| From 346ece0b7ba2730b4d633b9e371fe55488803102 Mon Sep 17 00:00:00 2001 |
| From: Bing Zhao <bzhao@marvell.com> |
| Date: Tue, 24 Sep 2013 19:31:25 -0700 |
| Subject: mwifiex: fix NULL pointer dereference in usb suspend handler |
| |
| From: Bing Zhao <bzhao@marvell.com> |
| |
| commit 346ece0b7ba2730b4d633b9e371fe55488803102 upstream. |
| |
| Bug 60815 - Interface hangs in mwifiex_usb |
| https://bugzilla.kernel.org/show_bug.cgi?id=60815 |
| |
| [ 2.883807] BUG: unable to handle kernel NULL pointer dereference |
| at 0000000000000048 |
| [ 2.883813] IP: [<ffffffff815a65e0>] pfifo_fast_enqueue+0x90/0x90 |
| |
| [ 2.883834] CPU: 1 PID: 3220 Comm: kworker/u8:90 Not tainted |
| 3.11.1-monotone-l0 #6 |
| [ 2.883834] Hardware name: Microsoft Corporation Surface with |
| Windows 8 Pro/Surface with Windows 8 Pro, |
| BIOS 1.03.0450 03/29/2013 |
| |
| On Surface Pro, suspend to ram gives a NULL pointer dereference in |
| pfifo_fast_enqueue(). The stack trace reveals that the offending |
| call is clearing carrier in mwifiex_usb suspend handler. |
| |
| Since commit 1499d9f "mwifiex: don't drop carrier flag over suspend" |
| has removed the carrier flag handling over suspend/resume in SDIO |
| and PCIe drivers, I'm removing it in USB driver too. This also fixes |
| the bug for Surface Pro. |
| |
| Tested-by: Dmitry Khromov <icechrome@gmail.com> |
| Signed-off-by: Bing Zhao <bzhao@marvell.com> |
| Signed-off-by: John W. Linville <linville@tuxdriver.com> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| |
| --- |
| drivers/net/wireless/mwifiex/usb.c | 7 ------- |
| 1 file changed, 7 deletions(-) |
| |
| --- a/drivers/net/wireless/mwifiex/usb.c |
| +++ b/drivers/net/wireless/mwifiex/usb.c |
| @@ -446,9 +446,6 @@ static int mwifiex_usb_suspend(struct us |
| */ |
| adapter->is_suspended = true; |
| |
| - for (i = 0; i < adapter->priv_num; i++) |
| - netif_carrier_off(adapter->priv[i]->netdev); |
| - |
| if (atomic_read(&card->rx_cmd_urb_pending) && card->rx_cmd.urb) |
| usb_kill_urb(card->rx_cmd.urb); |
| |
| @@ -508,10 +505,6 @@ static int mwifiex_usb_resume(struct usb |
| MWIFIEX_RX_CMD_BUF_SIZE); |
| } |
| |
| - for (i = 0; i < adapter->priv_num; i++) |
| - if (adapter->priv[i]->media_connected) |
| - netif_carrier_on(adapter->priv[i]->netdev); |
| - |
| /* Disable Host Sleep */ |
| if (adapter->hs_activated) |
| mwifiex_cancel_hs(mwifiex_get_priv(adapter, |
