Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1157599

[PATCH 4.0 045/148] brcmfmac: avoid null pointer access when brcmf_msgbuf_get_pktid() fails

From Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Newsgroups linux.kernel
Subject [PATCH 4.0 045/148] brcmfmac: avoid null pointer access when brcmf_msgbuf_get_pktid() fails
Date 2015-06-03 15:00 +0200
Message-ID <pxgr2-1sR-47@gated-at.bofh.it> (permalink)
References <pxfOh-E4-3@gated-at.bofh.it>
Organization linux.* mail to news gateway

Show all headers | View raw

4.0-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Arend van Spriel <arend@broadcom.com>

commit 7d072b404c5d8f1e0b62b6bc488dfeaa61bd2d8d upstream.

The function brcmf_msgbuf_get_pktid() may return a NULL pointer so
the callers should check the return pointer before accessing it to
avoid the crash below (see [1]):

brcmfmac: brcmf_msgbuf_get_pktid: Invalid packet id 273 (not in use)
BUG: unable to handle kernel NULL pointer dereference at 0000000000000080
IP: [<ffffffff8145b225>] skb_pull+0x5/0x50
PGD 0
Oops: 0000 [#1] PREEMPT SMP
Modules linked in: pci_stub vboxpci(O) vboxnetflt(O) vboxnetadp(O) vboxdrv(O)
 snd_hda_codec_hdmi bnep mousedev hid_generic ushwmon msr ext4 crc16 mbcache
 jbd2 sd_mod uas usb_storage ahci libahci libata scsi_mod xhci_pci xhci_hcd
 usbcore usb_common
CPU: 0 PID: 1661 Comm: irq/61-brcmf_pc Tainted: G O    4.0.1-MacbookPro-ARCH #1
Hardware name: Apple Inc. MacBookPro12,1/Mac-E43C1C25D4880AD6,
 BIOS MBP121.88Z.0167.B02.1503241251 03/24/2015
task: ffff880264203cc0 ti: ffff88025ffe4000 task.ti: ffff88025ffe4000
RIP: 0010:[<ffffffff8145b225>]  [<ffffffff8145b225>] skb_pull+0x5/0x50
RSP: 0018:ffff88025ffe7d40  EFLAGS: 00010202
RAX: 0000000000000000 RBX: ffff88008a33c000 RCX: 0000000000000044
RDX: 0000000000000000 RSI: 000000000000004a RDI: 0000000000000000
RBP: ffff88025ffe7da8 R08: 0000000000000096 R09: 000000000000004a
R10: 0000000000000000 R11: 000000000000048e R12: ffff88025ff14f00
R13: 0000000000000000 R14: ffff880263b48200 R15: ffff88008a33c000
FS:  0000000000000000(0000) GS:ffff88026ec00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000080 CR3: 000000000180b000 CR4: 00000000003407f0
Stack:
 ffffffffa06aed74 ffff88025ffe7dc8 ffff880263b48270 ffff880263b48278
 05ea88020000004a 0002ffff81014635 000000001720b2f6 ffff88026ec116c0
 ffff880263b48200 0000000000010000 ffff880263b4ae00 ffff880264203cc0
Call Trace:
 [<ffffffffa06aed74>] ? brcmf_msgbuf_process_rx+0x404/0x480 [brcmfmac]
 [<ffffffff810cea60>] ? irq_finalize_oneshot.part.30+0xf0/0xf0
 [<ffffffffa06afb55>] brcmf_proto_msgbuf_rx_trigger+0x35/0xf0 [brcmfmac]
 [<ffffffffa06baf2a>] brcmf_pcie_isr_thread_v2+0x8a/0x130 [brcmfmac]
 [<ffffffff810cea80>] irq_thread_fn+0x20/0x50
 [<ffffffff810ceddf>] irq_thread+0x13f/0x170
 [<ffffffff810cebf0>] ? wake_threads_waitq+0x30/0x30
 [<ffffffff810ceca0>] ? irq_thread_dtor+0xb0/0xb0
 [<ffffffff81092a08>] kthread+0xd8/0xf0
 [<ffffffff81092930>] ? kthread_create_on_node+0x1c0/0x1c0
 [<ffffffff8156d898>] ret_from_fork+0x58/0x90
 [<ffffffff81092930>] ? kthread_create_on_node+0x1c0/0x1c0
Code: 01 83 e2 f7 88 50 01 48 83 c4 08 5b 5d f3 c3 0f 1f 80 00 00 00 00 83 e2
 f7 88 50 01 c3 66 0f 1f 84 00 00 00 00 00 0f 1f
RIP  [<ffffffff8145b225>] skb_pull+0x5/0x50
 RSP <ffff88025ffe7d40>
CR2: 0000000000000080
---[ end trace b074c0f90e7c997d ]---

[1] http://mid.gmane.org/20150430193259.GA5630@googlemail.com

Reported-by: Michael Hornung <mhornung.linux@gmail.com>
Reviewed-by: Hante Meuleman <meuleman@broadcom.com>
Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
Signed-off-by: Arend van Spriel <arend@broadcom.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/net/wireless/brcm80211/brcmfmac/msgbuf.c |   12 +++++-------
 1 file changed, 5 insertions(+), 7 deletions(-)

--- a/drivers/net/wireless/brcm80211/brcmfmac/msgbuf.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/msgbuf.c
@@ -512,11 +512,9 @@ static int brcmf_msgbuf_query_dcmd(struc
 				     msgbuf->rx_pktids,
 				     msgbuf->ioctl_resp_pktid);
 	if (msgbuf->ioctl_resp_ret_len != 0) {
-		if (!skb) {
-			brcmf_err("Invalid packet id idx recv'd %d\n",
-				  msgbuf->ioctl_resp_pktid);
+		if (!skb)
 			return -EBADF;
-		}
+
 		memcpy(buf, skb->data, (len < msgbuf->ioctl_resp_ret_len) ?
 				       len : msgbuf->ioctl_resp_ret_len);
 	}
@@ -875,10 +873,8 @@ brcmf_msgbuf_process_txstatus(struct brc
 	flowid -= BRCMF_NROF_H2D_COMMON_MSGRINGS;
 	skb = brcmf_msgbuf_get_pktid(msgbuf->drvr->bus_if->dev,
 				     msgbuf->tx_pktids, idx);
-	if (!skb) {
-		brcmf_err("Invalid packet id idx recv'd %d\n", idx);
+	if (!skb)
 		return;
-	}
 
 	set_bit(flowid, msgbuf->txstatus_done_map);
 	commonring = msgbuf->flowrings[flowid];
@@ -1157,6 +1153,8 @@ brcmf_msgbuf_process_rx_complete(struct
 
 	skb = brcmf_msgbuf_get_pktid(msgbuf->drvr->bus_if->dev,
 				     msgbuf->rx_pktids, idx);
+	if (!skb)
+		return;
 
 	if (data_offset)
 		skb_pull(skb, data_offset);


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH 4.0 000/148] 4.0.5-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 15:00 +0200
  [PATCH 4.0 021/148] mfd: da9052: Fix broken regulator probe Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 15:00 +0200
  [PATCH 4.0 061/148] ASoC: wm8994: correct BCLK DIV 348 to 384 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 15:00 +0200
  [PATCH 4.0 026/148] hwmon: (ntc_thermistor) Ensure iio channel is of type IIO_VOLTAGE Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 15:00 +0200
  [PATCH 4.0 048/148] module: Call module notifier on failure after complete_formation() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 15:00 +0200
  [PATCH 4.0 053/148] ALSA: hda/realtek - ALC292 dock fix for Thinkpad L450 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 15:00 +0200
  [PATCH 4.0 046/148] lib: Fix strnlen_user() to not touch memory after specified maximum Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 15:00 +0200
  [PATCH 4.0 065/148] staging: vt6655: device_free_tx_buf use only ieee80211_tx_status_irqsafe Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 15:00 +0200
  [PATCH 4.0 008/148] KVM: MMU: fix CR4.SMEP=1, CR0.WP=0 with shadow pages Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 15:00 +0200
  [PATCH 4.0 033/148] iio: adc: cc10001: Fix incorrect use of power-up/power-down register Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 15:00 +0200
  [PATCH 4.0 034/148] iio: adc: cc10001: Add delay before setting START bit Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 15:00 +0200
  [PATCH 4.0 040/148] hwmon: (tmp401) Do not auto-detect chip on I2C address 0x37 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 15:00 +0200
  [PATCH 4.0 049/148] ALSA: usb-audio: Add quirk for MS LifeCam Studio Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 15:00 +0200
  [PATCH 4.0 009/148] KVM: MMU: fix smap permission check Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 15:00 +0200
  [PATCH 4.0 023/148] Revert "libceph: clear r_req_lru_item in __unregister_linger_request()" Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 15:00 +0200
  [PATCH 4.0 050/148] ALSA: hda - Add Conexant codecs CX20721, CX20722, CX20723 and CX20724 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 15:00 +0200
  [PATCH 4.0 045/148] brcmfmac: avoid null pointer access when brcmf_msgbuf_get_pktid() fails Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 15:00 +0200
  [PATCH 4.0 035/148] iio: adc: cc10001: Fix regulator_get_voltage() return value check Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 15:00 +0200
  [PATCH 4.0 060/148] ASoC: wm8960: fix "RINPUT3" audio route error Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 15:00 +0200
  [PATCH 4.0 022/148] libceph: request a new osdmap if lingering request maps to no osd Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 15:00 +0200
  [PATCH 4.0 025/148] xen/events: dont bind non-percpu VIRQs with percpu chip Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 15:00 +0200
  [PATCH 4.0 004/148] iommu/arm-smmu: Fix sign-extension of upstream bus addresses at stage 1 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 15:00 +0200
  [PATCH 4.0 057/148] ASoC: mc13783: Fix wrong mask value used in mc13xxx_reg_rmw() calls Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 15:00 +0200
  [PATCH 4.0 024/148] Btrfs: fix racy system chunk allocation when setting block group ro Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 15:00 +0200
  [PATCH 4.0 051/148] ALSA: hda - Add headphone quirk for Lifebook E752 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 15:00 +0200
  [PATCH 4.0 007/148] x86/fpu: Disable XSAVES* support for now Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 15:00 +0200
  [PATCH 4.0 064/148] staging: vt6656: use ieee80211_tx_info to select packet type. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 15:00 +0200
  [PATCH 4.0 056/148] ALSA: hda - Fix noise on AMD radeon 290x controller Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 15:00 +0200
  [PATCH 4.0 003/148] iommu/amd: Fix bug in put_pasid_state_wait Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 15:00 +0200
  [PATCH 4.0 032/148] iio: adc: cc10001: Fix the channel number mapping Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 15:00 +0200
  [PATCH 4.0 015/148] omfs: fix sign confusion for bitmap loop counter Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 15:10 +0200
  [PATCH 4.0 018/148] lguest: fix out-by-one error in address checking. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 15:10 +0200
  [PATCH 4.0 002/148] fs_pin: Allow for the possibility that m_list or s_list go unused. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 15:10 +0200
  [PATCH 4.0 016/148] xfs: xfs_attr_inactive leaves inconsistent attr fork state behind Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 15:10 +0200
  [PATCH 4.0 014/148] fs, omfs: add NULL terminator in the end up the token list Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 15:10 +0200
  [PATCH 4.0 017/148] xfs: xfs_iozero can return positive errno Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 15:10 +0200
  [PATCH 4.0 019/148] ovl: dont remove non-empty opaque directory Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 15:10 +0200
  Re: [PATCH 4.0 000/148] 4.0.5-stable review Shuah Khan <shuahkh@osg.samsung.com> - 2015-06-03 19:00 +0200

csiph-web