Re: [PATCH wireless v2] wifi: brcmfmac: fix crash while sending Action Frames in standalone AP Mode

[Arend van Spriel <arend.vanspriel@broadcom.com>]

On 10/13/2025 12:28 PM, Gokul Sivakumar wrote:
> Currently, whenever there is a need to transmit an Action frame,
> the brcmfmac driver always uses the P2P vif to send the "actframe" IOVAR to
> firmware. The P2P interfaces were available when wpa_supplicant is managing
> the wlan interface.
> 
> However, the P2P interfaces are not created/initialized when only hostapd
> is managing the wlan interface. And if hostapd receives an ANQP Query REQ
> Action frame even from an un-associated STA, the brcmfmac driver tries
> to use an uninitialized P2P vif pointer for sending the IOVAR to firmware.
> This NULL pointer dereferencing triggers a driver crash.
> 
>   [ 1417.074538] Unable to handle kernel NULL pointer dereference at virtual
>   address 0000000000000000

[...]

> 
> Fixes: 18e2f61db3b7 ("brcmfmac: P2P action frame tx")

Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>

> Signed-off-by: Gokul Sivakumar <gokulkumar.sivakumar@infineon.com>
> ---
> 
> v2:
> - Retain the reinit_completion() for "senf_af_done" in existing function
>    brcmf_p2p_tx_action_frame(). And move the init_completion() from
>    brcmf_p2p_create_p2pdev() to the brcmf_p2p_attach() function.
> 
>   .../broadcom/brcm80211/brcmfmac/cfg80211.c    |  3 +-
>   .../broadcom/brcm80211/brcmfmac/p2p.c         | 28 +++++++------------
>   .../broadcom/brcm80211/brcmfmac/p2p.h         |  3 +-
>   3 files changed, 12 insertions(+), 22 deletions(-)