93 lines
4.4 KiB
Diff
93 lines
4.4 KiB
Diff
|
From: Arend van Spriel <arend@broadcom.com>
|
||
|
|
Date: Wed, 26 Aug 2015 22:14:56 +0200
|
||
|
|
Subject: [PATCH] brcmfmac: only call brcmf_cfg80211_detach() when attach
|
||
|
|
was successful
|
||
|
|
|
||
|
|
In brcmf_bus_start() the function brcmf_cfg80211_attach() is called which
|
||
|
|
may fail. If this happens we should not call brcmf_cfg80211_detach() in
|
||
|
|
the failure path as it will result in NULL pointer dereference:
|
||
|
|
|
||
|
|
brcmf_fweh_activate_events: Set event_msgs error (-5)
|
||
|
|
brcmf_bus_start: failed: -5
|
||
|
|
brcmf_sdio_firmware_callback: dongle is not responding
|
||
|
|
BUG: unable to handle kernel NULL pointer dereference at 0000000000000068
|
||
|
|
IP: [<ffffffff811e8f08>] kernfs_find_ns+0x18/0xd0
|
||
|
|
PGD 0
|
||
|
|
Oops: 0000 [#1] SMP
|
||
|
|
Modules linked in: brcmfmac(O) brcmutil(O) cfg80211 auth_rpcgss
|
||
|
|
CPU: 1 PID: 45 Comm: kworker/1:1 Tainted: G O
|
||
|
|
Hardware name: Dell Inc. Latitude E6410/07XJP9, BIOS A07 02/15/2011
|
||
|
|
Workqueue: events request_firmware_work_func
|
||
|
|
task: ffff880036c09ac0 ti: ffff880036dd4000 task.ti: ffff880036dd4000
|
||
|
|
RIP: 0010:[<ffffffff811e8f08>] [<ffffffff811e8f08>] kernfs_find_ns+0x18/0xd0
|
||
|
|
RSP: 0018:ffff880036dd7a28 EFLAGS: 00010246
|
||
|
|
RAX: ffff880036c09ac0 RBX: 0000000000000000 RCX: 000000007fffffff
|
||
|
|
RDX: 0000000000000000 RSI: ffffffff816578b9 RDI: 0000000000000000
|
||
|
|
RBP: ffff880036dd7a48 R08: 0000000000000000 R09: ffff880036c0b340
|
||
|
|
R10: 00000000000002ec R11: ffff880036dd7b08 R12: ffffffff816578b9
|
||
|
|
R13: 0000000000000000 R14: ffffffff816578b9 R15: ffff8800c6c87000
|
||
|
|
FS: 0000000000000000(0000) GS:ffff88012bc40000(0000) knlGS:0000000000000000
|
||
|
|
CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b
|
||
|
|
CR2: 0000000000000068 CR3: 0000000001a0b000 CR4: 00000000000006e0
|
||
|
|
Stack:
|
||
|
|
0000000000000000 ffffffff816578b9 0000000000000000 ffff8800c0d003c8
|
||
|
|
ffff880036dd7a78 ffffffff811e8ff5 0000000ffffffff1 ffffffff81a9b060
|
||
|
|
ffff8800c789f880 ffff8800c0d00000 ffff880036dd7a98 ffffffff811ebe0d
|
||
|
|
Call Trace:
|
||
|
|
[<ffffffff811e8ff5>] kernfs_find_and_get_ns+0x35/0x60
|
||
|
|
[<ffffffff811ebe0d>] sysfs_unmerge_group+0x1d/0x60
|
||
|
|
[<ffffffff81404ef2>] dpm_sysfs_remove+0x22/0x60
|
||
|
|
[<ffffffff813f9db9>] device_del+0x49/0x240
|
||
|
|
[<ffffffff815da768>] rfkill_unregister+0x58/0xc0
|
||
|
|
[<ffffffffa06bd91b>] wiphy_unregister+0xab/0x2f0 [cfg80211]
|
||
|
|
[<ffffffffa0742fe3>] brcmf_cfg80211_detach+0x23/0x50 [brcmfmac]
|
||
|
|
[<ffffffffa074d986>] brcmf_detach+0x86/0xe0 [brcmfmac]
|
||
|
|
[<ffffffffa0757de8>] brcmf_sdio_remove+0x48/0x120 [brcmfmac]
|
||
|
|
[<ffffffffa0758ed9>] brcmf_sdiod_remove+0x29/0xd0 [brcmfmac]
|
||
|
|
[<ffffffffa0759031>] brcmf_ops_sdio_remove+0xb1/0x110 [brcmfmac]
|
||
|
|
[<ffffffffa001c267>] sdio_bus_remove+0x37/0x100 [mmc_core]
|
||
|
|
[<ffffffff813fe026>] __device_release_driver+0x96/0x130
|
||
|
|
[<ffffffff813fe0e3>] device_release_driver+0x23/0x30
|
||
|
|
[<ffffffffa0754bc8>] brcmf_sdio_firmware_callback+0x2a8/0x5d0 [brcmfmac]
|
||
|
|
[<ffffffffa074deaf>] brcmf_fw_request_nvram_done+0x15f/0x5e0 [brcmfmac]
|
||
|
|
[<ffffffff8140142f>] ? devres_add+0x3f/0x50
|
||
|
|
[<ffffffff810642b5>] ? usermodehelper_read_unlock+0x15/0x20
|
||
|
|
[<ffffffff81400000>] ? platform_match+0x70/0xa0
|
||
|
|
[<ffffffff8140f400>] request_firmware_work_func+0x30/0x60
|
||
|
|
[<ffffffff8106828c>] process_one_work+0x14c/0x3d0
|
||
|
|
[<ffffffff8106862a>] worker_thread+0x11a/0x450
|
||
|
|
[<ffffffff81068510>] ? process_one_work+0x3d0/0x3d0
|
||
|
|
[<ffffffff8106d692>] kthread+0xd2/0xf0
|
||
|
|
[<ffffffff8106d5c0>] ? kthread_create_on_node+0x180/0x180
|
||
|
|
[<ffffffff815ed35f>] ret_from_fork+0x3f/0x70
|
||
|
|
[<ffffffff8106d5c0>] ? kthread_create_on_node+0x180/0x180
|
||
|
|
Code: e9 40 fe ff ff 48 89 d8 eb 87 66 0f 1f 84 00 00 00 00 00 66 66 66 66
|
||
|
|
90 55 48 89 e5 41 56 49 89 f6 41 55 49 89 d5 31 d2 41 54 53 <0f> b7
|
||
|
|
47 68 48 8b 5f 48 66 c1 e8 05 83 e0 01 4d 85 ed 0f b6 c8
|
||
|
|
RIP [<ffffffff811e8f08>] kernfs_find_ns+0x18/0xd0
|
||
|
|
RSP <ffff880036dd7a28>
|
||
|
|
CR2: 0000000000000068
|
||
|
|
---[ end trace 87d6ec0d3fe46740 ]---
|
||
|
|
|
||
|
|
Reported-by: Daniel (Deognyoun) Kim <dekim@broadcom.com>
|
||
|
|
Reviewed-by: Hante Meuleman <meuleman@broadcom.com>
|
||
|
|
Reviewed-by: Franky (Zhenhui) Lin <frankyl@broadcom.com>
|
||
|
|
Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
|
||
|
|
Signed-off-by: Arend van Spriel <arend@broadcom.com>
|
||
|
|
---
|
||
|
|
|
||
|
|
--- a/drivers/net/wireless/brcm80211/brcmfmac/core.c
|
||
|
|
+++ b/drivers/net/wireless/brcm80211/brcmfmac/core.c
|
||
|
|
@@ -1049,7 +1049,10 @@ int brcmf_bus_start(struct device *dev)
|
||
|
|
fail:
|
||
|
|
if (ret < 0) {
|
||
|
|
brcmf_err("failed: %d\n", ret);
|
||
|
|
- brcmf_cfg80211_detach(drvr->config);
|
||
|
|
+ if (drvr->config) {
|
||
|
|
+ brcmf_cfg80211_detach(drvr->config);
|
||
|
|
+ drvr->config = NULL;
|
||
|
|
+ }
|
||
|
|
if (drvr->fws) {
|
||
|
|
brcmf_fws_del_interface(ifp);
|
||
|
|
brcmf_fws_deinit(drvr);
|