Return-path: Received: from mail-bn3nam01on0096.outbound.protection.outlook.com ([104.47.33.96]:56064 "EHLO NAM01-BN3-obe.outbound.protection.outlook.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1732639AbeHGPx1 (ORCPT ); Tue, 7 Aug 2018 11:53:27 -0400 From: Chi-Hsien Lin To: linux-wireless@vger.kernel.org Cc: brcm80211-dev-list.pdl@broadcom.com, brcm80211-dev-list@cypress.com, Arend van Spriel , Franky Lin , Hante Meuleman , Wright Feng , Kalle Valo , Winnie Chang , Chi-Hsien Lin Subject: [PATCH v2] brcmfmac: fix brcmf_wiphy_wowl_params() NULL pointer dereference Date: Tue, 7 Aug 2018 08:38:27 -0500 Message-Id: <1533649107-157808-1-git-send-email-chi-hsien.lin@cypress.com> (sfid-20180807_153922_456508_D0676EF3) MIME-Version: 1.0 Content-Type: text/plain Sender: linux-wireless-owner@vger.kernel.org List-ID: From: Winnie Chang The kernel BUG happens when wowl is enabled from firmware. In brcmf_wiphy_wowl_params(), cfg is a NULL pointer because it is drvr->config returned from wiphy_to_cfg(), and drvr->config is not set yet. To fix it, set drvr->config before brcmf_setup_wiphy() which calls brcmf_wiphy_wowl_params(). The kernel panic is introduced in below commit: commit id: 856d5a011c86b59f6564be4508912fb1d866adfc brcmfmac: allocate struct brcmf_pub instance using wiphy_new() Signed-off-by: Winnie Chang Signed-off-by: Chi-Hsien Lin --- drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c index 24c4e18..5444e62 100644 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c @@ -6926,15 +6926,15 @@ struct brcmf_cfg80211_info *brcmf_cfg80211_attach(struct brcmf_pub *drvr, cfg->d11inf.io_type = (u8)io_type; brcmu_d11_attach(&cfg->d11inf); - err = brcmf_setup_wiphy(wiphy, ifp); - if (err < 0) - goto priv_out; - /* regulatory notifer below needs access to cfg so * assign it now. */ drvr->config = cfg; + err = brcmf_setup_wiphy(wiphy, ifp); + if (err < 0) + goto priv_out; + brcmf_dbg(INFO, "Registering custom regulatory\n"); wiphy->reg_notifier = brcmf_cfg80211_reg_notifier; wiphy->regulatory_flags |= REGULATORY_CUSTOM_REG; -- 2.1.0