2014-11-05 22:31:19

by Hauke Mehrtens

Subject: [PATCH 3.18+] b43: fix NULL pointer dereference in b43_phy_copy()

phy_read and phy_write are not set for every phy any more sine this:
commit d342b95dd735014a590f9051b1ba227eb54ca8f6
Author: Rafał Miłecki <[email protected]>
Date: Thu Jul 31 21:59:43 2014 +0200

b43: don't duplicate common PHY read/write ops

b43_phy_copy() accesses phy_read and phy_write directly and will fail
with some phys. This patch fixes the regression by using the
b43_phy_read() and b43_phy_write() functions which should be used for
read and write access.

This should fix this bug report:
https://bugzilla.kernel.org/show_bug.cgi?id=87731

Reported-by: Volker Kempter <[email protected]>
Signed-off-by: Hauke Mehrtens <[email protected]>
---
drivers/net/wireless/b43/phy_common.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)

This should go into wireless-testing and into 3.18 as it fixes a
regression in 3.18.

diff --git a/drivers/net/wireless/b43/phy_common.c b/drivers/net/wireless/b43/phy_common.c
index 1dfc682..3f37401 100644
--- a/drivers/net/wireless/b43/phy_common.c
+++ b/drivers/net/wireless/b43/phy_common.c
@@ -301,8 +301,7 @@ void b43_phy_write(struct b43_wldev *dev, u16 reg, u16 value)
void b43_phy_copy(struct b43_wldev *dev, u16 destreg, u16 srcreg)
{
assert_mac_suspended(dev);
- dev->phy.ops->phy_write(dev, destreg,
- dev->phy.ops->phy_read(dev, srcreg));
+ b43_phy_write(dev, destreg, b43_phy_read(dev, srcreg));
}

void b43_phy_mask(struct b43_wldev *dev, u16 offset, u16 mask)
--
1.9.1

2014-11-05 22:58:07

by Rafał Miłecki

Subject: Re: [PATCH 3.18+] b43: fix NULL pointer dereference in b43_phy_copy()

On 5 November 2014 23:31, Hauke Mehrtens <[email protected]> wrote:
> phy_read and phy_write are not set for every phy any more sine this:
> commit d342b95dd735014a590f9051b1ba227eb54ca8f6
> Author: Rafał Miłecki <[email protected]>
> Date: Thu Jul 31 21:59:43 2014 +0200
>
> b43: don't duplicate common PHY read/write ops
>
> b43_phy_copy() accesses phy_read and phy_write directly and will fail
> with some phys. This patch fixes the regression by using the
> b43_phy_read() and b43_phy_write() functions which should be used for
> read and write access.
>
> This should fix this bug report:
> https://bugzilla.kernel.org/show_bug.cgi?id=87731
>
> Reported-by: Volker Kempter <[email protected]>
> Signed-off-by: Hauke Mehrtens <[email protected]>
> ---
> drivers/net/wireless/b43/phy_common.c | 3 +--
> 1 file changed, 1 insertion(+), 2 deletions(-)
>
> This should go into wireless-testing and into 3.18 as it fixes a
> regression in 3.18.
>
> diff --git a/drivers/net/wireless/b43/phy_common.c b/drivers/net/wireless/b43/phy_common.c
> index 1dfc682..3f37401 100644
> --- a/drivers/net/wireless/b43/phy_common.c
> +++ b/drivers/net/wireless/b43/phy_common.c
> @@ -301,8 +301,7 @@ void b43_phy_write(struct b43_wldev *dev, u16 reg, u16 value)
> void b43_phy_copy(struct b43_wldev *dev, u16 destreg, u16 srcreg)
> {
> assert_mac_suspended(dev);
> - dev->phy.ops->phy_write(dev, destreg,
> - dev->phy.ops->phy_read(dev, srcreg));
> + b43_phy_write(dev, destreg, b43_phy_read(dev, srcreg));
> }

Could you drop the assert_mac_suspended? We do it already in both:
phy_read and phy_write.