linux/drivers/net
Uri Mashiach e47301b06d wlcore/wl12xx: spi: fix NULL pointer dereference (Oops)
Fix the below Oops when trying to modprobe wlcore_spi.
The oops occurs because the wl1271_power_{off,on}()
function doesn't check the power() function pointer.

[   23.401447] Unable to handle kernel NULL pointer dereference at
virtual address 00000000
[   23.409954] pgd = c0004000
[   23.412922] [00000000] *pgd=00000000
[   23.416693] Internal error: Oops: 80000007 [#1] SMP ARM
[   23.422168] Modules linked in: wl12xx wlcore mac80211 cfg80211
musb_dsps musb_hdrc usbcore usb_common snd_soc_simple_card evdev joydev
omap_rng wlcore_spi snd_soc_tlv320aic23_i2c rng_core snd_soc_tlv320aic23
c_can_platform c_can can_dev snd_soc_davinci_mcasp snd_soc_edma
snd_soc_omap omap_wdt musb_am335x cpufreq_dt thermal_sys hwmon
[   23.453253] CPU: 0 PID: 36 Comm: kworker/0:2 Not tainted
4.2.0-00002-g951efee-dirty #233
[   23.461720] Hardware name: Generic AM33XX (Flattened Device Tree)
[   23.468123] Workqueue: events request_firmware_work_func
[   23.473690] task: de32efc0 ti: de4ee000 task.ti: de4ee000
[   23.479341] PC is at 0x0
[   23.482112] LR is at wl12xx_set_power_on+0x28/0x124 [wlcore]
[   23.488074] pc : [<00000000>]    lr : [<bf2581f0>]    psr: 60000013
[   23.488074] sp : de4efe50  ip : 00000002  fp : 00000000
[   23.500162] r10: de7cdd00  r9 : dc848800  r8 : bf27af00
[   23.505663] r7 : bf27a1a8  r6 : dcbd8a80  r5 : dce0e2e0  r4 :
dce0d2e0
[   23.512536] r3 : 00000000  r2 : 00000000  r1 : 00000001  r0 :
dc848810
[   23.519412] Flags: nZCv  IRQs on  FIQs on  Mode SVC_32  ISA ARM
Segment kernel
[   23.527109] Control: 10c5387d  Table: 9cb78019  DAC: 00000015
[   23.533160] Process kworker/0:2 (pid: 36, stack limit = 0xde4ee218)
[   23.539760] Stack: (0xde4efe50 to 0xde4f0000)

[...]

[   23.665030] [<bf2581f0>] (wl12xx_set_power_on [wlcore]) from
[<bf25f7ac>] (wlcore_nvs_cb+0x118/0xa4c [wlcore])
[   23.675604] [<bf25f7ac>] (wlcore_nvs_cb [wlcore]) from [<c04387ec>]
(request_firmware_work_func+0x30/0x58)
[   23.685784] [<c04387ec>] (request_firmware_work_func) from
[<c0058e2c>] (process_one_work+0x1b4/0x4b4)
[   23.695591] [<c0058e2c>] (process_one_work) from [<c0059168>]
(worker_thread+0x3c/0x4a4)
[   23.704124] [<c0059168>] (worker_thread) from [<c005ee68>]
(kthread+0xd4/0xf0)
[   23.711747] [<c005ee68>] (kthread) from [<c000f598>]
(ret_from_fork+0x14/0x3c)
[   23.719357] Code: bad PC value
[   23.722760] ---[ end trace 981be8510db9b3a9 ]---

Prevent oops by validationg power() pointer value before
calling the function.

Signed-off-by: Uri Mashiach <uri.mashiach@compulab.co.il>
Cc: stable@vger.kernel.org
Acked-by: Igor Grinberg <grinberg@compulab.co.il>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2015-12-31 10:21:41 +02:00
..
appletalk
arcnet arcnet/com20020: add LEDS_CLASS dependency 2015-11-03 11:29:56 -05:00
bonding net: bonding: remove redudant brackets 2015-12-04 00:07:14 -05:00
caif net: caif: check return value of alloc_netdev 2015-11-09 11:31:13 -05:00
can Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2015-12-03 21:09:12 -05:00
cris
dsa dsa: mv88e6xxx.c: Hardware reset the chip if available 2015-11-23 11:53:10 -05:00
ethernet chelsio: constify cmac_ops structures 2015-12-08 23:27:54 -05:00
fddi
fjes fjes: fix inconsistent indenting 2015-11-15 17:09:23 -05:00
hamradio
hippi
hyperv hv_netvsc: Eliminate vlan_tci from struct hv_netvsc_packet 2015-12-02 23:43:25 -05:00
ieee802154 spi: Updates for v4.4 2015-11-05 13:15:12 -08:00
ipvlan ipvlan: fix use after free of skb 2015-11-17 14:39:29 -05:00
irda
phy PHY: DP83867: Remove looking in parent device for OF properties 2015-12-06 23:05:56 -05:00
plip
ppp pppox: use standard module auto-loading feature 2015-12-03 15:12:54 -05:00
slip ppp, slip: Validate VJ compression slot parameters completely 2015-11-02 16:25:00 -05:00
team team: implement lower state change propagation 2015-12-03 11:49:27 -05:00
usb net: cdc_ncm: add "ndp_to_end" sysfs attribute 2015-12-06 22:52:18 -05:00
vmxnet3 vmxnet3: fix checks for dma mapping errors 2015-12-01 15:19:16 -05:00
wan WAN: HDLC: Call notifiers before and after changing device type 2015-12-05 17:41:42 -05:00
wimax
wireless wlcore/wl12xx: spi: fix NULL pointer dereference (Oops) 2015-12-31 10:21:41 +02:00
xen-netback xen: features for 4.4-rc0 2015-11-04 17:32:42 -08:00
dummy.c net: dummy: add more features 2015-10-21 19:36:10 -07:00
eql.c
geneve.c geneve: add IPv6 bits to geneve_fill_metadata_dst 2015-10-30 12:10:54 +09:00
ifb.c
Kconfig net: Add IPv6 support to VRF device 2015-10-13 04:55:07 -07:00
LICENSE.SRC
loopback.c
macvlan.c macvlan: fix leak in macvlan_handle_frame 2015-11-17 14:39:29 -05:00
macvtap.c net: rename SOCK_ASYNC_NOSPACE and SOCK_ASYNC_WAITDATA 2015-12-01 15:45:05 -05:00
Makefile
mdio.c
mii.c
netconsole.c netconsole: use per-attribute show and store methods 2015-10-13 22:17:51 -07:00
nlmon.c
ntb_netdev.c
rionet.c
sb1000.c
Space.c
sungem_phy.c
tun.c net: rename SOCK_ASYNC_NOSPACE and SOCK_ASYNC_WAITDATA 2015-12-01 15:45:05 -05:00
veth.c
virtio_net.c net: provide generic busy polling to all NAPI drivers 2015-11-18 16:17:42 -05:00
vrf.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2015-12-03 21:09:12 -05:00
vxlan.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2015-10-24 06:54:12 -07:00
xen-netfront.c xen: features for 4.4-rc0 2015-11-04 17:32:42 -08:00