From mboxrd@z Thu Jan 1 00:00:00 1970 From: Kalle Valo Subject: Re: wlcore/wl12xx: spi: fix NULL pointer dereference (Oops) Date: Thu, 31 Dec 2015 08:22:24 +0000 (UTC) Message-ID: <20151231082224.EF8FF6034B@smtp.codeaurora.org> References: <1450965900-23222-1-git-send-email-uri.mashiach@compulab.co.il> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Cc: linux-wireless-u79uwXL29TY76Z2rM5mHXA@public.gmane.org, netdev-u79uwXL29TY76Z2rM5mHXA@public.gmane.org, igor.grinberg-UTxiZqZC01RS1MOuV/RT9w@public.gmane.org, Uri Mashiach To: Uri Mashiach Return-path: In-Reply-To: <1450965900-23222-1-git-send-email-uri.mashiach-UTxiZqZC01RS1MOuV/RT9w@public.gmane.org> Sender: linux-wireless-owner-u79uwXL29TY76Z2rM5mHXA@public.gmane.org List-Id: netdev.vger.kernel.org > Fix the below Oops when trying to modprobe wlcore_spi. > The oops occurs because the wl1271_power_{off,on}() > function doesn't check the power() function pointer. > > [ 23.401447] Unable to handle kernel NULL pointer dereference at > virtual address 00000000 > [ 23.409954] pgd = c0004000 > [ 23.412922] [00000000] *pgd=00000000 > [ 23.416693] Internal error: Oops: 80000007 [#1] SMP ARM > [ 23.422168] Modules linked in: wl12xx wlcore mac80211 cfg80211 > musb_dsps musb_hdrc usbcore usb_common snd_soc_simple_card evdev joydev > omap_rng wlcore_spi snd_soc_tlv320aic23_i2c rng_core snd_soc_tlv320aic23 > c_can_platform c_can can_dev snd_soc_davinci_mcasp snd_soc_edma > snd_soc_omap omap_wdt musb_am335x cpufreq_dt thermal_sys hwmon > [ 23.453253] CPU: 0 PID: 36 Comm: kworker/0:2 Not tainted > 4.2.0-00002-g951efee-dirty #233 > [ 23.461720] Hardware name: Generic AM33XX (Flattened Device Tree) > [ 23.468123] Workqueue: events request_firmware_work_func > [ 23.473690] task: de32efc0 ti: de4ee000 task.ti: de4ee000 > [ 23.479341] PC is at 0x0 > [ 23.482112] LR is at wl12xx_set_power_on+0x28/0x124 [wlcore] > [ 23.488074] pc : [<00000000>] lr : [] psr: 60000013 > [ 23.488074] sp : de4efe50 ip : 00000002 fp : 00000000 > [ 23.500162] r10: de7cdd00 r9 : dc848800 r8 : bf27af00 > [ 23.505663] r7 : bf27a1a8 r6 : dcbd8a80 r5 : dce0e2e0 r4 : > dce0d2e0 > [ 23.512536] r3 : 00000000 r2 : 00000000 r1 : 00000001 r0 : > dc848810 > [ 23.519412] Flags: nZCv IRQs on FIQs on Mode SVC_32 ISA ARM > Segment kernel > [ 23.527109] Control: 10c5387d Table: 9cb78019 DAC: 00000015 > [ 23.533160] Process kworker/0:2 (pid: 36, stack limit = 0xde4ee218) > [ 23.539760] Stack: (0xde4efe50 to 0xde4f0000) > > [...] > > [ 23.665030] [] (wl12xx_set_power_on [wlcore]) from > [] (wlcore_nvs_cb+0x118/0xa4c [wlcore]) > [ 23.675604] [] (wlcore_nvs_cb [wlcore]) from [] > (request_firmware_work_func+0x30/0x58) > [ 23.685784] [] (request_firmware_work_func) from > [] (process_one_work+0x1b4/0x4b4) > [ 23.695591] [] (process_one_work) from [] > (worker_thread+0x3c/0x4a4) > [ 23.704124] [] (worker_thread) from [] > (kthread+0xd4/0xf0) > [ 23.711747] [] (kthread) from [] > (ret_from_fork+0x14/0x3c) > [ 23.719357] Code: bad PC value > [ 23.722760] ---[ end trace 981be8510db9b3a9 ]--- > > Prevent oops by validationg power() pointer value before > calling the function. > > Signed-off-by: Uri Mashiach > Cc: stable-u79uwXL29TY76Z2rM5mHXA@public.gmane.org > Acked-by: Igor Grinberg Thanks, applied to wireless-drivers-next.git. Kalle Valo -- To unsubscribe from this list: send the line "unsubscribe linux-wireless" in the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org More majordomo info at http://vger.kernel.org/majordomo-info.html