| From 1f235074bc4ace6e476aa5d6f889eadb95ed0903 Mon Sep 17 00:00:00 2001 |
| From: Miaoqing Pan <miaoqing@codeaurora.org> |
| Date: Wed, 16 Nov 2016 17:23:08 +0800 |
| Subject: [PATCH] ath9k: fix NULL pointer dereference |
| |
| commit 40bea976c72b9ee60f8d097852deb53ccbeaffbe upstream. |
| |
| relay_open() may return NULL, check the return value to avoid the crash. |
| |
| BUG: unable to handle kernel NULL pointer dereference at 0000000000000040 |
| IP: [<ffffffffa01a95c5>] ath_cmn_process_fft+0xd5/0x700 [ath9k_common] |
| PGD 41cf28067 PUD 41be92067 PMD 0 |
| Oops: 0000 [#1] SMP |
| CPU: 0 PID: 0 Comm: swapper/0 Not tainted 4.8.6+ #35 |
| Hardware name: Hewlett-Packard h8-1080t/2A86, BIOS 6.15 07/04/2011 |
| task: ffffffff81e0c4c0 task.stack: ffffffff81e00000 |
| RIP: 0010:[<ffffffffa01a95c5>] [<ffffffffa01a95c5>] ath_cmn_process_fft+0xd5/0x700 [ath9k_common] |
| RSP: 0018:ffff88041f203ca0 EFLAGS: 00010293 |
| RAX: 0000000000000000 RBX: 000000000000059f RCX: 0000000000000000 |
| RDX: 0000000000000000 RSI: 0000000000000040 RDI: ffffffff81f0ca98 |
| RBP: ffff88041f203dc8 R08: ffffffffffffffff R09: 00000000000000ff |
| R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 |
| R13: ffffffff81f0ca98 R14: 0000000000000000 R15: 0000000000000000 |
| FS: 0000000000000000(0000) GS:ffff88041f200000(0000) knlGS:0000000000000000 |
| CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 |
| CR2: 0000000000000040 CR3: 000000041b6ec000 CR4: 00000000000006f0 |
| Stack: |
| 0000000000000363 00000000000003f3 00000000000003f3 00000000000001f9 |
| 000000000000049a 0000000001252c04 ffff88041f203e44 ffff880417b4bfd0 |
| 0000000000000008 ffff88041785b9c0 0000000000000002 ffff88041613dc60 |
| |
| Call Trace: |
| <IRQ> |
| [<ffffffffa01b6441>] ath9k_tasklet+0x1b1/0x220 [ath9k] |
| [<ffffffff8105d8dd>] tasklet_action+0x4d/0xf0 |
| [<ffffffff8105dde2>] __do_softirq+0x92/0x2a0 |
| |
| Reported-by: Devin Tuchsen <devin.tuchsen@gmail.com> |
| Tested-by: Devin Tuchsen <devin.tuchsen@gmail.com> |
| Signed-off-by: Miaoqing Pan <miaoqing@codeaurora.org> |
| Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com> |
| Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> |
| |
| diff --git a/drivers/net/wireless/ath/ath9k/common-spectral.c b/drivers/net/wireless/ath/ath9k/common-spectral.c |
| index e2512d5bc0e1..eedf86b67cf5 100644 |
| --- a/drivers/net/wireless/ath/ath9k/common-spectral.c |
| +++ b/drivers/net/wireless/ath/ath9k/common-spectral.c |
| @@ -528,6 +528,9 @@ int ath_cmn_process_fft(struct ath_spec_scan_priv *spec_priv, struct ieee80211_h |
| if (!(radar_info->pulse_bw_info & SPECTRAL_SCAN_BITMASK)) |
| return 0; |
| |
| + if (!spec_priv->rfs_chan_spec_scan) |
| + return 1; |
| + |
| /* Output buffers are full, no need to process anything |
| * since there is no space to put the result anyway |
| */ |
| @@ -1072,7 +1075,7 @@ static struct rchan_callbacks rfs_spec_scan_cb = { |
| |
| void ath9k_cmn_spectral_deinit_debug(struct ath_spec_scan_priv *spec_priv) |
| { |
| - if (IS_ENABLED(CONFIG_ATH9K_DEBUGFS)) { |
| + if (IS_ENABLED(CONFIG_ATH9K_DEBUGFS) && spec_priv->rfs_chan_spec_scan) { |
| relay_close(spec_priv->rfs_chan_spec_scan); |
| spec_priv->rfs_chan_spec_scan = NULL; |
| } |
| @@ -1086,6 +1089,9 @@ void ath9k_cmn_spectral_init_debug(struct ath_spec_scan_priv *spec_priv, |
| debugfs_phy, |
| 1024, 256, &rfs_spec_scan_cb, |
| NULL); |
| + if (!spec_priv->rfs_chan_spec_scan) |
| + return; |
| + |
| debugfs_create_file("spectral_scan_ctl", |
| S_IRUSR | S_IWUSR, |
| debugfs_phy, spec_priv, |
| -- |
| 2.12.0 |
| |