releases/4.1.7/rtlwifi-fix-null-dereference-when-pci-driver-used-as-an-ap.patch

   1 From 7c62940165e9ae4004ce4e6b5117330bab94df68 Mon Sep 17 00:00:00 2001
   2 From: Luis Felipe Dominguez Vega <lfdominguez@nauta.cu>
   3 Date: Wed, 29 Jul 2015 21:11:20 -0500
   4 Subject: rtlwifi: Fix NULL dereference when PCI driver used as an AP
   5
   6 From: Luis Felipe Dominguez Vega <lfdominguez@nauta.cu>
   7
   8 commit 7c62940165e9ae4004ce4e6b5117330bab94df68 upstream.
   9
  10 In commit 33511b157bbcebaef853cc1811992b664a2e5862 ("rtlwifi: add support to
  11 send beacon frame"), the mechanism for sending beacons was established. That
  12 patch works correctly for rtl8192cu, but there is a possibility of getting
  13 the following warnings in the PCI drivers:
  14
  15 WARNING: CPU: 1 PID: 2439 at net/mac80211/driver-ops.h:12
  16 ieee80211_bss_info_change_notify+0x179/0x1d0 [mac80211]()
  17 wlp5s0:  Failed check-sdata-in-driver check, flags: 0x0
  18
  19 The warning is followed by a NULL pointer dereference as follows:
  20
  21 BUG: unable to handle kernel NULL pointer dereference at 0000000000000006
  22 IP: [<ffffffffc073998e>] rtl_get_tcb_desc+0x5e/0x760 [rtlwifi]
  23
  24 This problem was reported at http://thread.gmane.org/gmane.linux.kernel.wireless.general/138645,
  25 but no solution was found at that time.
  26
  27 The problem was also reported at https://bugzilla.kernel.org/show_bug.cgi?id=9744
  28 and this solution was developed and tested there.
  29
  30 The USB driver works with a NULL final argument in the adapter_tx() callback;
  31 however, the PCI drivers need a struct rtl_tcb_desc in that position.
  32
  33 Fixes: 33511b157bbc ("rtlwifi: add support to send beacon frame.")
  34 Signed-off-by: Luis Felipe Dominguez Vega <lfdominguez@nauta.cu>
  35 Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
  36 Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  37 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  38
  39 ---
  40  drivers/net/wireless/rtlwifi/core.c |    7 +++++--
  41  1 file changed, 5 insertions(+), 2 deletions(-)
  42
  43 --- a/drivers/net/wireless/rtlwifi/core.c
  44 +++ b/drivers/net/wireless/rtlwifi/core.c
  45 @@ -1015,9 +1015,12 @@ static void send_beacon_frame(struct iee
  46  {
  47         struct rtl_priv *rtlpriv = rtl_priv(hw);
  48         struct sk_buff *skb = ieee80211_beacon_get(hw, vif);
  49 +       struct rtl_tcb_desc tcb_desc;
  50
  51 -       if (skb)
  52 -               rtlpriv->intf_ops->adapter_tx(hw, NULL, skb, NULL);
  53 +       if (skb) {
  54 +               memset(&tcb_desc, 0, sizeof(struct rtl_tcb_desc));
  55 +               rtlpriv->intf_ops->adapter_tx(hw, NULL, skb, &tcb_desc);
  56 +       }
  57  }
  58
  59  static void rtl_op_bss_info_changed(struct ieee80211_hw *hw,