Re: [4.17 iwlwifi regression] NULL pointer dereference in reg_query_regdb_wmm()

[Kalle Valo <kvalo@codeaurora.org>]

Luca Coelho <luca@coelho.fi> writes:

> On Mon, 2018-05-21 at 19:25 +0300, Kalle Valo wrote:
>> Luca Coelho <luca@coelho.fi> writes:
>> 
>> > On Sat, 2018-05-19 at 11:33 -0700, Eric Biggers wrote:
>> > > Hello,
>> > > 
>> > > Using v4.17-rc5, on a laptop with an "Intel Corporation Wireless
>> > > 3165
>> > > (rev 79)"
>> > > using the iwlwifi driver, I get a NULL pointer dereference
>> > > immediately after
>> > > boot.  Apparently, the 'regdb' variable in net/wireless/reg.c is
>> > > NULL, yet
>> > > reg_query_regdb_wmm() is checking for IS_ERR().  It goes away if
>> > > I
>> > > revert commit
>> > > 77e30e10ee28a5 ("iwlwifi: mvm: query regdb for wmm rule if
>> > > needed").  The
>> > > symbolized crash report is:
>> > > 
>> > > BUG: unable to handle kernel NULL pointer dereference at
>> > > 000000000000000a
>> > 
>> > Thanks for the report and analysis! Haim is working on a fix and I
>> > will
>> > send it out later today.
>> 
>> We are on -rc6 already and getting close to the final v4.17 release.
>> I
>> wonder should we just revert 77e30e10ee28a5 for now?
>
> I don't think we should revert it, this implements the new ETSI
> requirements for the WMM settings and this will be enforced in all new
> devices sold after mid-June (IIRC).
>
> We haven't seen this problem and cfg80211 should not crash if the
> driver does stupid things, so we should just reject the call if regdb
> is still NULL.  It's a simple fix for the crash and the driver should
> recover from the issue later on.
>
> I'll push the patch for cfg80211 later this evening.

Very good that we have a quick fix, and I assume that will go through
mac80211 tree so I can send my w-d pull request tomorrow.

-- 
Kalle Valo