieee80211_flush_queues+0x180/0x244 [mac80211] > [ 65.642079] ieee80211_flush_queues+0x34/0x40 [mac80211] > [ 65.642095] __ieee80211_suspend+0xfc/0x47c [mac80211] > [ 65.658611] ieee80211_suspend+0x30/0x3c [mac80211] > [ 65.658627] wiphy_suspend+0x15c/0x3a8 [cfg80211] > [ 65.672810] dpm_run_callback+0xf0/0x1f0 > [ 65.672814] __device_suspend+0x3ac/0x4f8 > [ 65.672819] async_suspend+0x34/0xbc > [ 65.684096] async_run_entry_fn+0x54/0x104 > [ 65.684099] worker_thread+0x4cc/0x72c > [ 65.684102] kthread+0x134/0x13c > [ 65.684105] ret_from_fork+0x10/0x18 > > Fixes: 9de4162f0999 ("ath10k: add peer flush in ath10k_flush for STATION") > Signed-off-by: Brian Norris <briannorris@chromium.org> Patch applied to wireless-drivers.git, thanks. d987f783a480 ath10k: don't assume 'vif' is non-NULL in flush()
diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c index a1c2801ded10..7e49342bae38 100644 --- a/drivers/net/wireless/ath/ath10k/mac.c +++ b/drivers/net/wireless/ath/ath10k/mac.c @@ -6867,7 +6867,7 @@ static void ath10k_flush(struct ieee80211_hw *hw, struct ieee80211_vif *vif, u32 bitmap; if (drop) { - if (vif->type == NL80211_IFTYPE_STATION) { + if (vif && vif->type == NL80211_IFTYPE_STATION) { bitmap = ~(1 << WMI_MGMT_TID); list_for_each_entry(arvif, &ar->arvifs, list) { if (arvif->vdev_type == WMI_VDEV_TYPE_STA)
mac80211 may call us with vif == NULL, if the station is not currently active (e.g., not associated). It is trivially easy to reproduce a crash by suspending the system when not connected to an AP: [ 65.533934] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 ... [ 65.574521] pc : ath10k_flush+0x30/0xd0 [ath10k_core] [ 65.574538] lr : __ieee80211_flush_queues+0x180/0x244 [mac80211] [ 65.599680] Process kworker/u12:1 (pid: 57, stack limit = 0x(____ptrval____)) [ 65.599682] Call trace: [ 65.599695] ath10k_flush+0x30/0xd0 [ath10k_core] [ 65.642064] __ieee80211_flush_queues+0x180/0x244 [mac80211] [ 65.642079] ieee80211_flush_queues+0x34/0x40 [mac80211] [ 65.642095] __ieee80211_suspend+0xfc/0x47c [mac80211] [ 65.658611] ieee80211_suspend+0x30/0x3c [mac80211] [ 65.658627] wiphy_suspend+0x15c/0x3a8 [cfg80211] [ 65.672810] dpm_run_callback+0xf0/0x1f0 [ 65.672814] __device_suspend+0x3ac/0x4f8 [ 65.672819] async_suspend+0x34/0xbc [ 65.684096] async_run_entry_fn+0x54/0x104 [ 65.684099] worker_thread+0x4cc/0x72c [ 65.684102] kthread+0x134/0x13c [ 65.684105] ret_from_fork+0x10/0x18 Fixes: 9de4162f0999 ("ath10k: add peer flush in ath10k_flush for STATION") Signed-off-by: Brian Norris <briannorris@chromium.org> --- drivers/net/wireless/ath/ath10k/mac.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)