All of lore.kernel.org
 help / color / mirror / Atom feed
* [4.17 iwlwifi regression] NULL pointer dereference in reg_query_regdb_wmm()
@ 2018-05-19 18:33 Eric Biggers
  2018-05-21  7:42 ` Luca Coelho
                   ` (3 more replies)
  0 siblings, 4 replies; 14+ messages in thread
From: Eric Biggers @ 2018-05-19 18:33 UTC (permalink / raw)
  To: Intel Linux Wireless, linux-wireless, Haim Dreyfuss, Luca Coelho,
	Kalle Valo

Hello,

Using v4.17-rc5, on a laptop with an "Intel Corporation Wireless 3165 (rev 79)"
using the iwlwifi driver, I get a NULL pointer dereference immediately after
boot.  Apparently, the 'regdb' variable in net/wireless/reg.c is NULL, yet
reg_query_regdb_wmm() is checking for IS_ERR().  It goes away if I revert commit
77e30e10ee28a5 ("iwlwifi: mvm: query regdb for wmm rule if needed").  The
symbolized crash report is:

BUG: unable to handle kernel NULL pointer dereference at 000000000000000a
PGD 0 P4D 0
Oops: 0000 [#1] PREEMPT SMP PTI
Modules linked in: kvm_intel kvm irqbypass joydev
CPU: 2 PID: 371 Comm: NetworkManager Tainted: G                T 4.17.0-rc5-00140-g0b449a441dac #5
Hardware name: Dell Inc. Inspiron 15-7568/0M5YMV, BIOS 01.00.00 08/07/2015
RIP: 0010:reg_query_regdb_wmm+0x14/0x160 net/wireless/reg.c:919
RSP: 0018:ffffad458102b4f0 EFLAGS: 00010207
RAX: ffff96a8e7b350a0 RBX: ffff96a8e7b35000 RCX: ffff96a8e7b35638
RDX: ffff96a8e14ee408 RSI: 000000000000143c RDI: ffff96a8e7b35018
RBP: 0000000000000005 R08: 0000000000013088 R09: 0000000000000000
R10: 0000000000000004 R11: 000000000000143c R12: ffffffff93ebd7a0
R13: ffff96a8e14ee400 R14: 0000000000000040 R15: 000000000000000e
FS:  00007f29f1311880(0000) GS:ffff96a8f2500000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000000000000a CR3: 0000000260e9c005 CR4: 00000000003606e0
Call Trace:
 iwl_parse_nvm_mcc_info+0x267/0x4e0 drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c:962
 iwl_mvm_get_regdomain+0x67/0xb0 drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c:311
 iwl_mvm_init_mcc+0x6f/0x1f0 drivers/net/wireless/intel/iwlwifi/mvm/nvm.c:783
 iwl_mvm_up+0x79f/0x840 drivers/net/wireless/intel/iwlwifi/mvm/fw.c:1089
 __iwl_mvm_mac_start+0x225/0x290 drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c:1108
 iwl_mvm_mac_start+0x4e/0x120 drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c:1141
 ? inetdev_event+0x72/0x4d0 net/ipv4/devinet.c:1533
 drv_start+0x2d/0x50 net/mac80211/driver-ops.c:26
 ieee80211_do_open+0x453/0x880 net/mac80211/iface.c:558
 __dev_open+0xb4/0x130 net/core/dev.c:1392
 __dev_change_flags+0x1a1/0x210 net/core/dev.c:6955
 ? call_netdevice_notifiers net/core/dev.c:1752 [inline]
 ? __dev_notify_flags+0x56/0xf0 net/core/dev.c:6993
 dev_change_flags+0x1e/0x60 net/core/dev.c:7024
 ? nla_put_ifalias+0x2e/0x90 net/core/rtnetlink.c:1459
 do_setlink+0x656/0xd80 net/core/rtnetlink.c:2362
 ? new_slab_objects mm/slub.c:2452 [inline]
 ? ___slab_alloc+0x48a/0x560 mm/slub.c:2604
 ? memset include/linux/string.h:330 [inline]
 ? __nla_reserve+0x38/0x50 lib/nlattr.c:437
 ? __nla_put+0xc/0x20 lib/nlattr.c:568
 ? nla_put+0x2f/0x40 lib/nlattr.c:627
 ? nla_put_u8 include/net/netlink.h:780 [inline]
 ? rtnl_xdp_fill+0x172/0x1d0 net/core/rtnetlink.c:1379
 ? memset include/linux/string.h:330 [inline]
 ? __nla_reserve+0x38/0x50 lib/nlattr.c:437
 ? memset include/linux/string.h:330 [inline]
 ? __nla_reserve+0x38/0x50 lib/nlattr.c:437
 ? inet_fill_link_af+0x1c/0x50 net/ipv4/devinet.c:1738
 ? rtnl_newlink+0x793/0x930 net/core/rtnetlink.c:2970
 ? spin_unlock_irqrestore include/linux/spinlock.h:365 [inline]
 ? __wake_up_common_lock+0x84/0xb0 kernel/sched/wait.c:120
 ? rtnetlink_rcv_msg+0x121/0x390 net/core/rtnetlink.c:4646
 ? fast_dput fs/dcache.c:716 [inline]
 ? dput.part.5+0x92/0x120 fs/dcache.c:837
 ? __lookup_slow+0x137/0x160 fs/namei.c:1633
 ? rtnl_calcit.isra.14+0x110/0x110 net/core/rtnetlink.c:3188
 ? netlink_rcv_skb+0x44/0x110 net/netlink/af_netlink.c:2448
 ? netlink_unicast_kernel net/netlink/af_netlink.c:1310 [inline]
 ? netlink_unicast+0x18b/0x230 net/netlink/af_netlink.c:1336
 ? netlink_sendmsg+0x1f0/0x3b0 net/netlink/af_netlink.c:1901
 ? sock_sendmsg_nosec net/socket.c:629 [inline]
 ? sock_sendmsg+0x14/0x20 net/socket.c:639
 ? ___sys_sendmsg+0x28e/0x2f0 net/socket.c:2117
 ? try_to_wake_up+0x26a/0x360 kernel/sched/core.c:2060
 ? __check_object_size+0xf9/0x180 mm/usercopy.c:262
 ? rcu_read_unlock include/linux/rcupdate.h:687 [inline]
 ? __fget+0x67/0xa0 fs/file.c:697
 ? __sys_sendmsg+0x52/0xa0 net/socket.c:2155
 ? do_syscall_64+0x43/0xd0 arch/x86/entry/common.c:287
 ? entry_SYSCALL_64_after_hwframe+0x44/0xa9
Code: ff ff 0f 1f 44 00 00 eb ae 0f 1f 40 00 66 2e 0f 1f 84 00 00 00 00 00 4c 8b 0d 89 41 fd 00 49 81 f9 00 f0 ff ff 0f 87 12 01 00 00 <45> 0f b7 41 0a 49 89 d2 b8 c3 ff ff ff 49 8d 51 08 66 45 85 c0
RIP: reg_query_regdb_wmm+0x14/0x160 net/wireless/reg.c:919 RSP: ffffad458102b4f0
CR2: 000000000000000a
---[ end trace 0940319c2377625e ]---

^ permalink raw reply	[flat|nested] 14+ messages in thread
end of thread, other threads:[~2018-05-22 14:06 UTC | newest]

Thread overview: 14+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2018-05-19 18:33 [4.17 iwlwifi regression] NULL pointer dereference in reg_query_regdb_wmm() Eric Biggers
2018-05-21  7:42 ` Luca Coelho
2018-05-21 16:25   ` Kalle Valo
2018-05-21 16:30     ` Luca Coelho
2018-05-21 17:57       ` Kalle Valo
2018-05-21 10:10 ` Dreyfuss, Haim
2018-05-21 16:28   ` Kalle Valo
2018-05-21 16:56     ` Dreyfuss, Haim
2018-05-22 14:06       ` Kalle Valo
2018-05-22  4:47   ` Eric Biggers
2018-05-22  4:59     ` Eric Biggers
2018-05-22  7:58       ` Dreyfuss, Haim
2018-05-21 10:11 ` Dreyfuss, Haim
2018-05-21 20:34 ` [PATCH] cfg80211: fix NULL pointer derference when querying regdb Luca Coelho

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.