Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1704455
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Newsgroups | linux.kernel |
| Subject | [PATCH 4.4 27/91] ath10k: fix null deref on wmi-tlv when trying spectral scan |
| Date | 2017-08-05 02:00 +0200 |
| Message-ID | <uaUFC-5lm-67@gated-at.bofh.it> (permalink) |
| References | <uaUcx-5a1-3@gated-at.bofh.it> |
| Organization | linux.* mail to news gateway |
4.4-stable review patch. If anyone has any objections, please let me know. ------------------ From: Michal Kazior <michal.kazior@tieto.com> commit 18ae68fff392e445af3c2d8be9bef8a16e1c72a7 upstream. WMI ops wrappers did not properly check for null function pointers for spectral scan. This caused null dereference crash with WMI-TLV based firmware which doesn't implement spectral scan. The crash could be triggered with: ip link set dev wlan0 up echo background > /sys/kernel/debug/ieee80211/phy0/ath10k/spectral_scan_ctl The crash looked like this: [ 168.031989] BUG: unable to handle kernel NULL pointer dereference at (null) [ 168.037406] IP: [< (null)>] (null) [ 168.040395] PGD cdd4067 PUD fa0f067 PMD 0 [ 168.043303] Oops: 0010 [#1] SMP [ 168.045377] Modules linked in: ath10k_pci(O) ath10k_core(O) ath mac80211 cfg80211 [last unloaded: cfg80211] [ 168.051560] CPU: 1 PID: 1380 Comm: bash Tainted: G W O 4.8.0 #78 [ 168.054336] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.7.5-20140531_083030-gandalf 04/01/2014 [ 168.059183] task: ffff88000c460c00 task.stack: ffff88000d4bc000 [ 168.061736] RIP: 0010:[<0000000000000000>] [< (null)>] (null) ... [ 168.100620] Call Trace: [ 168.101910] [<ffffffffa03b9566>] ? ath10k_spectral_scan_config+0x96/0x200 [ath10k_core] [ 168.104871] [<ffffffff811386e2>] ? filemap_fault+0xb2/0x4a0 [ 168.106696] [<ffffffffa03b97e6>] write_file_spec_scan_ctl+0x116/0x280 [ath10k_core] [ 168.109618] [<ffffffff812da3a1>] full_proxy_write+0x51/0x80 [ 168.111443] [<ffffffff811957b8>] __vfs_write+0x28/0x120 [ 168.113090] [<ffffffff812f1a2d>] ? security_file_permission+0x3d/0xc0 [ 168.114932] [<ffffffff8109b912>] ? percpu_down_read+0x12/0x60 [ 168.116680] [<ffffffff811965f8>] vfs_write+0xb8/0x1a0 [ 168.118293] [<ffffffff81197966>] SyS_write+0x46/0xa0 [ 168.119912] [<ffffffff818f2972>] entry_SYSCALL_64_fastpath+0x1a/0xa4 [ 168.121737] Code: Bad RIP value. [ 168.123318] RIP [< (null)>] (null) Signed-off-by: Michal Kazior <michal.kazior@tieto.com> Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com> Signed-off-by: Amit Pundir <amit.pundir@linaro.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> --- drivers/net/wireless/ath/ath10k/wmi-ops.h | 6 ++++++ 1 file changed, 6 insertions(+) --- a/drivers/net/wireless/ath/ath10k/wmi-ops.h +++ b/drivers/net/wireless/ath/ath10k/wmi-ops.h @@ -639,6 +639,9 @@ ath10k_wmi_vdev_spectral_conf(struct ath struct sk_buff *skb; u32 cmd_id; + if (!ar->wmi.ops->gen_vdev_spectral_conf) + return -EOPNOTSUPP; + skb = ar->wmi.ops->gen_vdev_spectral_conf(ar, arg); if (IS_ERR(skb)) return PTR_ERR(skb); @@ -654,6 +657,9 @@ ath10k_wmi_vdev_spectral_enable(struct a struct sk_buff *skb; u32 cmd_id; + if (!ar->wmi.ops->gen_vdev_spectral_enable) + return -EOPNOTSUPP; + skb = ar->wmi.ops->gen_vdev_spectral_enable(ar, vdev_id, trigger, enable); if (IS_ERR(skb))
Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
[PATCH 4.4 00/91] 4.4.80-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-05 02:00 +0200
[PATCH 4.4 23/91] nfc: fdp: fix NULL pointer dereference Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-05 02:00 +0200
[PATCH 4.4 38/91] libnvdimm, btt: fix btt_rw_page not returning errors Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-05 02:00 +0200
[PATCH 4.4 06/91] md/raid5: add thread_group worker async_tx_issue_pending_all Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-05 02:00 +0200
[PATCH 4.4 04/91] powerpc/pseries: Fix of_node_put() underflow during reconfig remove Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-05 02:00 +0200
[PATCH 4.4 26/91] isdn/i4l: fix buffer overflow Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-05 02:00 +0200
[PATCH 4.4 29/91] mailbox: always wait in mbox_send_message for blocking Tx mode Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-05 02:00 +0200
[PATCH 4.4 05/91] crypto: authencesn - Fix digest_null crash Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-05 02:00 +0200
[PATCH 4.4 28/91] wil6210: fix deadlock when using fw_no_recovery option Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-05 02:00 +0200
[PATCH 4.4 54/91] x86/mce/AMD: Make the init code more robust Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-05 02:00 +0200
[PATCH 4.4 62/91] irqchip/keystone: Fix "scheduling while atomic" on rt Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-05 02:00 +0200
[PATCH 4.4 53/91] tpm: Replace device number bitmap with IDR Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-05 02:00 +0200
[PATCH 4.4 47/91] pstore: Use dynamic spinlock initializer Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-05 02:00 +0200
[PATCH 4.4 17/91] drm: rcar-du: Simplify and fix probe error handling Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-05 02:00 +0200
Re: [PATCH 4.4 17/91] drm: rcar-du: Simplify and fix probe error handling Ben Hutchings <ben.hutchings@codethink.co.uk> - 2017-08-07 17:20 +0200
Re: [PATCH 4.4 17/91] drm: rcar-du: Simplify and fix probe error handling Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-08 18:30 +0200
[PATCH 4.4 34/91] kaweth: fix oops upon failed memory allocation Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-05 02:00 +0200
[PATCH 4.4 07/91] drm/vmwgfx: Fix gcc-7.1.1 warning Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-05 02:00 +0200
[PATCH 4.4 25/91] isdn: Fix a sleep-in-atomic bug Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-05 02:00 +0200
[PATCH 4.4 39/91] ipmi/watchdog: fix watchdog timeout set on reboot Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-05 02:00 +0200
[PATCH 4.4 36/91] PM / Domains: defer dev_pm_domain_set() until genpd->attach_dev succeeds if present Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-05 02:00 +0200
[PATCH 4.4 03/91] net: reduce skb_warn_bad_offload() noise Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-05 02:00 +0200
[PATCH 4.4 32/91] mpt3sas: Dont overreach ioc->reply_post[] during initialization Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-05 02:00 +0200
[PATCH 4.4 08/91] drm/nouveau/bar/gf100: fix access to upper half of BAR2 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-05 02:00 +0200
[PATCH 4.4 27/91] ath10k: fix null deref on wmi-tlv when trying spectral scan Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-05 02:00 +0200
[PATCH 4.4 09/91] KVM: PPC: Book3S HV: Context-switch EBB registers properly Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-05 02:00 +0200
[PATCH 4.4 60/91] drm/msm: Verify that MSM_SUBMIT_BO_FLAGS are set Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-05 02:00 +0200
[PATCH 4.4 22/91] xfs: dont BUG() on mixed direct and mapped I/O Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-05 02:00 +0200
[PATCH 4.4 15/91] drm/rcar: Nuke preclose hook Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-05 02:10 +0200
[PATCH 4.4 18/91] perf intel-pt: Fix ip compression Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-05 02:10 +0200
[PATCH 4.4 13/91] Revert "powerpc/numa: Fix percpu allocations to be NUMA aware" Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-05 02:10 +0200
[PATCH 4.4 11/91] KVM: PPC: Book3S HV: Reload HTM registers explicitly Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-05 02:10 +0200
[PATCH 4.4 14/91] Staging: comedi: comedi_fops: Avoid orphaned proc entry Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-05 02:10 +0200
[PATCH 4.4 16/91] drm: rcar-du: Perform initialization/cleanup at probe/remove time Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-05 02:10 +0200
[PATCH 4.4 19/91] perf intel-pt: Fix last_ip usage Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-05 02:10 +0200
[PATCH 4.4 10/91] KVM: PPC: Book3S HV: Restore critical SPRs to host values on guest exit Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-05 02:10 +0200
Re: [PATCH 4.4 00/91] 4.4.80-stable review Shuah Khan <shuahkh@osg.samsung.com> - 2017-08-05 04:00 +0200
Re: [PATCH 4.4 00/91] 4.4.80-stable review Guenter Roeck <linux@roeck-us.net> - 2017-08-05 08:20 +0200
csiph-web