[email protected] writes:
> From: Marcin Ślusarz <[email protected]>
>
> Right now it's possible to hit NULL pointer dereference in
> rtw_rx_fill_rx_status on hw object and/or its fields because
> initialization routine can start getting USB replies before
> rtw_dev is fully setup.
>
> The stack trace looks like this:
>
> rtw_rx_fill_rx_status
> rtw8821c_query_rx_desc
> rtw_usb_rx_handler
> ...
> queue_work
> rtw_usb_read_port_complete
> ...
> usb_submit_urb
> rtw_usb_rx_resubmit
> rtw_usb_init_rx
> rtw_usb_probe
>
> So while we do the async stuff rtw_usb_probe continues and calls
> rtw_register_hw, which does all kinds of initialization (e.g.
> via ieee80211_register_hw) that rtw_rx_fill_rx_status relies on.
>
> Fix this by moving the first usb_submit_urb after everything
> is set up.
>
> For me, this bug manifested as:
> [ 8.893177] rtw_8821cu 1-1:1.2: band wrong, packet dropped
> [ 8.910904] rtw_8821cu 1-1:1.2: hw->conf.chandef.chan NULL in rtw_rx_fill_rx_status
> because I'm using Larry's backport of rtw88 driver with the NULL
> checks in rtw_rx_fill_rx_status.
>
> This should fix:
> https://marc.info/?l=linux-wireless&m=167907688311943&w=2
Please use permalinks from lore.kernel.org, marc links don't contain the
Message-Id and are hence unreliable.
--
https://patchwork.kernel.org/project/linux-wireless/list/
https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches