From: Ben Hutchings <ben@decadent.org.uk>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: akpm@linux-foundation.org,
"John W. Linville" <linville@tuxdriver.com>,
"Larry Finger" <Larry.Finger@lwfinger.net>
Subject: [27/83] b43legacy: Fix crash on unload when firmware not available
Date: Sun, 16 Jun 2013 23:01:37 +0100 [thread overview]
Message-ID: <lsq.1371420097.98236981@decadent.org.uk> (raw)
In-Reply-To: <lsq.1371420097.958132574@decadent.org.uk>
3.2.47-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Larry Finger <Larry.Finger@lwfinger.net>
commit 2d838bb608e2d1f6cb4280e76748cb812dc822e7 upstream.
When b43legacy is loaded without the firmware being available, a following
unload generates a kernel NULL pointer dereference BUG as follows:
[ 214.330789] BUG: unable to handle kernel NULL pointer dereference at 0000004c
[ 214.330997] IP: [<c104c395>] drain_workqueue+0x15/0x170
[ 214.331179] *pde = 00000000
[ 214.331311] Oops: 0000 [#1] SMP
[ 214.331471] Modules linked in: b43legacy(-) ssb pcmcia mac80211 cfg80211 af_packet mperf arc4 ppdev sr_mod cdrom sg shpchp yenta_socket pcmcia_rsrc pci_hotplug pcmcia_core battery parport_pc parport floppy container ac button edd autofs4 ohci_hcd ehci_hcd usbcore usb_common thermal processor scsi_dh_rdac scsi_dh_hp_sw scsi_dh_emc scsi_dh_alua scsi_dh fan thermal_sys hwmon ata_generic pata_ali libata [last unloaded: cfg80211]
[ 214.333421] Pid: 3639, comm: modprobe Not tainted 3.6.0-rc6-wl+ #163 Source Technology VIC 9921/ALI Based Notebook
[ 214.333580] EIP: 0060:[<c104c395>] EFLAGS: 00010246 CPU: 0
[ 214.333687] EIP is at drain_workqueue+0x15/0x170
[ 214.333788] EAX: c162ac40 EBX: cdfb8360 ECX: 0000002a EDX: 00002a2a
[ 214.333890] ESI: 00000000 EDI: 00000000 EBP: cd767e7c ESP: cd767e5c
[ 214.333957] DS: 007b ES: 007b FS: 00d8 GS: 0033 SS: 0068
[ 214.333957] CR0: 8005003b CR2: 0000004c CR3: 0c96a000 CR4: 00000090
[ 214.333957] DR0: 00000000 DR1: 00000000 DR2: 00000000 DR3: 00000000
[ 214.333957] DR6: ffff0ff0 DR7: 00000400
[ 214.333957] Process modprobe (pid: 3639, ti=cd766000 task=cf802e90 task.ti=cd766000)
[ 214.333957] Stack:
[ 214.333957] 00000292 cd767e74 c12c5e09 00000296 00000296 cdfb8360 cdfb9220 00000000
[ 214.333957] cd767e90 c104c4fd cdfb8360 cdfb9220 cd682800 cd767ea4 d0c10184 cd682800
[ 214.333957] cd767ea4 cba31064 cd767eb8 d0867908 cba31064 d087e09c cd96f034 cd767ec4
[ 214.333957] Call Trace:
[ 214.333957] [<c12c5e09>] ? skb_dequeue+0x49/0x60
[ 214.333957] [<c104c4fd>] destroy_workqueue+0xd/0x150
[ 214.333957] [<d0c10184>] ieee80211_unregister_hw+0xc4/0x100 [mac80211]
[ 214.333957] [<d0867908>] b43legacy_remove+0x78/0x80 [b43legacy]
[ 214.333957] [<d083654d>] ssb_device_remove+0x1d/0x30 [ssb]
[ 214.333957] [<c126f15a>] __device_release_driver+0x5a/0xb0
[ 214.333957] [<c126fb07>] driver_detach+0x87/0x90
[ 214.333957] [<c126ef4c>] bus_remove_driver+0x6c/0xe0
[ 214.333957] [<c1270120>] driver_unregister+0x40/0x70
[ 214.333957] [<d083686b>] ssb_driver_unregister+0xb/0x10 [ssb]
[ 214.333957] [<d087c488>] b43legacy_exit+0xd/0xf [b43legacy]
[ 214.333957] [<c1089dde>] sys_delete_module+0x14e/0x2b0
[ 214.333957] [<c110a4a7>] ? vfs_write+0xf7/0x150
[ 214.333957] [<c1240050>] ? tty_write_lock+0x50/0x50
[ 214.333957] [<c110a6f8>] ? sys_write+0x38/0x70
[ 214.333957] [<c1397c55>] syscall_call+0x7/0xb
[ 214.333957] Code: bc 27 00 00 00 00 a1 74 61 56 c1 55 89 e5 e8 a3 fc ff ff 5d c3 90 55 89 e5 57 56 89 c6 53 b8 40 ac 62 c1 83 ec 14 e8 bb b7 34 00 <8b> 46 4c 8d 50 01 85 c0 89 56 4c 75 03 83 0e 40 80 05 40 ac 62
[ 214.333957] EIP: [<c104c395>] drain_workqueue+0x15/0x170 SS:ESP 0068:cd767e5c
[ 214.333957] CR2: 000000000000004c
[ 214.341110] ---[ end trace c7e90ec026d875a6 ]---Index: wireless-testing/drivers/net/wireless/b43legacy/main.c
The problem is fixed by making certain that the ucode pointer is not NULL
before deregistering the driver in mac80211.
Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/net/wireless/b43legacy/main.c | 2 ++
1 file changed, 2 insertions(+)
--- a/drivers/net/wireless/b43legacy/main.c
+++ b/drivers/net/wireless/b43legacy/main.c
@@ -3837,6 +3837,8 @@ static void b43legacy_remove(struct ssb_
cancel_work_sync(&wldev->restart_work);
B43legacy_WARN_ON(!wl);
+ if (!wldev->fw.ucode)
+ return; /* NULL if fw never loaded */
if (wl->current_dev == wldev)
ieee80211_unregister_hw(wl->hw);
next prev parent reply other threads:[~2013-06-16 22:20 UTC|newest]
Thread overview: 88+ messages / expand[flat|nested] mbox.gz Atom feed top
2013-06-16 22:01 [00/83] 3.2.47-rc1 review Ben Hutchings
2013-06-16 22:01 ` [12/83] tg3: Add read dma workaround for 5720 Ben Hutchings
2013-06-16 22:01 ` [25/83] jfs: fix a couple races Ben Hutchings
2013-06-16 22:01 ` [14/83] ALSA: usb-audio: avoid integer overflow in create_fixed_stream_quirk() Ben Hutchings
2013-06-16 22:01 ` [06/83] mac80211: close AP_VLAN interfaces before unregistering all Ben Hutchings
2013-06-16 22:01 ` [02/83] ata_piix: add PCI IDs for Intel BayTail Ben Hutchings
2013-06-16 22:01 ` [21/83] xen-netback: avoid allocating variable size array on stack Ben Hutchings
2013-06-16 22:01 ` [28/83] ext4: lock i_mutex when truncating orphan inodes Ben Hutchings
2013-06-17 10:18 ` Luis Henriques
2013-06-16 22:01 ` [22/83] xen-netback: better names for thresholds Ben Hutchings
2013-06-16 22:01 ` [01/83] rapidio/tsi721: Fix interrupt mask when handling MSI Ben Hutchings
2013-06-16 22:01 ` [13/83] ALSA: usb-audio: fix possible hang and overflow in parse_uac2_sample_rate_range() Ben Hutchings
2013-06-16 22:01 ` [07/83] iwlwifi: dvm: fix zero LQ CMD sending avoidance Ben Hutchings
2013-06-16 22:01 ` [04/83] cfg80211: check wdev->netdev in connection work Ben Hutchings
2013-06-16 22:01 ` [10/83] iscsi-target: fix heap buffer overflow on error Ben Hutchings
2013-06-16 22:01 ` [08/83] drm/radeon: fix card_posted check for newer asics Ben Hutchings
2013-06-16 22:01 ` [17/83] xen-netback: fix sparse warning Ben Hutchings
2013-06-16 22:01 ` [09/83] xfs: kill suid/sgid through the truncate path Ben Hutchings
2013-06-16 22:01 ` [19/83] xen-netback: don't disconnect frontend when seeing oversize packet Ben Hutchings
2013-06-16 22:01 ` [05/83] cifs: fix potential buffer overrun when composing a new options string Ben Hutchings
2013-06-16 22:01 ` [03/83] libata: make ata_exec_internal_sg honor DMADIR Ben Hutchings
2013-06-16 22:01 ` [15/83] xen-netback: remove skb in xen_netbk_alloc_page Ben Hutchings
2013-06-16 22:01 ` [20/83] xen-netback: remove redundent parameter in netbk_count_requests Ben Hutchings
2013-06-16 22:01 ` [23/83] net: Add net_ratelimited_function and net_<level>_ratelimited macros Ben Hutchings
2013-06-16 22:01 ` [18/83] xen-netback: coalesce slots in TX path and fix regressions Ben Hutchings
2013-06-16 22:01 ` [11/83] tg3: Add New 5719 Read DMA workaround Ben Hutchings
2013-06-16 22:01 ` [24/83] xen-netfront: reduce gso_max_size to account for max TCP header Ben Hutchings
2013-06-16 22:01 ` [29/83] thinkpad-acpi: recognize latest V-Series using DMI_BIOS_VENDOR Ben Hutchings
2013-06-16 22:01 ` [30/83] ftrace: Move ftrace_filter_lseek out of CONFIG_DYNAMIC_FTRACE section Ben Hutchings
2013-06-16 22:01 ` Ben Hutchings [this message]
2013-06-16 22:01 ` [16/83] netback: remove redundant assignment Ben Hutchings
2013-06-16 22:01 ` [26/83] xen/events: Handle VIRQ_TIMER before any other hardirq in event loop Ben Hutchings
2013-06-16 22:01 ` [53/83] USB: serial: Add Option GTM681W to qcserial device table Ben Hutchings
2013-06-16 22:01 ` [36/83] xhci - correct comp_mode_recovery_timer on return from hibernate Ben Hutchings
2013-06-16 22:01 ` [45/83] ACPI video: ignore BIOS backlight value for HP dm4 Ben Hutchings
2013-06-16 22:01 ` [44/83] USB: mos7720: fix message timeouts Ben Hutchings
2013-06-16 22:01 ` [40/83] USB: visor: fix initialisation of Treo/Kyocera devices Ben Hutchings
2013-06-16 22:01 ` [65/83] drm/gma500/cdv: Unpin framebuffer on crtc disable Ben Hutchings
2013-06-16 22:01 ` [64/83] drm/gma500/psb: " Ben Hutchings
2013-06-16 22:01 ` [34/83] xhci-mem: init list heads at the beginning of init Ben Hutchings
2013-06-16 22:01 ` [46/83] ACPI video: ignore BIOS initial backlight value for HP 1000 Ben Hutchings
2013-06-16 22:01 ` [62/83] USB: option: blacklist network interface on Huawei E1820 Ben Hutchings
2013-06-16 22:01 ` [49/83] drm: fix a use-after-free when GPU acceleration disabled Ben Hutchings
2013-06-16 22:01 ` [52/83] USB: Serial: cypress_M8: Enable FRWD Dongle hidcom device Ben Hutchings
2013-06-16 22:01 ` [78/83] USB: spcp8x5: fix device initialisation at open Ben Hutchings
2013-06-16 22:01 ` [74/83] cciss: fix broken mutex usage in ioctl Ben Hutchings
2013-06-16 22:01 ` [80/83] x86: Fix typo in kexec register clearing Ben Hutchings
2013-06-16 22:01 ` [37/83] usb: dwc3: gadget: free trb pool only from epnum 2 Ben Hutchings
2013-06-16 22:01 ` [48/83] ACPI / video: ignore BIOS initial backlight value for HP Pavilion g6 Ben Hutchings
2013-06-16 22:01 ` [63/83] hwmon: (adm1021) Strengthen chip detection for ADM1021, LM84 and MAX1617 Ben Hutchings
2013-06-16 22:01 ` [50/83] drm/i915: no lvds quirk for hp t5740 Ben Hutchings
2013-06-16 22:01 ` [71/83] CPU hotplug: provide a generic helper to disable/enable CPU hotplug Ben Hutchings
2013-06-16 22:01 ` [51/83] radeon: Fix system hang issue when using KMS with older cards Ben Hutchings
2013-06-16 22:01 ` [43/83] USB: iuu_phoenix: fix bulk-message timeout Ben Hutchings
2013-06-16 22:01 ` [32/83] USB: ftdi_sio: Quiet sparse noise about using plain integer was NULL pointer Ben Hutchings
2013-06-16 22:01 ` [60/83] ARM: 7743/1: compressed/head.S: work around new binutils warning Ben Hutchings
2013-06-16 22:01 ` [66/83] drm/i915: prefer VBT modes for SVDO-LVDS over EDID Ben Hutchings
2013-06-16 22:01 ` [31/83] USB: serial: ftdi_sio: Handle the old_termios == 0 case e.g. uart_resume_port() Ben Hutchings
2013-06-16 22:01 ` [35/83] xhci: fix list access before init Ben Hutchings
2013-06-16 22:01 ` [58/83] ALSA: usb-audio - Fix invalid volume resolution on Logitech HD webcam c270 Ben Hutchings
2013-06-16 22:01 ` [68/83] ath9k: Disable PowerSave by default Ben Hutchings
2013-06-17 9:55 ` Luis Henriques
2013-06-17 11:55 ` Ben Hutchings
2013-06-16 22:01 ` [73/83] audit: wait_for_auditd() should use TASK_UNINTERRUPTIBLE Ben Hutchings
2013-06-16 22:01 ` [55/83] drm/i915/sdvo: Use &intel_sdvo->ddc instead of intel_sdvo->i2c for DDC Ben Hutchings
2013-06-16 22:01 ` [56/83] USB: keyspan: fix bogus array index Ben Hutchings
2013-06-16 22:01 ` [77/83] mm: migration: add migrate_entry_wait_huge() Ben Hutchings
2013-06-16 22:01 ` [41/83] USB: mos7720: fix DMA to stack Ben Hutchings
2013-06-16 22:01 ` [76/83] swap: avoid read_swap_cache_async() race to deadlock while waiting on discard I/O completion Ben Hutchings
2013-06-16 22:01 ` [72/83] reboot: rigrate shutdown/reboot to boot cpu Ben Hutchings
2013-06-16 22:01 ` [67/83] Bluetooth: Fix missing length checks for L2CAP signalling PDUs Ben Hutchings
2013-06-16 22:01 ` [70/83] b43: stop format string leaking into error msgs Ben Hutchings
2013-06-16 22:01 ` [54/83] ALSA: usb-audio - Apply Logitech QuickCam Pro 9000 quirk only to audio iface Ben Hutchings
2013-06-16 22:01 ` [83/83] powerpc: Fix emulation of illegal instructions on PowerNV platform Ben Hutchings
2013-06-16 22:01 ` [69/83] ath9k: Use minstrel rate control by default Ben Hutchings
2013-06-16 22:01 ` [79/83] USB: pl2303: fix device initialisation at open Ben Hutchings
2013-06-16 22:01 ` [75/83] drivers/rtc/rtc-twl.c: fix missing device_init_wakeup() when booted with device tree Ben Hutchings
2013-06-16 22:01 ` [81/83] md/raid1: consider WRITE as successful only if at least one non-Faulty and non-rebuilding drive completed it Ben Hutchings
2013-06-16 22:01 ` [38/83] USB: revert periodic scheduling bugfix Ben Hutchings
2013-06-16 22:01 ` [61/83] USB: whiteheat: fix broken port configuration Ben Hutchings
2013-06-16 22:01 ` [42/83] USB: ark3116: fix control-message timeout Ben Hutchings
2013-06-16 22:01 ` [59/83] ARM: 7742/1: topology: export cpu_topology Ben Hutchings
2013-06-16 22:01 ` [39/83] USB: serial: fix Treo/Kyocera interrrupt-in urb context Ben Hutchings
2013-06-16 22:01 ` [47/83] ACPI / video: ignore BIOS initial backlight value for HP m4 Ben Hutchings
2013-06-16 22:01 ` [57/83] USB: mos7720: fix hardware flow control Ben Hutchings
2013-06-16 22:01 ` [33/83] drm/gma500: Increase max resolution for mode setting Ben Hutchings
2013-06-16 22:01 ` [82/83] tg3: Wait for boot code to finish after power on Ben Hutchings
2013-06-16 22:42 ` [00/83] 3.2.47-rc1 review Ben Hutchings
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=lsq.1371420097.98236981@decadent.org.uk \
--to=ben@decadent.org.uk \
--cc=Larry.Finger@lwfinger.net \
--cc=akpm@linux-foundation.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linville@tuxdriver.com \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®