Linux wireless drivers development
 help / color / mirror / Atom feed
* [4.17 iwlwifi regression] NULL pointer dereference in reg_query_regdb_wmm()
@ 2018-05-19 18:33 Eric Biggers
  2018-05-21  7:42 ` Luca Coelho
                   ` (3 more replies)
  0 siblings, 4 replies; 14+ messages in thread
From: Eric Biggers @ 2018-05-19 18:33 UTC (permalink / raw)
  To: Intel Linux Wireless, linux-wireless, Haim Dreyfuss, Luca Coelho,
	Kalle Valo

Hello,

Using v4.17-rc5, on a laptop with an "Intel Corporation Wireless 3165 (rev 79)"
using the iwlwifi driver, I get a NULL pointer dereference immediately after
boot.  Apparently, the 'regdb' variable in net/wireless/reg.c is NULL, yet
reg_query_regdb_wmm() is checking for IS_ERR().  It goes away if I revert commit
77e30e10ee28a5 ("iwlwifi: mvm: query regdb for wmm rule if needed").  The
symbolized crash report is:

BUG: unable to handle kernel NULL pointer dereference at 000000000000000a
PGD 0 P4D 0
Oops: 0000 [#1] PREEMPT SMP PTI
Modules linked in: kvm_intel kvm irqbypass joydev
CPU: 2 PID: 371 Comm: NetworkManager Tainted: G                T 4.17.0-rc5-00140-g0b449a441dac #5
Hardware name: Dell Inc. Inspiron 15-7568/0M5YMV, BIOS 01.00.00 08/07/2015
RIP: 0010:reg_query_regdb_wmm+0x14/0x160 net/wireless/reg.c:919
RSP: 0018:ffffad458102b4f0 EFLAGS: 00010207
RAX: ffff96a8e7b350a0 RBX: ffff96a8e7b35000 RCX: ffff96a8e7b35638
RDX: ffff96a8e14ee408 RSI: 000000000000143c RDI: ffff96a8e7b35018
RBP: 0000000000000005 R08: 0000000000013088 R09: 0000000000000000
R10: 0000000000000004 R11: 000000000000143c R12: ffffffff93ebd7a0
R13: ffff96a8e14ee400 R14: 0000000000000040 R15: 000000000000000e
FS:  00007f29f1311880(0000) GS:ffff96a8f2500000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000000000000a CR3: 0000000260e9c005 CR4: 00000000003606e0
Call Trace:
 iwl_parse_nvm_mcc_info+0x267/0x4e0 drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c:962
 iwl_mvm_get_regdomain+0x67/0xb0 drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c:311
 iwl_mvm_init_mcc+0x6f/0x1f0 drivers/net/wireless/intel/iwlwifi/mvm/nvm.c:783
 iwl_mvm_up+0x79f/0x840 drivers/net/wireless/intel/iwlwifi/mvm/fw.c:1089
 __iwl_mvm_mac_start+0x225/0x290 drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c:1108
 iwl_mvm_mac_start+0x4e/0x120 drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c:1141
 ? inetdev_event+0x72/0x4d0 net/ipv4/devinet.c:1533
 drv_start+0x2d/0x50 net/mac80211/driver-ops.c:26
 ieee80211_do_open+0x453/0x880 net/mac80211/iface.c:558
 __dev_open+0xb4/0x130 net/core/dev.c:1392
 __dev_change_flags+0x1a1/0x210 net/core/dev.c:6955
 ? call_netdevice_notifiers net/core/dev.c:1752 [inline]
 ? __dev_notify_flags+0x56/0xf0 net/core/dev.c:6993
 dev_change_flags+0x1e/0x60 net/core/dev.c:7024
 ? nla_put_ifalias+0x2e/0x90 net/core/rtnetlink.c:1459
 do_setlink+0x656/0xd80 net/core/rtnetlink.c:2362
 ? new_slab_objects mm/slub.c:2452 [inline]
 ? ___slab_alloc+0x48a/0x560 mm/slub.c:2604
 ? memset include/linux/string.h:330 [inline]
 ? __nla_reserve+0x38/0x50 lib/nlattr.c:437
 ? __nla_put+0xc/0x20 lib/nlattr.c:568
 ? nla_put+0x2f/0x40 lib/nlattr.c:627
 ? nla_put_u8 include/net/netlink.h:780 [inline]
 ? rtnl_xdp_fill+0x172/0x1d0 net/core/rtnetlink.c:1379
 ? memset include/linux/string.h:330 [inline]
 ? __nla_reserve+0x38/0x50 lib/nlattr.c:437
 ? memset include/linux/string.h:330 [inline]
 ? __nla_reserve+0x38/0x50 lib/nlattr.c:437
 ? inet_fill_link_af+0x1c/0x50 net/ipv4/devinet.c:1738
 ? rtnl_newlink+0x793/0x930 net/core/rtnetlink.c:2970
 ? spin_unlock_irqrestore include/linux/spinlock.h:365 [inline]
 ? __wake_up_common_lock+0x84/0xb0 kernel/sched/wait.c:120
 ? rtnetlink_rcv_msg+0x121/0x390 net/core/rtnetlink.c:4646
 ? fast_dput fs/dcache.c:716 [inline]
 ? dput.part.5+0x92/0x120 fs/dcache.c:837
 ? __lookup_slow+0x137/0x160 fs/namei.c:1633
 ? rtnl_calcit.isra.14+0x110/0x110 net/core/rtnetlink.c:3188
 ? netlink_rcv_skb+0x44/0x110 net/netlink/af_netlink.c:2448
 ? netlink_unicast_kernel net/netlink/af_netlink.c:1310 [inline]
 ? netlink_unicast+0x18b/0x230 net/netlink/af_netlink.c:1336
 ? netlink_sendmsg+0x1f0/0x3b0 net/netlink/af_netlink.c:1901
 ? sock_sendmsg_nosec net/socket.c:629 [inline]
 ? sock_sendmsg+0x14/0x20 net/socket.c:639
 ? ___sys_sendmsg+0x28e/0x2f0 net/socket.c:2117
 ? try_to_wake_up+0x26a/0x360 kernel/sched/core.c:2060
 ? __check_object_size+0xf9/0x180 mm/usercopy.c:262
 ? rcu_read_unlock include/linux/rcupdate.h:687 [inline]
 ? __fget+0x67/0xa0 fs/file.c:697
 ? __sys_sendmsg+0x52/0xa0 net/socket.c:2155
 ? do_syscall_64+0x43/0xd0 arch/x86/entry/common.c:287
 ? entry_SYSCALL_64_after_hwframe+0x44/0xa9
Code: ff ff 0f 1f 44 00 00 eb ae 0f 1f 40 00 66 2e 0f 1f 84 00 00 00 00 00 4c 8b 0d 89 41 fd 00 49 81 f9 00 f0 ff ff 0f 87 12 01 00 00 <45> 0f b7 41 0a 49 89 d2 b8 c3 ff ff ff 49 8d 51 08 66 45 85 c0
RIP: reg_query_regdb_wmm+0x14/0x160 net/wireless/reg.c:919 RSP: ffffad458102b4f0
CR2: 000000000000000a
---[ end trace 0940319c2377625e ]---

^ permalink raw reply	[flat|nested] 14+ messages in thread
end of thread, other threads:[~2018-05-22 14:06 UTC | newest]

Thread overview: 14+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2018-05-19 18:33 [4.17 iwlwifi regression] NULL pointer dereference in reg_query_regdb_wmm() Eric Biggers
2018-05-21  7:42 ` Luca Coelho
2018-05-21 16:25   ` Kalle Valo
2018-05-21 16:30     ` Luca Coelho
2018-05-21 17:57       ` Kalle Valo
2018-05-21 10:10 ` Dreyfuss, Haim
2018-05-21 16:28   ` Kalle Valo
2018-05-21 16:56     ` Dreyfuss, Haim
2018-05-22 14:06       ` Kalle Valo
2018-05-22  4:47   ` Eric Biggers
2018-05-22  4:59     ` Eric Biggers
2018-05-22  7:58       ` Dreyfuss, Haim
2018-05-21 10:11 ` Dreyfuss, Haim
2018-05-21 20:34 ` [PATCH] cfg80211: fix NULL pointer derference when querying regdb Luca Coelho

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox