[5.10,060/152] ath11k: fix crash caused by NULL rx_channel

Message ID	20210118113355.672301537@linuxfoundation.org
State	New
Headers	show Return-Path: <stable-owner@kernel.org> From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>, stable@vger.kernel.org, Carl Huang <cjhuang@codeaurora.org>, Kalle Valo <kvalo@codeaurora.org>, Sasha Levin <sashal@kernel.org> Subject: [PATCH 5.10 060/152] ath11k: fix crash caused by NULL rx_channel Date: Mon, 18 Jan 2021 12:33:55 +0100 Message-Id: <20210118113355.672301537@linuxfoundation.org> In-Reply-To: <20210118113352.764293297@linuxfoundation.org> References: <20210118113352.764293297@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk
Series	None \| expand [5.10,002/152] btrfs: prevent NULL pointer dereference in extent_io_tree_panic [5.10,003/152] ALSA: hda/realtek: fix right sounds and mute/micmute LEDs for HP machines [5.10,004/152] ALSA: doc: Fix reference to mixart.rst [5.10,005/152] ASoC: AMD Renoir - add DMI entry for Lenovo ThinkPad X395 [5.10,006/152] ASoC: dapm: remove widget from dirty list on free [5.10,007/152] x86/hyperv: check cpu mask after interrupt has been disabled [5.10,008/152] drm/amdgpu: add green_sardine device id (v2) [5.10,009/152] drm/amdgpu: fix DRM_INFO flood if display core is not supported (bug 210921) [5.10,010/152] Revert "drm/amd/display: Fixed Intermittent blue screen on OLED panel" [5.10,011/152] drm/amdgpu: add new device id for Renior [5.10,012/152] drm/i915: Allow the sysadmin to override security mitigations [5.10,013/152] drm/i915/gt: Limit VFE threads based on GT [5.10,014/152] drm/i915/backlight: fix CPU mode backlight takeover on LPT [5.10,015/152] drm/bridge: sii902x: Refactor init code into separate function [5.10,016/152] dt-bindings: display: sii902x: Add supply bindings [5.10,017/152] drm/bridge: sii902x: Enable I/O and core VCC supplies if present [5.10,018/152] tracing/kprobes: Do the notrace functions check without kprobes on ftrace [5.10,019/152] tools/bootconfig: Add tracing_on support to helper scripts [5.10,020/152] ext4: use IS_ERR instead of IS_ERR_OR_NULL and set inode null when IS_ERR [5.10,021/152] ext4: fix wrong list_splice in ext4_fc_cleanup [5.10,022/152] ext4: fix bug for rename with RENAME_WHITEOUT [5.10,023/152] cifs: check pointer before freeing [5.10,024/152] cifs: fix interrupted close commands [5.10,025/152] riscv: Drop a duplicated PAGE_KERNEL_EXEC [5.10,026/152] riscv: return -ENOSYS for syscall -1 [5.10,027/152] riscv: Fixup CONFIG_GENERIC_TIME_VSYSCALL [5.10,028/152] riscv: Fix KASAN memory mapping. [5.10,029/152] mips: fix Section mismatch in reference [5.10,030/152] mips: lib: uncached: fix non-standard usage of variable sp [5.10,031/152] MIPS: boot: Fix unaligned access with CONFIG_MIPS_RAW_APPENDED_DTB [5.10,032/152] MIPS: Fix malformed NT_FILE and NT_SIGINFO in 32bit coredumps [5.10,033/152] MIPS: relocatable: fix possible boot hangup with KASLR enabled [5.10,034/152] RDMA/ocrdma: Fix use after free in ocrdma_dealloc_ucontext_pd() [5.10,035/152] ACPI: scan: Harden acpi_device_add() against device ID overflows [5.10,036/152] xen/privcmd: allow fetching resource sizes [5.10,037/152] compiler.h: Raise minimum version of GCC to 5.1 for arm64 [5.10,038/152] mm/vmalloc.c: fix potential memory leak [5.10,039/152] mm/hugetlb: fix potential missing huge page size info [5.10,040/152] mm/process_vm_access.c: include compat.h [5.10,041/152] dm raid: fix discard limits for raid1 [5.10,042/152] dm snapshot: flush merged data before committing metadata [5.10,043/152] dm integrity: fix flush with external metadata device [5.10,044/152] dm integrity: fix the maximum number of arguments [5.10,045/152] dm crypt: use GFP_ATOMIC when allocating crypto requests from softirq [5.10,046/152] dm crypt: do not wait for backlogged crypto request completion in softirq [5.10,047/152] dm crypt: do not call bio_endio() from the dm-crypt tasklet [5.10,048/152] dm crypt: defer decryption to a tasklet if interrupts disabled [5.10,049/152] stmmac: intel: change all EHL/TGL to auto detect phy addr [5.10,050/152] r8152: Add Lenovo Powered USB-C Travel Hub [5.10,051/152] btrfs: tree-checker: check if chunk item end overflows [5.10,052/152] ext4: dont leak old mountpoint samples [5.10,053/152] io_uring: dont take files/mm for a dead task [5.10,054/152] io_uring: drop mm and files after task_work_run [5.10,055/152] ARC: build: remove non-existing bootpImage from KBUILD_IMAGE [5.10,056/152] ARC: build: add uImage.lzma to the top-level target [5.10,057/152] ARC: build: add boot_targets to PHONY [5.10,058/152] ARC: build: move symlink creation to arch/arc/Makefile to avoid race [5.10,059/152] ARM: omap2: pmic-cpcap: fix maximum voltage to be consistent with defaults on xt875 [5.10,060/152] ath11k: fix crash caused by NULL rx_channel [5.10,061/152] netfilter: ipset: fixes possible oops in mtype_resize [5.10,062/152] ath11k: qmi: try to allocate a big block of DMA memory first [5.10,063/152] btrfs: fix async discard stall [5.10,064/152] btrfs: merge critical sections of discard lock in workfn [5.10,065/152] btrfs: fix transaction leak and crash after RO remount caused by qgroup rescan [5.10,066/152] regulator: bd718x7: Add enable times [5.10,067/152] ethernet: ucc_geth: fix definition and size of ucc_geth_tx_global_pram [5.10,068/152] ARM: dts: ux500/golden: Set display max brightness [5.10,069/152] habanalabs: adjust pci controller init to new firmware [5.10,070/152] habanalabs/gaudi: retry loading TPC f/w on -EINTR [5.10,071/152] habanalabs: register to pci shutdown callback [5.10,072/152] staging: spmi: hisi-spmi-controller: Fix some error handling paths [5.10,073/152] spi: altera: fix return value for altera_spi_txrx() [5.10,074/152] habanalabs: Fix memleak in hl_device_reset [5.10,075/152] hwmon: (pwm-fan) Ensure that calculation doesnt discard big period values [5.10,076/152] lib/raid6: Let $(UNROLL) rules work with macOS userland [5.10,077/152] kconfig: remove kvmconfig and xenconfig shorthands [5.10,078/152] spi: fix the divide by 0 error when calculating xfer waiting time [5.10,079/152] io_uring: drop file refs after task cancel [5.10,080/152] bfq: Fix computation of shallow depth [5.10,081/152] arch/arc: add copy_user_page() to <asm/page.h> to fix build error on ARC [5.10,082/152] misdn: dsp: select CONFIG_BITREVERSE [5.10,083/152] net: ethernet: fs_enet: Add missing MODULE_LICENSE [5.10,084/152] selftests: fix the return value for UDP GRO test [5.10,085/152] nvme-pci: mark Samsung PM1725a as IGNORE_DEV_SUBNQN [5.10,086/152] nvme: avoid possible double fetch in handling CQE [5.10,087/152] nvmet-rdma: Fix list_del corruption on queue establishment failure [5.10,088/152] drm/amd/display: fix sysfs amdgpu_current_backlight_pwm NULL pointer issue [5.10,089/152] drm/amdgpu: fix a GPU hang issue when remove device [5.10,090/152] drm/amd/pm: fix the failure when change power profile for renoir [5.10,091/152] drm/amdgpu: fix potential memory leak during navi12 deinitialization [5.10,092/152] usb: typec: Fix copy paste error for NVIDIA alt-mode description [5.10,093/152] iommu/vt-d: Fix lockdep splat in sva bind()/unbind() [5.10,094/152] ACPI: scan: add stub acpi_create_platform_device() for !CONFIG_ACPI [5.10,095/152] drm/msm: Call msm_init_vram before binding the gpu [5.10,096/152] ARM: picoxcell: fix missing interrupt-parent properties [5.10,097/152] poll: fix performance regression due to out-of-line __put_user() [5.10,098/152] rcu-tasks: Move RCU-tasks initialization to before early_initcall() [5.10,099/152] bpf: Simplify task_file_seq_get_next() [5.10,100/152] bpf: Save correct stopping point in file seq iteration [5.10,101/152] x86/sev-es: Fix SEV-ES OUT/IN immediate opcode vc handling [5.10,102/152] cfg80211: select CONFIG_CRC32 [5.10,103/152] nvme-fc: avoid calling _nvme_fc_abort_outstanding_ios from interrupt context [5.10,104/152] iommu/vt-d: Update domain geometry in iommu_ops.at(de)tach_dev [5.10,105/152] net/mlx5e: CT: Use per flow counter when CT flow accounting is enabled [5.10,106/152] net/mlx5: Fix passing zero to PTR_ERR [5.10,107/152] net/mlx5: E-Switch, fix changing vf VLANID [5.10,108/152] blk-mq-debugfs: Add decode for BLK_MQ_F_TAG_HCTX_SHARED [5.10,109/152] mm: fix clear_refs_write locking [5.10,110/152] mm: dont play games with pinned pages in clear_page_refs [5.10,111/152] mm: dont put pinned pages into the swap cache [5.10,112/152] perf intel-pt: Fix CPU too large error [5.10,113/152] dump_common_audit_data(): fix racy accesses to ->d_name [5.10,114/152] ASoC: meson: axg-tdm-interface: fix loopback [5.10,115/152] ASoC: meson: axg-tdmin: fix axg skew offset [5.10,116/152] ASoC: Intel: fix error code cnl_set_dsp_D0() [5.10,117/152] nvmet-rdma: Fix NULL deref when setting pi_enable and traddr INADDR_ANY [5.10,118/152] nvme: dont intialize hwmon for discovery controllers [5.10,119/152] nvme-tcp: fix possible data corruption with bio merges [5.10,120/152] nvme-tcp: Fix warning with CONFIG_DEBUG_PREEMPT [5.10,121/152] NFS4: Fix use-after-free in trace_event_raw_event_nfs4_set_lock [5.10,122/152] pNFS: We want return-on-close to complete when evicting the inode [5.10,123/152] pNFS: Mark layout for return if return-on-close was not sent [5.10,124/152] pNFS: Stricter ordering of layoutget and layoutreturn [5.10,125/152] NFS: Adjust fs_context error logging [5.10,126/152] NFS/pNFS: Dont call pnfs_free_bucket_lseg() before removing the request [5.10,127/152] NFS/pNFS: Dont leak DS commits in pnfs_generic_retry_commit() [5.10,128/152] NFS/pNFS: Fix a leak of the layout plh_outstanding counter [5.10,129/152] NFS: nfs_delegation_find_inode_server must first reference the superblock [5.10,130/152] NFS: nfs_igrab_and_active must first reference the superblock [5.10,131/152] scsi: ufs: Fix possible power drain during system suspend [5.10,132/152] ext4: fix superblock checksum failure when setting password salt [5.10,133/152] RDMA/restrack: Dont treat as an error allocation ID wrapping [5.10,134/152] RDMA/usnic: Fix memleak in find_free_vf_and_create_qp_grp [5.10,135/152] bnxt_en: Improve stats context resource accounting with RDMA driver loaded. [5.10,136/152] RDMA/mlx5: Fix wrong free of blue flame register on error [5.10,137/152] IB/mlx5: Fix error unwinding when set_has_smi_cap fails [5.10,138/152] umount(2): move the flag validity checks first [5.10,139/152] dm zoned: select CONFIG_CRC32 [5.10,140/152] drm/i915/dsi: Use unconditional msleep for the panel_on_delay when there is no res... [5.10,141/152] drm/i915/icl: Fix initing the DSI DSC power refcount during HW readout [5.10,142/152] drm/i915/gt: Restore clear-residual mitigations for Ivybridge, Baytrail [5.10,143/152] mm, slub: consider rest of partial list if acquire_slab() fails [5.10,144/152] riscv: Trace irq on only interrupt is enabled [5.10,145/152] iommu/vt-d: Fix unaligned addresses for intel_flush_svm_range_dev() [5.10,146/152] net: sunrpc: interpret the return value of kstrtou32 correctly [5.10,147/152] selftests: netfilter: Pass family parameter "-f" to conntrack tool [5.10,148/152] dm: eliminate potential source of excessive kernel log noise [5.10,149/152] ALSA: fireface: Fix integer overflow in transmit_midi_msg() [5.10,150/152] ALSA: firewire-tascam: Fix integer overflow in midi_port_work() [5.10,151/152] netfilter: conntrack: fix reading nf_conntrack_buckets [5.10,152/152] netfilter: nf_nat: Fix memleak in nf_nat_init

Message ID

20210118113355.672301537@linuxfoundation.org

State

New

Headers

From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
	stable@vger.kernel.org, Carl Huang <cjhuang@codeaurora.org>,
	Kalle Valo <kvalo@codeaurora.org>, Sasha Levin <sashal@kernel.org>
Subject: [PATCH 5.10 060/152] ath11k: fix crash caused by NULL rx_channel
Date: Mon, 18 Jan 2021 12:33:55 +0100
Message-Id: <20210118113355.672301537@linuxfoundation.org>
In-Reply-To: <20210118113352.764293297@linuxfoundation.org>
References: <20210118113352.764293297@linuxfoundation.org>
User-Agent: quilt/0.66
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Precedence: bulk

Series

None | expand

Commit Message

Greg Kroah-Hartman Jan. 18, 2021, 11:33 a.m. UTC

From: Carl Huang <cjhuang@codeaurora.org>

[ Upstream commit 3597010630d0aa96f5778901e691c6068bb86318 ]

During connect and disconnect stress test, crashed happened
because ar->rx_channel is NULL. Fix it by checking whether
ar->rx_channel is NULL.

Crash stack is as below:
RIP: 0010:ath11k_dp_rx_h_ppdu+0x110/0x230 [ath11k]
[ 5028.808963]  ath11k_dp_rx_wbm_err+0x14a/0x360 [ath11k]
[ 5028.808970]  ath11k_dp_rx_process_wbm_err+0x41c/0x520 [ath11k]
[ 5028.808978]  ath11k_dp_service_srng+0x25e/0x2d0 [ath11k]
[ 5028.808982]  ath11k_pci_ext_grp_napi_poll+0x23/0x80 [ath11k_pci]
[ 5028.808986]  net_rx_action+0x27e/0x400
[ 5028.808990]  __do_softirq+0xfd/0x2bb
[ 5028.808993]  irq_exit+0xa6/0xb0
[ 5028.808995]  do_IRQ+0x56/0xe0
[ 5028.808997]  common_interrupt+0xf/0xf

Tested-on: QCA6390 hw2.0 PCI WLAN.HST.1.0.1-01740-QCAHSTSWPLZ_V2_TO_X86-1

Signed-off-by: Carl Huang <cjhuang@codeaurora.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20201211055613.9310-1-cjhuang@codeaurora.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/ath/ath11k/dp_rx.c | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/drivers/net/wireless/ath/ath11k/dp_rx.c b/drivers/net/wireless/ath/ath11k/dp_rx.c
index 01625327eef7c..3638501a09593 100644
--- a/drivers/net/wireless/ath/ath11k/dp_rx.c
+++ b/drivers/net/wireless/ath/ath11k/dp_rx.c
@@ -2272,6 +2272,7 @@  static void ath11k_dp_rx_h_ppdu(struct ath11k *ar, struct hal_rx_desc *rx_desc,
 {
 	u8 channel_num;
 	u32 center_freq;
+	struct ieee80211_channel *channel;
 
 	rx_status->freq = 0;
 	rx_status->rate_idx = 0;
@@ -2292,9 +2293,12 @@  static void ath11k_dp_rx_h_ppdu(struct ath11k *ar, struct hal_rx_desc *rx_desc,
 		rx_status->band = NL80211_BAND_5GHZ;
 	} else {
 		spin_lock_bh(&ar->data_lock);
-		rx_status->band = ar->rx_channel->band;
-		channel_num =
-			ieee80211_frequency_to_channel(ar->rx_channel->center_freq);
+		channel = ar->rx_channel;
+		if (channel) {
+			rx_status->band = channel->band;
+			channel_num =
+				ieee80211_frequency_to_channel(channel->center_freq);
+		}
 		spin_unlock_bh(&ar->data_lock);
 		ath11k_dbg_dump(ar->ab, ATH11K_DBG_DATA, NULL, "rx_desc: ",
 				rx_desc, sizeof(struct hal_rx_desc));

[5.10,060/152] ath11k: fix crash caused by NULL rx_channel

Commit Message

Patch