linux_dsm_epyc7002/drivers/net/wireless
Larry Finger 2d838bb608 b43legacy: Fix crash on unload when firmware not available
When b43legacy is loaded without the firmware being available, a following
unload generates a kernel NULL pointer dereference BUG as follows:

[  214.330789] BUG: unable to handle kernel NULL pointer dereference at 0000004c
[  214.330997] IP: [<c104c395>] drain_workqueue+0x15/0x170
[  214.331179] *pde = 00000000
[  214.331311] Oops: 0000 [] SMP
[  214.331471] Modules linked in: b43legacy(-) ssb pcmcia mac80211 cfg80211 af_packet mperf arc4 ppdev sr_mod cdrom sg shpchp yenta_socket pcmcia_rsrc pci_hotplug pcmcia_core battery parport_pc parport floppy container ac button edd autofs4 ohci_hcd ehci_hcd usbcore usb_common thermal processor scsi_dh_rdac scsi_dh_hp_sw scsi_dh_emc scsi_dh_alua scsi_dh fan thermal_sys hwmon ata_generic pata_ali libata [last unloaded: cfg80211]
[  214.333421] Pid: 3639, comm: modprobe Not tainted 3.6.0-rc6-wl+  Source Technology VIC 9921/ALI Based Notebook
[  214.333580] EIP: 0060:[<c104c395>] EFLAGS: 00010246 CPU: 0
[  214.333687] EIP is at drain_workqueue+0x15/0x170
[  214.333788] EAX: c162ac40 EBX: cdfb8360 ECX: 0000002a EDX: 00002a2a
[  214.333890] ESI: 00000000 EDI: 00000000 EBP: cd767e7c ESP: cd767e5c
[  214.333957]  DS: 007b ES: 007b FS: 00d8 GS: 0033 SS: 0068
[  214.333957] CR0: 8005003b CR2: 0000004c CR3: 0c96a000 CR4: 00000090
[  214.333957] DR0: 00000000 DR1: 00000000 DR2: 00000000 DR3: 00000000
[  214.333957] DR6: ffff0ff0 DR7: 00000400
[  214.333957] Process modprobe (pid: 3639, ti=cd766000 task=cf802e90 task.ti=cd766000)
[  214.333957] Stack:
[  214.333957]  00000292 cd767e74 c12c5e09 00000296 00000296 cdfb8360 cdfb9220 00000000
[  214.333957]  cd767e90 c104c4fd cdfb8360 cdfb9220 cd682800 cd767ea4 d0c10184 cd682800
[  214.333957]  cd767ea4 cba31064 cd767eb8 d0867908 cba31064 d087e09c cd96f034 cd767ec4
[  214.333957] Call Trace:
[  214.333957]  [<c12c5e09>] ? skb_dequeue+0x49/0x60
[  214.333957]  [<c104c4fd>] destroy_workqueue+0xd/0x150
[  214.333957]  [<d0c10184>] ieee80211_unregister_hw+0xc4/0x100 [mac80211]
[  214.333957]  [<d0867908>] b43legacy_remove+0x78/0x80 [b43legacy]
[  214.333957]  [<d083654d>] ssb_device_remove+0x1d/0x30 [ssb]
[  214.333957]  [<c126f15a>] __device_release_driver+0x5a/0xb0
[  214.333957]  [<c126fb07>] driver_detach+0x87/0x90
[  214.333957]  [<c126ef4c>] bus_remove_driver+0x6c/0xe0
[  214.333957]  [<c1270120>] driver_unregister+0x40/0x70
[  214.333957]  [<d083686b>] ssb_driver_unregister+0xb/0x10 [ssb]
[  214.333957]  [<d087c488>] b43legacy_exit+0xd/0xf [b43legacy]
[  214.333957]  [<c1089dde>] sys_delete_module+0x14e/0x2b0
[  214.333957]  [<c110a4a7>] ? vfs_write+0xf7/0x150
[  214.333957]  [<c1240050>] ? tty_write_lock+0x50/0x50
[  214.333957]  [<c110a6f8>] ? sys_write+0x38/0x70
[  214.333957]  [<c1397c55>] syscall_call+0x7/0xb
[  214.333957] Code: bc 27 00 00 00 00 a1 74 61 56 c1 55 89 e5 e8 a3 fc ff ff 5d c3 90 55 89 e5 57 56 89 c6 53 b8 40 ac 62 c1 83 ec 14 e8 bb b7 34 00 <8b> 46 4c 8d 50 01 85 c0 89 56 4c 75 03 83 0e 40 80 05 40 ac 62
[  214.333957] EIP: [<c104c395>] drain_workqueue+0x15/0x170 SS:ESP 0068:cd767e5c
[  214.333957] CR2: 000000000000004c
[  214.341110] ---[ end trace c7e90ec026d875a6 ]---Index: wireless-testing/drivers/net/wireless/b43legacy/main.c

The problem is fixed by making certain that the ucode pointer is not NULL
before deregistering the driver in mac80211.

Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
Cc: Stable <stable@vger.kernel.org>   [v 3.3.0+]
Signed-off-by: John W. Linville <linville@tuxdriver.com>
2012-09-28 13:54:07 -04:00
..
ath ath9k: Enable MCI for AR9565 2012-09-28 13:54:07 -04:00
b43 Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless 2012-09-07 15:07:55 -04:00
b43legacy b43legacy: Fix crash on unload when firmware not available 2012-09-28 13:54:07 -04:00
brcm80211 brcmfmac: use kcalloc() to prevent integer overflow 2012-09-28 13:54:06 -04:00
hostap wireless: use is_broadcast_ether_addr() instead of memcmp() 2012-09-07 15:03:39 -04:00
ipw2x00 ipw2x00: silence GCC warning for unused variable 'dev' 2012-09-24 15:02:08 -04:00
iwlegacy iwlegacy: use eth_broadcast_addr 2012-09-24 15:02:08 -04:00
iwlwifi Merge branch 'for-john' of git://git.kernel.org/pub/scm/linux/kernel/git/iwlwifi/iwlwifi-next 2012-09-25 15:55:02 -04:00
libertas libertas: set mac control synchronously during init 2012-09-11 15:32:02 -04:00
libertas_tf mac80211: move TX station pointer and restructure TX 2012-07-31 16:18:39 +02:00
mwifiex mwifiex: add inactivity deauth support for ap 2012-09-28 13:54:06 -04:00
orinoco orinoco: use is_zero_ether_addr() instead of memcmp() 2012-09-07 15:03:37 -04:00
p54 p54: connect to 11w protected networks 2012-09-24 15:02:08 -04:00
prism54
rt2x00 rt2x00: Replace open coded interface checking with interface combinations. 2012-09-25 15:57:44 -04:00
rtl818x mac80211: move TX station pointer and restructure TX 2012-07-31 16:18:39 +02:00
rtlwifi rtlwifi: Remove EXPERIMENTAL as pre-requisite for the drivers 2012-09-12 14:19:16 -04:00
ti wlcore: protect wlcore_op_set_key with mutex 2012-09-27 12:13:54 +03:00
zd1211rw zd1211rw: enable support for MFP 2012-09-11 15:13:50 -04:00
adm8211.c mac80211: move TX station pointer and restructure TX 2012-07-31 16:18:39 +02:00
adm8211.h
airo_cs.c
airo.c airo: remove duplicated include from airo.c 2012-09-07 15:03:40 -04:00
airo.h
at76c50x-usb.c wireless: at76c50x: eliminate hex2str() 2012-09-11 15:13:53 -04:00
at76c50x-usb.h
atmel_cs.c
atmel_pci.c
atmel.c
atmel.h
Kconfig iwmc3200wifi: remove driver for unavailable hardware 2012-07-10 12:16:32 -04:00
mac80211_hwsim.c mac80211_hwsim: move module_init/exit 2012-09-06 17:09:30 +02:00
mac80211_hwsim.h
Makefile iwmc3200wifi: remove driver for unavailable hardware 2012-07-10 12:16:32 -04:00
mwl8k.c mac80211: move TX station pointer and restructure TX 2012-07-31 16:18:39 +02:00
ray_cs.c
ray_cs.h
rayctl.h
rndis_wlan.c rndis_wlan: remove pointless check from rndis_scan() 2012-09-11 15:31:44 -04:00
wl3501_cs.c wl3501_cs: use is_broadcast_ether_addr() instead of memcmp() 2012-09-07 15:03:40 -04:00
wl3501.h
zd1201.c
zd1201.h