1. 19 3月, 2015 2 次提交
  2. 12 3月, 2015 2 次提交
  3. 05 3月, 2015 1 次提交
    • E
      iwlwifi: mvm: BT Coex - fix a NULL pointer exception · 4cd4b50c
      Emmanuel Grumbach 提交于
      The commit below introduced an unsafe dereference of
      mvmvif->phy_ctxt. It can be NULL even if we hold the mutex.
      We can be handling a BT Coex notification while the vif has
      already been unassigned. This can happen since the BT Coex
      notification is hanled asynchronuously: we can have started
      to handle the BT Coex notification trying to acquire the
      mutex while the unassign flow already got it. The BT Coex
      notification handling will wait for the mutext. I'll get it
      later, but then mvmvif->phy_ctxt will be NULL.
      
      Panic log:
      
      BUG: unable to handle kernel NULL pointer dereference at   (null)
      IP: [<f985180d>] iwl_mvm_bt_notif_iterator+0x9d/0x340 [iwlmvm]
      *pdpt = 0000000000000000 *pde = f000eef300000007
      Oops: 0000 [#1] SMP
      Workqueue: events iwl_mvm_async_handlers_wk [iwlmvm]
      task: ed719b20 ti: ec03e000 task.ti: ec03e000
      EIP: 0060:[<f985180d>] EFLAGS: 00010202 CPU: 2
      EIP is at iwl_mvm_bt_notif_iterator+0x9d/0x340 [iwlmvm]
      EAX: 00000000 EBX: f6d3cb70 ECX: f6d3cb70 EDX: 00000000
      ESI: ec03fe40 EDI: efeb8810 EBP: ec03fdf0 ESP: ec03fdac
       DS: 007b ES: 007b FS: 00d8 GS: 0000 SS: 0068
      CR0: 80050033 CR2: 00000000 CR3: 01a1a000 CR4: 001407f0
      Stack:
       f743ca80 f744a404 ec03fdcc c10e3952 00003aba f743ca80 00000246 f743ca80
       00000246 00000000 00000001 00000000 ebd45ff6 ebd458a4 f6d3c500 ebd45578
       ebd44b01 ec03fe18 f99e1bc2 00000002 ebd44bc0 f9851770 00000000 f6d3c500
      Call Trace:
       [<c10e3952>] ? ring_buffer_unlock_commit+0xa2/0xd0
       [<f99e1bc2>] __iterate_interfaces+0x82/0x110 [mac80211]
       [<f9851770>] ? iwl_mvm_bt_coex_reduced_txp+0x140/0x140 [iwlmvm]
       [<f99e1c6a>] ieee80211_iterate_active_interfaces_atomic+0x1a/0x20 [mac80211]
       [<f9851427>] iwl_mvm_bt_coex_notif_handle+0x77/0x280 [iwlmvm]
       [<f9852161>] iwl_mvm_rx_bt_coex_notif_old+0x211/0x220 [iwlmvm]
       [<f9850b8b>] iwl_mvm_rx_bt_coex_notif+0x19b/0x1b0 [iwlmvm]
       [<f983944f>] iwl_mvm_async_handlers_wk+0x7f/0xe0 [iwlmvm]
      
      CC: <stable@vger.kernel.org> [3.19+]
      Fixes: 123f5156 ("iwlwifi: mvm: BT Coex - add support for TTC / RRC")
      Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>
      4cd4b50c
  4. 25 2月, 2015 1 次提交
  5. 24 2月, 2015 5 次提交
  6. 18 2月, 2015 29 次提交