leandrof/linux
1
0
Fork 0
forked from Minki/linux
Code Issues Pull Requests Packages Projects Releases Wiki Activity
7d072b404c
linux/drivers/net/wireless/brcm80211/brcmfmac
History
Arend van Spriel 7d072b404c brcmfmac: avoid null pointer access when brcmf_msgbuf_get_pktid() fails 
The function brcmf_msgbuf_get_pktid() may return a NULL pointer so
the callers should check the return pointer before accessing it to
avoid the crash below (see [1]):

brcmfmac: brcmf_msgbuf_get_pktid: Invalid packet id 273 (not in use)
BUG: unable to handle kernel NULL pointer dereference at 0000000000000080
IP: [<ffffffff8145b225>] skb_pull+0x5/0x50
PGD 0
Oops: 0000 [#1] PREEMPT SMP
Modules linked in: pci_stub vboxpci(O) vboxnetflt(O) vboxnetadp(O) vboxdrv(O)
 snd_hda_codec_hdmi bnep mousedev hid_generic ushwmon msr ext4 crc16 mbcache
 jbd2 sd_mod uas usb_storage ahci libahci libata scsi_mod xhci_pci xhci_hcd
 usbcore usb_common
CPU: 0 PID: 1661 Comm: irq/61-brcmf_pc Tainted: G O    4.0.1-MacbookPro-ARCH #1
Hardware name: Apple Inc. MacBookPro12,1/Mac-E43C1C25D4880AD6,
 BIOS MBP121.88Z.0167.B02.1503241251 03/24/2015
task: ffff880264203cc0 ti: ffff88025ffe4000 task.ti: ffff88025ffe4000
RIP: 0010:[<ffffffff8145b225>]  [<ffffffff8145b225>] skb_pull+0x5/0x50
RSP: 0018:ffff88025ffe7d40  EFLAGS: 00010202
RAX: 0000000000000000 RBX: ffff88008a33c000 RCX: 0000000000000044
RDX: 0000000000000000 RSI: 000000000000004a RDI: 0000000000000000
RBP: ffff88025ffe7da8 R08: 0000000000000096 R09: 000000000000004a
R10: 0000000000000000 R11: 000000000000048e R12: ffff88025ff14f00
R13: 0000000000000000 R14: ffff880263b48200 R15: ffff88008a33c000
FS:  0000000000000000(0000) GS:ffff88026ec00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000080 CR3: 000000000180b000 CR4: 00000000003407f0
Stack:
 ffffffffa06aed74 ffff88025ffe7dc8 ffff880263b48270 ffff880263b48278
 05ea88020000004a 0002ffff81014635 000000001720b2f6 ffff88026ec116c0
 ffff880263b48200 0000000000010000 ffff880263b4ae00 ffff880264203cc0
Call Trace:
 [<ffffffffa06aed74>] ? brcmf_msgbuf_process_rx+0x404/0x480 [brcmfmac]
 [<ffffffff810cea60>] ? irq_finalize_oneshot.part.30+0xf0/0xf0
 [<ffffffffa06afb55>] brcmf_proto_msgbuf_rx_trigger+0x35/0xf0 [brcmfmac]
 [<ffffffffa06baf2a>] brcmf_pcie_isr_thread_v2+0x8a/0x130 [brcmfmac]
 [<ffffffff810cea80>] irq_thread_fn+0x20/0x50
 [<ffffffff810ceddf>] irq_thread+0x13f/0x170
 [<ffffffff810cebf0>] ? wake_threads_waitq+0x30/0x30
 [<ffffffff810ceca0>] ? irq_thread_dtor+0xb0/0xb0
 [<ffffffff81092a08>] kthread+0xd8/0xf0
 [<ffffffff81092930>] ? kthread_create_on_node+0x1c0/0x1c0
 [<ffffffff8156d898>] ret_from_fork+0x58/0x90
 [<ffffffff81092930>] ? kthread_create_on_node+0x1c0/0x1c0
Code: 01 83 e2 f7 88 50 01 48 83 c4 08 5b 5d f3 c3 0f 1f 80 00 00 00 00 83 e2
 f7 88 50 01 c3 66 0f 1f 84 00 00 00 00 00 0f 1f
RIP  [<ffffffff8145b225>] skb_pull+0x5/0x50
 RSP <ffff88025ffe7d40>
CR2: 0000000000000080
---[ end trace b074c0f90e7c997d ]---

[1] http://mid.gmane.org/20150430193259.GA5630@googlemail.com

Cc: <stable@vger.kernel.org> # v3.18, v3.19, v4.0, v4.1
Reported-by: Michael Hornung <mhornung.linux@gmail.com>
Reviewed-by: Hante Meuleman <meuleman@broadcom.com>
Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
Signed-off-by: Arend van Spriel <arend@broadcom.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2015-05-28 16:27:44 +03:00
..
bcdc.c brcmfmac: (clean) Rename sdio related files. 2014-10-30 15:26:48 -04:00
bcdc.h brcmfmac: conditionally compile firmware protocol source code 2014-09-15 15:09:26 -04:00
bcmsdh.c brcmfmac: add support for BCM43430 SDIO chipset 2015-03-20 09:03:46 +02:00
btcoex.c brcmfmac: (clean) Rename sdio related files. 2014-10-30 15:26:48 -04:00
btcoex.h
bus.h brcmfmac: Reopen netdev queue on bus state data. 2015-01-29 09:59:05 +02:00
cfg80211.c Lots of updates for net-next; along with the usual flurry 2015-03-31 16:39:04 -04:00
cfg80211.h brcmfmac: enable 802.11d support in firmware 2015-01-06 20:30:16 +02:00
chip.c brcmfmac: add support for BCM43430 SDIO chipset 2015-03-20 09:03:46 +02:00
chip.h brcmfmac: extract ram size info from internal memory registers 2015-03-13 16:10:33 +02:00
common.c brcmfmac: store revinfo retrieval result 2015-01-29 09:59:17 +02:00
common.h brcmfmac: signal completion of 802.1x. 2015-01-06 20:29:57 +02:00
commonring.c brcmfmac: (clean) Rename sdio related files. 2014-10-30 15:26:48 -04:00
commonring.h brcmfmac: Relax scheduling of msgbuf worker on high throughput. 2015-01-29 09:58:49 +02:00
core.c brcmfmac: add debugfs file containing revision info 2015-02-26 15:14:18 +02:00
core.h brcmfmac: store revinfo retrieval result 2015-01-29 09:59:17 +02:00
debug.c brcmfmac: (clean) Rename sdio related files. 2014-10-30 15:26:48 -04:00
debug.h brcmfmac: (clean) Rename files dhd_dbg to debug 2014-10-30 15:26:44 -04:00
feature.c brcmfmac: disable MBSS feature for BCM43362 2015-03-21 08:36:07 +02:00
feature.h brcmfmac: add multiple BSS support. 2014-12-04 11:35:03 -05:00
firmware.c brcmfmac: fix nvram processing 2015-01-29 10:00:19 +02:00
firmware.h brcmfmac: Make firmware path a module parameter 2014-07-15 16:00:12 -04:00
flowring.c wireless: Use eth_<foo>_addr instead of memset 2015-03-03 17:01:36 -05:00
flowring.h brcmfmac: Add TDLS support to msgbuf. 2014-07-31 13:45:29 -04:00
fweh.c brcmfmac: add multiple BSS support. 2014-12-04 11:35:03 -05:00
fweh.h brcmfmac: handle IF event for P2P_DEVICE interface 2014-09-15 15:09:26 -04:00
fwil_types.h brcmfmac: determine chip info when not provided by bus layer 2015-01-29 09:59:11 +02:00
fwil.c brcmfmac: SDIO: avoid using bus state for private states. 2015-01-29 09:59:03 +02:00
fwil.h brcmfmac: determine chip info when not provided by bus layer 2015-01-29 09:59:11 +02:00
fwsignal.c brcmfmac: (clean) Rename sdio related files. 2014-10-30 15:26:48 -04:00
fwsignal.h
Makefile brcmfmac: (clean) Rename sdio related files. 2014-10-30 15:26:48 -04:00
msgbuf.c brcmfmac: avoid null pointer access when brcmf_msgbuf_get_pktid() fails 2015-05-28 16:27:44 +03:00
msgbuf.h brcmfmac: Update msgbuf commonring size for improved throughput. 2015-03-20 09:03:39 +02:00
of.c Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless 2014-12-08 13:58:58 -05:00
of.h brcmfmac: add device tree support for SDIO devices 2014-07-29 10:32:56 -04:00
p2p.c Lots of updates for net-next; along with the usual flurry 2015-03-31 16:39:04 -04:00
p2p.h cfg80211: pass name_assign_type to rdev_add_virtual_intf() 2015-03-30 10:36:17 +02:00
pcie.c brcmfmac: remove support for unreleased BCM4354 PCIe 2015-03-20 09:03:50 +02:00
pcie.h brcmfmac: Adding PCIe bus layer support. 2014-07-31 13:45:26 -04:00
proto.c brcmfmac: (clean) Rename sdio related files. 2014-10-30 15:26:48 -04:00
proto.h brcmfmac: Add TDLS support to msgbuf. 2014-07-31 13:45:29 -04:00
sdio.c brcmfmac: only support the BCM43455/7 device 2015-03-20 09:03:48 +02:00
sdio.h brcmfmac: make sdio suspend wait for threads to freeze 2015-02-26 15:14:19 +02:00
tracepoint.c brcmfmac: (clean) Move tracepoint related function. 2014-10-30 15:26:38 -04:00
tracepoint.h brcmfmac: Use consistent naming for BCDC. 2013-12-02 14:25:25 -05:00
usb.c brcm80211: Delete unnecessary checks before two function calls 2015-02-06 08:52:50 +02:00
usb.h
vendor.c brcmfmac: Perform bound checking on vendor command buffer 2015-03-07 10:52:30 +02:00
vendor.h brcmfmac: replace cfg80211 testmode with vendor command 2014-06-25 15:32:48 -04:00