Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1333852

[PATCH 3.10 15/64] wlcore/wl12xx: spi: fix NULL pointer dereference (Oops)

Show all headers | View raw

3.10-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Uri Mashiach <uri.mashiach@compulab.co.il>

commit e47301b06d5a65678690f04c2248fd181db1e59a upstream.

Fix the below Oops when trying to modprobe wlcore_spi.
The oops occurs because the wl1271_power_{off,on}()
function doesn't check the power() function pointer.

[   23.401447] Unable to handle kernel NULL pointer dereference at
virtual address 00000000
[   23.409954] pgd = c0004000
[   23.412922] [00000000] *pgd=00000000
[   23.416693] Internal error: Oops: 80000007 [#1] SMP ARM
[   23.422168] Modules linked in: wl12xx wlcore mac80211 cfg80211
musb_dsps musb_hdrc usbcore usb_common snd_soc_simple_card evdev joydev
omap_rng wlcore_spi snd_soc_tlv320aic23_i2c rng_core snd_soc_tlv320aic23
c_can_platform c_can can_dev snd_soc_davinci_mcasp snd_soc_edma
snd_soc_omap omap_wdt musb_am335x cpufreq_dt thermal_sys hwmon
[   23.453253] CPU: 0 PID: 36 Comm: kworker/0:2 Not tainted
4.2.0-00002-g951efee-dirty #233
[   23.461720] Hardware name: Generic AM33XX (Flattened Device Tree)
[   23.468123] Workqueue: events request_firmware_work_func
[   23.473690] task: de32efc0 ti: de4ee000 task.ti: de4ee000
[   23.479341] PC is at 0x0
[   23.482112] LR is at wl12xx_set_power_on+0x28/0x124 [wlcore]
[   23.488074] pc : [<00000000>]    lr : [<bf2581f0>]    psr: 60000013
[   23.488074] sp : de4efe50  ip : 00000002  fp : 00000000
[   23.500162] r10: de7cdd00  r9 : dc848800  r8 : bf27af00
[   23.505663] r7 : bf27a1a8  r6 : dcbd8a80  r5 : dce0e2e0  r4 :
dce0d2e0
[   23.512536] r3 : 00000000  r2 : 00000000  r1 : 00000001  r0 :
dc848810
[   23.519412] Flags: nZCv  IRQs on  FIQs on  Mode SVC_32  ISA ARM
Segment kernel
[   23.527109] Control: 10c5387d  Table: 9cb78019  DAC: 00000015
[   23.533160] Process kworker/0:2 (pid: 36, stack limit = 0xde4ee218)
[   23.539760] Stack: (0xde4efe50 to 0xde4f0000)

[...]

[   23.665030] [<bf2581f0>] (wl12xx_set_power_on [wlcore]) from
[<bf25f7ac>] (wlcore_nvs_cb+0x118/0xa4c [wlcore])
[   23.675604] [<bf25f7ac>] (wlcore_nvs_cb [wlcore]) from [<c04387ec>]
(request_firmware_work_func+0x30/0x58)
[   23.685784] [<c04387ec>] (request_firmware_work_func) from
[<c0058e2c>] (process_one_work+0x1b4/0x4b4)
[   23.695591] [<c0058e2c>] (process_one_work) from [<c0059168>]
(worker_thread+0x3c/0x4a4)
[   23.704124] [<c0059168>] (worker_thread) from [<c005ee68>]
(kthread+0xd4/0xf0)
[   23.711747] [<c005ee68>] (kthread) from [<c000f598>]
(ret_from_fork+0x14/0x3c)
[   23.719357] Code: bad PC value
[   23.722760] ---[ end trace 981be8510db9b3a9 ]---

Prevent oops by validationg power() pointer value before
calling the function.

Signed-off-by: Uri Mashiach <uri.mashiach@compulab.co.il>
Acked-by: Igor Grinberg <grinberg@compulab.co.il>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/net/wireless/ti/wlcore/io.h |   10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

--- a/drivers/net/wireless/ti/wlcore/io.h
+++ b/drivers/net/wireless/ti/wlcore/io.h
@@ -203,19 +203,23 @@ static inline int __must_check wlcore_wr
 
 static inline void wl1271_power_off(struct wl1271 *wl)
 {
-	int ret;
+	int ret = 0;
 
 	if (!test_bit(WL1271_FLAG_GPIO_POWER, &wl->flags))
 		return;
 
-	ret = wl->if_ops->power(wl->dev, false);
+	if (wl->if_ops->power)
+		ret = wl->if_ops->power(wl->dev, false);
 	if (!ret)
 		clear_bit(WL1271_FLAG_GPIO_POWER, &wl->flags);
 }
 
 static inline int wl1271_power_on(struct wl1271 *wl)
 {
-	int ret = wl->if_ops->power(wl->dev, true);
+	int ret = 0;
+
+	if (wl->if_ops->power)
+		ret = wl->if_ops->power(wl->dev, true);
 	if (ret == 0)
 		set_bit(WL1271_FLAG_GPIO_POWER, &wl->flags);
 

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH 3.10 00/64] 3.10.97-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-15 00:40 +0100
  [PATCH 3.10 03/64] crypto: algif_hash - Only export and import on sockets with data Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-15 00:40 +0100
  [PATCH 3.10 31/64] ALSA: rawmidi: Remove kernel WARNING for NULL user-space buffer check Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-15 00:40 +0100
  [PATCH 3.10 55/64] crypto: af_alg - Disallow bind/setkey/... after accept(2) Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-15 00:40 +0100
  [PATCH 3.10 25/64] fix sysvfs symlinks Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-15 00:40 +0100
  [PATCH 3.10 01/64] recordmcount: Fix endianness handling bug for nop_mcount Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-15 00:40 +0100
  [PATCH 3.10 37/64] ALSA: seq: Fix lockdep warnings due to double mutex locks Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-15 00:40 +0100
  [PATCH 3.10 60/64] crypto: algif_hash - wait for crypto_ahash_init() to complete Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-15 00:40 +0100
  [PATCH 3.10 59/64] ahci: Intel DNV device IDs SATA Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-15 00:40 +0100
  [PATCH 3.10 07/64] kernel/signal.c: unexport sigsuspend() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-15 00:40 +0100
  [PATCH 3.10 24/64] [media] media: vb2 dma-contig: Fully cache synchronise buffers in prepare and finish Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-15 00:40 +0100
  [PATCH 3.10 39/64] ALSA: timer: Fix leftover link at closing Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-15 00:40 +0100
  [PATCH 3.10 28/64] ALSA: compress: Disable GET_CODEC_CAPS ioctl for some architectures Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-15 00:40 +0100
  [PATCH 3.10 23/64] [media] v4l2-compat-ioctl32: fix alignment for ARM64 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-15 00:40 +0100
  [PATCH 3.10 05/64] HID: usbhid: fix recursive deadlock Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-15 00:40 +0100
  [PATCH 3.10 57/64] AHCI: Fix softreset failed issue of Port Multiplier Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-15 00:40 +0100
  [PATCH 3.10 04/64] dm btree: fix leak of bufio-backed block in btree_split_sibling error path Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-15 00:40 +0100
  [PATCH 3.10 16/64] vTPM: fix memory allocation flag for rtce buffer at kernel boot Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-15 00:50 +0100
  [PATCH 3.10 14/64] wlcore/wl12xx: spi: fix oops on firmware load Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-15 00:50 +0100
  [PATCH 3.10 15/64] wlcore/wl12xx: spi: fix NULL pointer dereference (Oops) Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-15 00:50 +0100
  [PATCH 3.10 22/64] parisc: Fix __ARCH_SI_PREAMBLE_SIZE Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-15 00:50 +0100
  [PATCH 3.10 19/64] [PATCH] fix calculation of meta_bg descriptor backups Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-15 00:50 +0100
  [PATCH 3.10 18/64] jbd2: Fix unreclaimed pages after truncate in data=journal mode Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-15 00:50 +0100
  [PATCH 3.10 17/64] mtd: mtdpart: fix add_mtd_partitions error path Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-15 00:50 +0100
  [PATCH 3.10 12/64] spi: atmel: Fix DMA-setup for transfers with more than 8 bits per word Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-15 00:50 +0100
  [PATCH 3.10 21/64] parisc: Fix syscall restarts Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-15 00:50 +0100
  [PATCH 3.10 11/64] Revert "dm mpath: fix stalls when handling invalid ioctls" Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-15 00:50 +0100
  [PATCH 3.10 13/64] spi: fix parent-device reference leak Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-15 00:50 +0100
  [PATCH 3.10 02/64] xhci: fix placement of call to usb_disabled() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-15 00:50 +0100
  Re: [PATCH 3.10 00/64] 3.10.97-stable review Guenter Roeck <linux@roeck-us.net> - 2016-02-15 06:30 +0100
    Re: [PATCH 3.10 00/64] 3.10.97-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-15 19:20 +0100
  Re: [PATCH 3.10 00/64] 3.10.97-stable review Guenter Roeck <linux@roeck-us.net> - 2016-02-15 16:50 +0100
  Re: [PATCH 3.10 00/64] 3.10.97-stable review Shuah Khan <shuahkh@osg.samsung.com> - 2016-02-15 18:20 +0100
    Re: [PATCH 3.10 00/64] 3.10.97-stable review Shuah Khan <shuahkh@osg.samsung.com> - 2016-02-17 21:40 +0100
      Re: [PATCH 3.10 00/64] 3.10.97-stable review Willy Tarreau <w@1wt.eu> - 2016-02-18 00:30 +0100
        Re: [PATCH 3.10 00/64] 3.10.97-stable review Shuah Khan <shuahkh@osg.samsung.com> - 2016-02-18 00:40 +0100
          Re: [PATCH 3.10 00/64] 3.10.97-stable review Shuah Khan <shuahkh@osg.samsung.com> - 2016-02-18 04:30 +0100
            Re: [PATCH 3.10 00/64] 3.10.97-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-19 23:30 +0100
    Re: [PATCH 3.10 00/64] 3.10.97-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-17 21:40 +0100

csiph-web