From patchwork Wed Dec 16 18:44:29 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Lorenzo Bianconi X-Patchwork-Id: 11978373 X-Patchwork-Delegate: kvalo@adurom.com Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-15.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_CR_TRAILER,INCLUDES_PATCH,MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2D115C4361B for ; Wed, 16 Dec 2020 18:46:07 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id C85B4233F6 for ; Wed, 16 Dec 2020 18:46:06 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1731880AbgLPSqG (ORCPT ); Wed, 16 Dec 2020 13:46:06 -0500 Received: from us-smtp-delivery-124.mimecast.com ([63.128.21.124]:46395 "EHLO us-smtp-delivery-124.mimecast.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1731874AbgLPSqG (ORCPT ); Wed, 16 Dec 2020 13:46:06 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1608144278; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type; bh=SKYDss7PxZFgt1jeP63b9jeFcKC3PBd+1GqytdVAcMw=; b=U8V2T90sizHqbzp3HRxTLlrpT0KK2CUaXQXYBJuMsxfd3YrvFLo49lVGuSfiq+Ega3rn8d B+7pAJfcuU9IRR3U9SWZ4I8cS0NgFJ9bLw+UItX+SWRI014NjlEoSywMu48jZugjTnUhB9 Qr2jm2eRHwRG6ClLIr0+4gOoTD3z7bs= Received: from mail-ot1-f72.google.com (mail-ot1-f72.google.com [209.85.210.72]) (Using TLS) by relay.mimecast.com with ESMTP id us-mta-454-JOZ4qQAXPlO-_NsrOlBdDg-1; Wed, 16 Dec 2020 13:44:35 -0500 X-MC-Unique: JOZ4qQAXPlO-_NsrOlBdDg-1 Received: by mail-ot1-f72.google.com with SMTP id q5so11419119otc.11 for ; Wed, 16 Dec 2020 10:44:35 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:date:from:to:cc:subject:message-id:mime-version :content-disposition; bh=SKYDss7PxZFgt1jeP63b9jeFcKC3PBd+1GqytdVAcMw=; b=eHVR3l1rT0JhPEndAaUAEzp6ykzN3DnvxN57HvYJ7ermqxWbzP07ywo+lWe4sZcPYk Pgdw4rwQHVIIJuJDg8PzbhfviZHvneDGPEfkGlbOinL4c0YwuaxIsDUnNSxs/woE3bwK lmPQ5h/jIQYHT+vl3WvOa/+emM3Obkeqlr1pVvo0rY95q515esdBdqN6PySTEQHlApYN veOCLmFynAS6xK2u3viaUJ9GnQ13fbJMB7nzzYoc8Tof67GU/Mzenslkmx/yuuKABjtm FDtcJw+m8ZSHY0ST6bKccxXKvBat2DLn+hvPzIX6Co8jhtpGyCDHtseqwq675TknoDNd NcLg== X-Gm-Message-State: AOAM530tQdJ3GSEdXOoLAKy0Vl3nfyCNI0fNQz31CSYy/G0dWwl5OFww EBkioESF5ZBcpPJNiTQFlSPWpyNuejhNRMZjAXoXudnZWWVSCoDrjSgnjBijalcJ2uGi8qUySht KqCfESR39Mc6DtBo1GxofR/7Zsc4= X-Received: by 2002:a05:6830:214c:: with SMTP id r12mr27108602otd.208.1608144274309; Wed, 16 Dec 2020 10:44:34 -0800 (PST) X-Google-Smtp-Source: ABdhPJx3gqYYB8pVhUOLCDK1/z/qYdCVLR+GelETsBfdXoe0XY+wd0j1sWHfGotqZFG8LsRRTidsRg== X-Received: by 2002:a05:6830:214c:: with SMTP id r12mr27108593otd.208.1608144274165; Wed, 16 Dec 2020 10:44:34 -0800 (PST) Received: from localhost ([151.66.8.153]) by smtp.gmail.com with ESMTPSA id e10sm620574otl.38.2020.12.16.10.44.33 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 16 Dec 2020 10:44:33 -0800 (PST) Date: Wed, 16 Dec 2020 19:44:29 +0100 From: Lorenzo Bianconi To: kvalo@codeaurora.org Cc: linux-wireless@vger.kernel.org, nbd@nbd.name Subject: Fwd: [PATCH] mt76: mt76u: fix NULL pointer dereference in mt76u_status_worker Message-ID: <20201216184429.GG2036@lore-desk> MIME-Version: 1.0 Content-Disposition: inline Precedence: bulk List-ID: X-Mailing-List: linux-wireless@vger.kernel.org Hi Kalle, Since net-next is closed now I guess we can consider this patch for wireless-drivers Regards, Lorenzo Fix the following NULL pointer dereference in mt76u_status_worker that can occur if status thread runs before allocating tx queues [ 31.395373] BUG: kernel NULL pointer dereference, address: 000000000000002c [ 31.395769] #PF: supervisor read access in kernel mode [ 31.395985] #PF: error_code(0x0000) - not-present page [ 31.396178] PGD 0 P4D 0 [ 31.396277] Oops: 0000 [#1] SMP [ 31.396430] CPU: 3 PID: 337 Comm: mt76-usb-status Not tainted 5.10.0-rc1-kvm+ #49 [ 31.396703] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.13.0-3.fc33 04/01/2014 [ 31.397048] RIP: 0010:mt76u_status_worker+0x2b/0x190 [ 31.397931] RSP: 0018:ffffc9000076fe98 EFLAGS: 00010282 [ 31.398118] RAX: 0000000000000001 RBX: ffff888111203fe8 RCX: 0000000000000000 [ 31.398400] RDX: 0000000000000001 RSI: 0000000000000246 RDI: ffff888111203fe8 [ 31.398668] RBP: ffff888111201d00 R08: 000000000000038c R09: 000000000000009b [ 31.398952] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 [ 31.399235] R13: 0000000000000000 R14: 0000000000000000 R15: ffff88810c987300 [ 31.399494] FS: 0000000000000000(0000) GS:ffff88817bd80000(0000) knlGS:0000000000000000 [ 31.399767] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 31.399991] CR2: 000000000000002c CR3: 0000000103525000 CR4: 00000000000006a0 [ 31.400236] Call Trace: [ 31.400348] ? schedule+0x3e/0xa0 [ 31.400514] __mt76_worker_fn+0x71/0xa0 [ 31.400634] ? mt76_get_min_avg_rssi+0x110/0x110 [ 31.400827] kthread+0x118/0x130 [ 31.400984] ? __kthread_bind_mask+0x60/0x60 [ 31.401212] ret_from_fork+0x1f/0x30 [ 31.401353] Modules linked in: [ 31.401480] CR2: 000000000000002c [ 31.401627] ---[ end trace 8bf174505cc34851 ]--- [ 31.401798] RIP: 0010:mt76u_status_worker+0x2b/0x190 [ 31.402636] RSP: 0018:ffffc9000076fe98 EFLAGS: 00010282 [ 31.402829] RAX: 0000000000000001 RBX: ffff888111203fe8 RCX: 0000000000000000 [ 31.403118] RDX: 0000000000000001 RSI: 0000000000000246 RDI: ffff888111203fe8 [ 31.403424] RBP: ffff888111201d00 R08: 000000000000038c R09: 000000000000009b [ 31.403689] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 [ 31.403933] R13: 0000000000000000 R14: 0000000000000000 R15: ffff88810c987300 [ 31.404209] FS: 0000000000000000(0000) GS:ffff88817bd80000(0000) knlGS:0000000000000000 [ 31.404482] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 31.404726] CR2: 000000000000002c CR3: 0000000103525000 CR4: 00000000000006a0 [ 31.405294] mt76x0u: probe of 1-1:1.0 failed with error -110 [ 31.406007] usb 1-1: USB disconnect, device number 2 [ 31.840756] usb 1-1: new high-speed USB device number 3 using xhci_hcd [ 32.461295] usb 1-1: reset high-speed USB device number 3 using xhci_hcd [ 32.659932] mt76x0u 1-1:1.0: ASIC revision: 76100002 MAC revision: 76502000 [ 33.197032] mt76x0u 1-1:1.0: EEPROM ver:02 fae:01 Fixes: 9daf27e62852 ("mt76: mt76u: use dedicated thread for status work") Signed-off-by: Lorenzo Bianconi --- drivers/net/wireless/mediatek/mt76/usb.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/net/wireless/mediatek/mt76/usb.c b/drivers/net/wireless/mediatek/mt76/usb.c index 7a91fd0c2b01..b95d093728b9 100644 --- a/drivers/net/wireless/mediatek/mt76/usb.c +++ b/drivers/net/wireless/mediatek/mt76/usb.c @@ -815,6 +815,8 @@ static void mt76u_status_worker(struct mt76_worker *w) for (i = 0; i < IEEE80211_NUM_ACS; i++) { q = dev->phy.q_tx[i]; + if (!q) + continue; while (q->queued > 0) { if (!q->entry[q->tail].done)