linux_dsm_epyc7002/drivers/net/wireless/iwlwifi/mvm
Emmanuel Grumbach 22cba0c085 iwlwifi: mvm: BT Coex fix NULL pointer dereference
When we disassociate, mac80211 removes the station and
then, it sets the bss it unsets the assoc bool in bss_info.

Since the firwmware wants it the opposite (first set the
MAC context as unassoc, and only then, remove the STA of
the API), we have a small period of time in which the STA
in firmware doesn't have a valid ieee80211_sta pointer.
During that time, iwl_mvm_vif->ap_sta_id, is still set
to the STA in firmware that represent the AP.

This avoids:

[ 4481.476246] BUG: unable to handle kernel NULL pointer dereference at 00000045
[ 4481.479521] IP: [<f8416a6a>] iwl_mvm_bt_coex_reduced_txp+0x7a/0x190 [iwlmvm]
[ 4481.482023] *pde = 00000000
[ 4481.484332] Oops: 0000 [#1] SMP DEBUG_PAGEALLOC
[ 4481.486897] Modules linked in: netconsole configfs autofs4 rfcomm(O) bnep(O) nfsd nfs_acl auth_rpcgss exportfs nfs lockd binfmt_misc sunrpc fscache arc4 iwlmvm(O) mac80211(O) btusb(O) iwlwifi(O) bluetooth(O) cfg80211(O) snd_hda_codec_hdmi coretemp dell_wmi snd_hda_codec_idt compat(O) dell_laptop aesni_intel i915 sparse_keymap dcdbas cryptd psmouse serio_raw aes_i586 microcode snd_hda_intel drm_kms_helper snd_hda_codec drm snd_pcm snd_timer i2c_algo_bit video intel_agp intel_gtt snd soundcore snd_page_alloc crc32c_intel ahci sdhci_pci libahci sdhci mmc_core e1000e xhci_hcd [last unloaded: configfs]
[ 4481.502983]
[ 4481.505599] Pid: 6507, comm: kworker/0:1 Tainted: G           O 3.4.43-dev #1 Dell Inc. Latitude E6430/0CMDYV
[ 4481.508575] EIP: 0060:[<f8416a6a>] EFLAGS: 00010246 CPU: 0
[ 4481.511248] EIP is at iwl_mvm_bt_coex_reduced_txp+0x7a/0x190 [iwlmvm]
[ 4481.513947] EAX: ffffffea EBX: 00000002 ECX: 00000001 EDX: 00000001
[ 4481.516710] ESI: ec6f0f28 EDI: 00000000 EBP: e8175dfc ESP: e8175d9c
[ 4481.519445]  DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068
[ 4481.522185] CR0: 8005003b CR2: 00000045 CR3: 01a5e000 CR4: 001407d0
[ 4481.524950] DR0: 00000000 DR1: 00000000 DR2: 00000000 DR3: 00000000
[ 4481.527768] DR6: ffff0ff0 DR7: 00000400
[ 4481.530565] Process kworker/0:1 (pid: 6507, ti=e8174000 task=e8032b20 task.ti=e8174000)
[ 4481.533447] Stack:
[ 4481.536379]  e472439f 00003a12 e8032b20 e8033048 00000001 e8175ddc 00000246 e8033040
[ 4481.540132]  00000002 01814990 ec4d1ddc e8175dcc 00000000 00000000 00000000 00000000
[ 4481.543867]  00000000 00000000 00000001 000001c8 009b0002 ec4d1ddc ec6f0f28 00000000
[ 4481.547633] Call Trace:
[ 4481.550578]  [<f8418027>] iwl_mvm_bt_rssi_event+0x197/0x220 [iwlmvm]
[ 4481.553537]  [<f840919c>] iwl_mvm_stat_iterator+0xdc/0x240 [iwlmvm]
[ 4481.556582]  [<f8d129c2>] __iterate_active_interfaces+0xe2/0x1f0 [mac80211]
[ 4481.559544]  [<f84090c0>] ? iwl_mvm_update_smps+0x90/0x90 [iwlmvm]
[ 4481.562519]  [<f84090c0>] ? iwl_mvm_update_smps+0x90/0x90 [iwlmvm]
[ 4481.565498]  [<f8d12b0c>] ieee80211_iterate_active_interfaces+0x3c/0x50 [mac80211]
[ 4481.568421]  [<f8409b43>] iwl_mvm_rx_statistics+0xb3/0x130 [iwlmvm]
[ 4481.571349]  [<f8405431>] iwl_mvm_async_handlers_wk+0xc1/0xf0 [iwlmvm]
[ 4481.574251]  [<c1052915>] ? process_one_work+0x105/0x5c0
[ 4481.577162]  [<c1052991>] process_one_work+0x181/0x5c0
[ 4481.580025]  [<c1052915>] ? process_one_work+0x105/0x5c0
[ 4481.582861]  [<f8405370>] ? iwl_mvm_rx_fw_logs+0x20/0x20 [iwlmvm]
[ 4481.585722]  [<c10530f1>] worker_thread+0x121/0x2c0
[ 4481.588536]  [<c1052fd0>] ? rescuer_thread+0x1d0/0x1d0
[ 4481.591323]  [<c105af0d>] kthread+0x7d/0x90
[ 4481.594059]  [<c105ae90>] ? flush_kthread_worker+0x120/0x120
[ 4481.596868]  [<c15b7cc2>] kernel_thread_helper+0x6/0x10
[ 4481.599605] Code: 9d de c3 c8 85 c0 74 0d 80 3d f8 ae 42 f8 00 0f 84 dc 00 00 00 8b 45 c8 0f b6 d3 31 ff 89 55 c0 8b 84 90 d8 03 00 00 0f b6 55 c7 <38> 50 5b 89 45 bc 0f 84 a8 00 00 00 a1 e4 d2 04 c2 85 c0 0f 84
[ 4481.611782] EIP: [<f8416a6a>] iwl_mvm_bt_coex_reduced_txp+0x7a/0x190 [iwlmvm] SS:ESP 0068:e8175d9c
[ 4481.614985] CR2: 0000000000000045
[ 4481.687441] ---[ end trace b11bc915fbac4412 ]---

Reviewed-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
2013-10-29 14:51:01 +01:00
..
binding.c iwlwifi: a few fixes in license 2013-03-06 16:46:59 +01:00
bt-coex.c iwlwifi: mvm: BT Coex fix NULL pointer dereference 2013-10-29 14:51:01 +01:00
constants.h iwlwifi: mvm: Adjust some power management constants 2013-10-02 18:00:35 +02:00
d3.c iwlwifi: mvm: keep connection to AP after WoWLAN 2013-10-11 09:57:53 +02:00
debugfs.c iwlwifi: mvm: fix fw_rx_stats debugfs entry 2013-10-18 16:02:22 +02:00
fw-api-bt-coex.h iwlwifi: mvm: BT Coex - always set mandatory fields 2013-10-18 16:02:00 +02:00
fw-api-d3.h iwlwifi: mvm: keep connection to AP after WoWLAN 2013-10-11 09:57:53 +02:00
fw-api-mac.h iwlwifi: mvm: add IBSS support 2013-10-11 10:14:08 +02:00
fw-api-power.h iwlwifi: mvm: Add device wide power command 2013-10-11 09:56:57 +02:00
fw-api-rs.h iwlwifi: mvm: support VHT in rs 2013-10-02 18:00:41 +02:00
fw-api-scan.h iwlwifi: mvm: support sched scan if supported by the fw 2013-10-02 18:00:39 +02:00
fw-api-sta.h iwlwifi: mvm: split ADD_STA and ADD_STA_KEY in firmware API 2013-10-02 18:00:36 +02:00
fw-api-tx.h iwlwifi: mvm: remove obsolete flag in TX command API 2013-07-31 11:05:05 +02:00
fw-api.h iwlwifi: mvm: add support for NICs which have only 16 Tx queues. 2013-10-11 09:56:58 +02:00
fw.c iwlwifi: mvm: add support for NICs which have only 16 Tx queues. 2013-10-11 09:56:58 +02:00
led.c iwlwifi: a few fixes in license 2013-03-06 16:46:59 +01:00
mac80211.c iwlwifi: mvm: update UAPSD support TLV bits 2013-10-29 14:45:23 +01:00
mac-ctxt.c iwlwifi: mvm: add IBSS support 2013-10-11 10:14:08 +02:00
Makefile iwlwifi: mvm: Upgrade to a new power management uAPSD API 2013-07-16 16:13:23 +03:00
mvm.h iwlwifi: mvm: add IBSS support 2013-10-11 10:14:08 +02:00
nvm.c iwlwifi: mvm: NVM - increase max section size 2013-10-18 16:01:27 +02:00
ops.c iwlwifi: mvm: update UAPSD support TLV bits 2013-10-29 14:45:23 +01:00
phy-ctxt.c iwlwifi: mvm: implement D3 testing 2013-05-29 21:56:57 +02:00
power_legacy.c iwlwifi: mvm: Upgrade to a new power management uAPSD API 2013-07-16 16:13:23 +03:00
power.c iwlwifi: mvm: Add device wide power command 2013-10-11 09:56:57 +02:00
quota.c iwlwifi: mvm: fix operator precedence 2013-10-18 16:02:38 +02:00
rs.c iwlwifi: mvm: BT Coex - update integration with rate control 2013-10-11 09:58:52 +02:00
rs.h iwlwifi: mvm: remove GF support in rs 2013-10-02 18:00:42 +02:00
rx.c iwlwifi: mvm: Implement BT coex notifications 2013-10-02 18:00:34 +02:00
scan.c iwlwifi: mvm: support sched scan if supported by the fw 2013-10-02 18:00:39 +02:00
sta.c iwlwifi: mvm: add IBSS support 2013-10-11 10:14:08 +02:00
sta.h iwlwifi: mvm: query firmware for non-QoS seqno 2013-10-02 18:00:32 +02:00
testmode.h iwlwifi: mvm: implement beacon filtering testmode command 2013-10-02 18:00:31 +02:00
time-event.c iwlwifi: mvm: give client MACs time to synchronise during restart 2013-10-02 18:00:34 +02:00
time-event.h iwlwifi: mvm: give client MACs time to synchronise during restart 2013-10-02 18:00:34 +02:00
tt.c iwlwifi: mvm: add high temperature SKU thermal throttling parameters 2013-07-31 11:05:07 +02:00
tx.c iwlwifi: mvm: add support for NICs which have only 16 Tx queues. 2013-10-11 09:56:58 +02:00
utils.c iwlwifi: mvm: don't sleep while allocating in atomic context 2013-10-02 18:00:38 +02:00