2016-11-16 09:23:22

by Miaoqing Pan

Subject: [PATCH] ath9k: fix NULL pointer dereference

From: Miaoqing Pan <[email protected]>

relay_open() may return NULL, check the return value to avoid the crash.

BUG: unable to handle kernel NULL pointer dereference at 0000000000000040
IP: [<ffffffffa01a95c5>] ath_cmn_process_fft+0xd5/0x700 [ath9k_common]
PGD 41cf28067 PUD 41be92067 PMD 0
Oops: 0000 [#1] SMP
CPU: 0 PID: 0 Comm: swapper/0 Not tainted 4.8.6+ #35
Hardware name: Hewlett-Packard h8-1080t/2A86, BIOS 6.15 07/04/2011
task: ffffffff81e0c4c0 task.stack: ffffffff81e00000
RIP: 0010:[<ffffffffa01a95c5>] [<ffffffffa01a95c5>] ath_cmn_process_fft+0xd5/0x700 [ath9k_common]
RSP: 0018:ffff88041f203ca0 EFLAGS: 00010293
RAX: 0000000000000000 RBX: 000000000000059f RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000040 RDI: ffffffff81f0ca98
RBP: ffff88041f203dc8 R08: ffffffffffffffff R09: 00000000000000ff
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
R13: ffffffff81f0ca98 R14: 0000000000000000 R15: 0000000000000000
FS: 0000000000000000(0000) GS:ffff88041f200000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000040 CR3: 000000041b6ec000 CR4: 00000000000006f0
Stack:
0000000000000363 00000000000003f3 00000000000003f3 00000000000001f9
000000000000049a 0000000001252c04 ffff88041f203e44 ffff880417b4bfd0
0000000000000008 ffff88041785b9c0 0000000000000002 ffff88041613dc60

Call Trace:
<IRQ>
[<ffffffffa01b6441>] ath9k_tasklet+0x1b1/0x220 [ath9k]
[<ffffffff8105d8dd>] tasklet_action+0x4d/0xf0
[<ffffffff8105dde2>] __do_softirq+0x92/0x2a0

Reported-by: Devin Tuchsen <[email protected]>
Tested-by: Devin Tuchsen <[email protected]>
Signed-off-by: Miaoqing Pan <[email protected]>
---
drivers/net/wireless/ath/ath9k/common-spectral.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/drivers/net/wireless/ath/ath9k/common-spectral.c b/drivers/net/wireless/ath/ath9k/common-spectral.c
index e2512d5..eedf86b 100644
--- a/drivers/net/wireless/ath/ath9k/common-spectral.c
+++ b/drivers/net/wireless/ath/ath9k/common-spectral.c
@@ -528,6 +528,9 @@ int ath_cmn_process_fft(struct ath_spec_scan_priv *spec_priv, struct ieee80211_h
if (!(radar_info->pulse_bw_info & SPECTRAL_SCAN_BITMASK))
return 0;

+ if (!spec_priv->rfs_chan_spec_scan)
+ return 1;
+
/* Output buffers are full, no need to process anything
* since there is no space to put the result anyway
*/
@@ -1072,7 +1075,7 @@ static int remove_buf_file_handler(struct dentry *dentry)

void ath9k_cmn_spectral_deinit_debug(struct ath_spec_scan_priv *spec_priv)
{
- if (IS_ENABLED(CONFIG_ATH9K_DEBUGFS)) {
+ if (IS_ENABLED(CONFIG_ATH9K_DEBUGFS) && spec_priv->rfs_chan_spec_scan) {
relay_close(spec_priv->rfs_chan_spec_scan);
spec_priv->rfs_chan_spec_scan = NULL;
}
@@ -1086,6 +1089,9 @@ void ath9k_cmn_spectral_init_debug(struct ath_spec_scan_priv *spec_priv,
debugfs_phy,
1024, 256, &rfs_spec_scan_cb,
NULL);
+ if (!spec_priv->rfs_chan_spec_scan)
+ return;
+
debugfs_create_file("spectral_scan_ctl",
S_IRUSR | S_IWUSR,
debugfs_phy, spec_priv,
--
1.9.1

2016-11-23 14:00:11

by Kalle Valo

Subject: Re: ath9k: fix NULL pointer dereference

miaoqing pan <[email protected]> wrote:
> From: Miaoqing Pan <[email protected]>
>
> relay_open() may return NULL, check the return value to avoid the crash.
>
> BUG: unable to handle kernel NULL pointer dereference at 0000000000000040
> IP: [<ffffffffa01a95c5>] ath_cmn_process_fft+0xd5/0x700 [ath9k_common]
> PGD 41cf28067 PUD 41be92067 PMD 0
> Oops: 0000 [#1] SMP
> CPU: 0 PID: 0 Comm: swapper/0 Not tainted 4.8.6+ #35
> Hardware name: Hewlett-Packard h8-1080t/2A86, BIOS 6.15 07/04/2011
> task: ffffffff81e0c4c0 task.stack: ffffffff81e00000
> RIP: 0010:[<ffffffffa01a95c5>] [<ffffffffa01a95c5>] ath_cmn_process_fft+0xd5/0x700 [ath9k_common]
> RSP: 0018:ffff88041f203ca0 EFLAGS: 00010293
> RAX: 0000000000000000 RBX: 000000000000059f RCX: 0000000000000000
> RDX: 0000000000000000 RSI: 0000000000000040 RDI: ffffffff81f0ca98
> RBP: ffff88041f203dc8 R08: ffffffffffffffff R09: 00000000000000ff
> R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
> R13: ffffffff81f0ca98 R14: 0000000000000000 R15: 0000000000000000
> FS: 0000000000000000(0000) GS:ffff88041f200000(0000) knlGS:0000000000000000
> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: 0000000000000040 CR3: 000000041b6ec000 CR4: 00000000000006f0
> Stack:
> 0000000000000363 00000000000003f3 00000000000003f3 00000000000001f9
> 000000000000049a 0000000001252c04 ffff88041f203e44 ffff880417b4bfd0
> 0000000000000008 ffff88041785b9c0 0000000000000002 ffff88041613dc60
>
> Call Trace:
> <IRQ>
> [<ffffffffa01b6441>] ath9k_tasklet+0x1b1/0x220 [ath9k]
> [<ffffffff8105d8dd>] tasklet_action+0x4d/0xf0
> [<ffffffff8105dde2>] __do_softirq+0x92/0x2a0
>
> Reported-by: Devin Tuchsen <[email protected]>
> Tested-by: Devin Tuchsen <[email protected]>
> Signed-off-by: Miaoqing Pan <[email protected]>

Patch applied to ath-next branch of ath.git, thanks.

40bea976c72b ath9k: fix NULL pointer dereference

--
https://patchwork.kernel.org/patch/9431163/

Documentation about submitting wireless patches and checking status
from patchwork:

https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches