From mboxrd@z Thu Jan 1 00:00:00 1970 Return-path: Received: from smtp.codeaurora.org ([198.145.29.96]:56607 "EHLO smtp.codeaurora.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753704AbbE1JDx (ORCPT ); Thu, 28 May 2015 05:03:53 -0400 From: Kalle Valo To: Arend van Spriel Cc: linux-wireless , Subject: Re: [for-4.1] brcmfmac: avoid null pointer access whenbrcmf_msgbuf_get_pktid() fails References: <20150528084642.220B4140749@smtp.codeaurora.org> Date: Thu, 28 May 2015 12:03:45 +0300 In-Reply-To: <20150528084642.220B4140749@smtp.codeaurora.org> (Kalle Valo's message of "Thu, 28 May 2015 08:46:42 +0000 (UTC)") Message-ID: <87pp5lxedq.fsf@kamboji.qca.qualcomm.com> (sfid-20150528_110437_849869_4AE1A2F9) MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Sender: linux-wireless-owner@vger.kernel.org List-ID: Kalle Valo writes: >> The function brcmf_msgbuf_get_pktid() may return a NULL pointer so >> the callers should check the return pointer before accessing it to >> avoid the crash below (see [1]): >> >> brcmfmac: brcmf_msgbuf_get_pktid: Invalid packet id 273 (not in use) >> BUG: unable to handle kernel NULL pointer dereference at 0000000000000080 >> IP: [] skb_pull+0x5/0x50 >> PGD 0 >> Oops: 0000 [#1] PREEMPT SMP >> Modules linked in: pci_stub vboxpci(O) vboxnetflt(O) vboxnetadp(O) vboxdrv(O) >> snd_hda_codec_hdmi bnep mousedev hid_generic ushwmon msr ext4 crc16 mbcache >> jbd2 sd_mod uas usb_storage ahci libahci libata scsi_mod xhci_pci xhci_hcd >> usbcore usb_common >> CPU: 0 PID: 1661 Comm: irq/61-brcmf_pc Tainted: G O 4.0.1-MacbookPro-ARCH #1 >> Hardware name: Apple Inc. MacBookPro12,1/Mac-E43C1C25D4880AD6, >> BIOS MBP121.88Z.0167.B02.1503241251 03/24/2015 >> task: ffff880264203cc0 ti: ffff88025ffe4000 task.ti: ffff88025ffe4000 >> RIP: 0010:[] [] skb_pull+0x5/0x50 >> RSP: 0018:ffff88025ffe7d40 EFLAGS: 00010202 >> RAX: 0000000000000000 RBX: ffff88008a33c000 RCX: 0000000000000044 >> RDX: 0000000000000000 RSI: 000000000000004a RDI: 0000000000000000 >> RBP: ffff88025ffe7da8 R08: 0000000000000096 R09: 000000000000004a >> R10: 0000000000000000 R11: 000000000000048e R12: ffff88025ff14f00 >> R13: 0000000000000000 R14: ffff880263b48200 R15: ffff88008a33c000 >> FS: 0000000000000000(0000) GS:ffff88026ec00000(0000) knlGS:0000000000000000 >> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 >> CR2: 0000000000000080 CR3: 000000000180b000 CR4: 00000000003407f0 >> Stack: >> ffffffffa06aed74 ffff88025ffe7dc8 ffff880263b48270 ffff880263b48278 >> 05ea88020000004a 0002ffff81014635 000000001720b2f6 ffff88026ec116c0 >> ffff880263b48200 0000000000010000 ffff880263b4ae00 ffff880264203cc0 >> Call Trace: >> [] ? brcmf_msgbuf_process_rx+0x404/0x480 [brcmfmac] >> [] ? irq_finalize_oneshot.part.30+0xf0/0xf0 >> [] brcmf_proto_msgbuf_rx_trigger+0x35/0xf0 [brcmfmac] >> [] brcmf_pcie_isr_thread_v2+0x8a/0x130 [brcmfmac] >> [] irq_thread_fn+0x20/0x50 >> [] irq_thread+0x13f/0x170 >> [] ? wake_threads_waitq+0x30/0x30 >> [] ? irq_thread_dtor+0xb0/0xb0 >> [] kthread+0xd8/0xf0 >> [] ? kthread_create_on_node+0x1c0/0x1c0 >> [] ret_from_fork+0x58/0x90 >> [] ? kthread_create_on_node+0x1c0/0x1c0 >> Code: 01 83 e2 f7 88 50 01 48 83 c4 08 5b 5d f3 c3 0f 1f 80 00 00 00 00 83 e2 >> f7 88 50 01 c3 66 0f 1f 84 00 00 00 00 00 0f 1f >> RIP [] skb_pull+0x5/0x50 >> RSP >> CR2: 0000000000000080 >> ---[ end trace b074c0f90e7c997d ]--- >> >> [1] http://mid.gmane.org/20150430193259.GA5630@googlemail.com >> >> Cc: # v3.18, v3.19, v4.0, v4.1 >> Reported-by: Michael Hornung >> Reviewed-by: Hante Meuleman >> Reviewed-by: Pieter-Paul Giesberts >> Signed-off-by: Arend van Spriel > > Thanks, applied to wireless-drivers.git. Oh, I forgot to mention that I'm not sure if this will make it into 4.1. But let's at least try. -- Kalle Valo