2017-01-17 23:24:19

by Jens Axboe

[permalink] [raw]
Subject: iwlwifi: fix kernel crash when unregistering thermal zone

A recent firmware change seems to have enabled thermal zones on the
iwlwifi driver. Unfortunately, my device fails when registering the
thermal zone. This doesn't stop the driver from attempting to unregister
the thermal zone at unload time, triggering a NULL pointer deference in
strlen() off the thermal_zone_device_unregister() path.

Don't unregister if name is NULL, for that case we failed registering.
Do the same for the cooling zone.

Signed-off-by: Jens Axboe <[email protected]>

---

Would be great if this could go into the current series, as sometimes I
have to reload the driver. Right now I can't, since it crashes...

diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/tt.c b/drivers/net/wireless/intel/iwlwifi/mvm/tt.c
index 63a051be832e..bec7d9c46087 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/tt.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/tt.c
@@ -843,8 +843,10 @@ static void iwl_mvm_thermal_zone_unregister(struct iwl_mvm *mvm)
return;

IWL_DEBUG_TEMP(mvm, "Thermal zone device unregister\n");
- thermal_zone_device_unregister(mvm->tz_device.tzone);
- mvm->tz_device.tzone = NULL;
+ if (mvm->tz_device.tzone) {
+ thermal_zone_device_unregister(mvm->tz_device.tzone);
+ mvm->tz_device.tzone = NULL;
+ }
}

static void iwl_mvm_cooling_device_unregister(struct iwl_mvm *mvm)
@@ -853,8 +855,10 @@ static void iwl_mvm_cooling_device_unregister(struct iwl_mvm *mvm)
return;

IWL_DEBUG_TEMP(mvm, "Cooling device unregister\n");
- thermal_cooling_device_unregister(mvm->cooling_dev.cdev);
- mvm->cooling_dev.cdev = NULL;
+ if (mvm->cooling_dev.cdev) {
+ thermal_cooling_device_unregister(mvm->cooling_dev.cdev);
+ mvm->cooling_dev.cdev = NULL;
+ }
}
#endif /* CONFIG_THERMAL */


2017-01-21 12:59:17

by Kalle Valo

[permalink] [raw]
Subject: Re: iwlwifi: fix kernel crash when unregistering thermal zone

Jens Axboe <[email protected]> wrote:
> A recent firmware change seems to have enabled thermal zones on the
> iwlwifi driver. Unfortunately, my device fails when registering the
> thermal zone. This doesn't stop the driver from attempting to unregister
> the thermal zone at unload time, triggering a NULL pointer deference in
> strlen() off the thermal_zone_device_unregister() path.
>
> Don't unregister if name is NULL, for that case we failed registering.
> Do the same for the cooling zone.
>
> Signed-off-by: Jens Axboe <[email protected]>

Patch applied to wireless-drivers.git, thanks.

92549cdc288f iwlwifi: fix kernel crash when unregistering thermal zone

--
https://patchwork.kernel.org/patch/9522187/

Documentation about submitting wireless patches and checking status
from patchwork:

https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches

2017-01-27 20:04:17

by Jens Axboe

[permalink] [raw]
Subject: Re: iwlwifi: fix kernel crash when unregistering thermal zone

On 01/27/2017 12:54 PM, Kalle Valo wrote:
> Jens Axboe <[email protected]> writes:
>
>> On 01/21/2017 05:59 AM, Kalle Valo wrote:
>>> Jens Axboe <[email protected]> wrote:
>>>> A recent firmware change seems to have enabled thermal zones on the
>>>> iwlwifi driver. Unfortunately, my device fails when registering the
>>>> thermal zone. This doesn't stop the driver from attempting to unregister
>>>> the thermal zone at unload time, triggering a NULL pointer deference in
>>>> strlen() off the thermal_zone_device_unregister() path.
>>>>
>>>> Don't unregister if name is NULL, for that case we failed registering.
>>>> Do the same for the cooling zone.
>>>>
>>>> Signed-off-by: Jens Axboe <[email protected]>
>>>
>>> Patch applied to wireless-drivers.git, thanks.
>>>
>>> 92549cdc288f iwlwifi: fix kernel crash when unregistering thermal zone
>>
>> When is this going out?
>
> Trying to send a pull request to Dave tomorrow.

Great, thanks!

--
Jens Axboe

2017-01-21 07:56:40

by Kalle Valo

[permalink] [raw]
Subject: Re: iwlwifi: fix kernel crash when unregistering thermal zone

Jens Axboe <[email protected]> writes:

> A recent firmware change seems to have enabled thermal zones on the
> iwlwifi driver. Unfortunately, my device fails when registering the
> thermal zone. This doesn't stop the driver from attempting to unregister
> the thermal zone at unload time, triggering a NULL pointer deference in
> strlen() off the thermal_zone_device_unregister() path.
>
> Don't unregister if name is NULL, for that case we failed registering.
> Do the same for the cooling zone.
>
> Signed-off-by: Jens Axboe <[email protected]>
>
> ---
>
> Would be great if this could go into the current series, as sometimes I
> have to reload the driver. Right now I can't, since it crashes...

Luca, can I take this directly to wireless-drivers? This is an important
fix and we should get it to Linus' tree ASAP.

--
Kalle Valo

2017-01-27 20:40:34

by Kalle Valo

[permalink] [raw]
Subject: Re: iwlwifi: fix kernel crash when unregistering thermal zone

Jens Axboe <[email protected]> writes:

> On 01/21/2017 05:59 AM, Kalle Valo wrote:
>> Jens Axboe <[email protected]> wrote:
>>> A recent firmware change seems to have enabled thermal zones on the
>>> iwlwifi driver. Unfortunately, my device fails when registering the
>>> thermal zone. This doesn't stop the driver from attempting to unregister
>>> the thermal zone at unload time, triggering a NULL pointer deference in
>>> strlen() off the thermal_zone_device_unregister() path.
>>>
>>> Don't unregister if name is NULL, for that case we failed registering.
>>> Do the same for the cooling zone.
>>>
>>> Signed-off-by: Jens Axboe <[email protected]>
>>
>> Patch applied to wireless-drivers.git, thanks.
>>
>> 92549cdc288f iwlwifi: fix kernel crash when unregistering thermal zone
>
> When is this going out?

Trying to send a pull request to Dave tomorrow.

--
Kalle Valo

2017-01-27 19:48:14

by Jens Axboe

[permalink] [raw]
Subject: Re: iwlwifi: fix kernel crash when unregistering thermal zone

On 01/21/2017 05:59 AM, Kalle Valo wrote:
> Jens Axboe <[email protected]> wrote:
>> A recent firmware change seems to have enabled thermal zones on the
>> iwlwifi driver. Unfortunately, my device fails when registering the
>> thermal zone. This doesn't stop the driver from attempting to unregister
>> the thermal zone at unload time, triggering a NULL pointer deference in
>> strlen() off the thermal_zone_device_unregister() path.
>>
>> Don't unregister if name is NULL, for that case we failed registering.
>> Do the same for the cooling zone.
>>
>> Signed-off-by: Jens Axboe <[email protected]>
>
> Patch applied to wireless-drivers.git, thanks.
>
> 92549cdc288f iwlwifi: fix kernel crash when unregistering thermal zone

When is this going out?

--
Jens Axboe