diff options
| author | Lorenzo Bianconi <lorenzo@kernel.org> | 2020-05-16 15:56:33 +0300 |
|---|---|---|
| committer | Felix Fietkau <nbd@nbd.name> | 2020-05-28 18:55:30 +0300 |
| commit | 4c04f25dd449a825fbcd7610c7f20be1e51b088d (patch) | |
| tree | 87c7e58772c42d979ead1a034fc5f543b5080606 /drivers/net/wireless/mediatek/mt76/mt7615/init.c | |
| parent | 19e29c69cc4760c0d340ac1fa7f8c423fcd70a08 (diff) | |
| download | linux-4c04f25dd449a825fbcd7610c7f20be1e51b088d.tar.xz | |
mt76: mt7615: fix NULL pointer deref in mt7615_register_ext_phy
Fix following NULL pointer dereference in mt7615_register_ext_phy routine
[ 27.648860] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000060
[ 27.657697] Mem abort info:
[ 27.660495] ESR = 0x96000046
[ 27.663549] EC = 0x25: DABT (current EL), IL = 32 bits
[ 27.668857] SET = 0, FnV = 0
[ 27.671910] EA = 0, S1PTW = 0
[ 27.675040] Data abort info:
[ 27.677918] ISV = 0, ISS = 0x00000046
[ 27.681751] CM = 0, WnR = 1
[ 27.684717] user pgtable: 4k pages, 39-bit VAs, pgdp=000000007d8cc000
[ 27.691156] [0000000000000060] pgd=000000007d281003, pud=000000007d281003, pmd=0000000000000000
[ 27.699857] Internal error: Oops: 96000046 [#1] SMP
[ 27.774939] CPU: 1 PID: 701 Comm: ash Not tainted 5.4.41 #0
[ 27.780500] Hardware name: Bananapi BPI-R64 (DT)
[ 27.785108] pstate: 60000005 (nZCv daif -PAN -UAO)
[ 27.789897] pc : mt7615_register_ext_phy+0x60/0x2c8 [mt7615_common]
[ 27.796156] lr : mt7615_init_debugfs+0x99c/0x18e0 [mt7615_common]
[ 27.802237] sp : ffffffc0115dbcb0
[ 27.805541] x29: ffffffc0115dbcb0 x28: ffffff803e309600
[ 27.810843] x27: 0000000000000000 x26: 0000000000000000
[ 27.816144] x25: ffffff803d936928 x24: ffffff803d936950
[ 27.821447] x23: 0000000000000000 x22: 0000000fffffffe0
[ 27.826749] x21: 0000000000000002 x20: ffffff8001e82620
[ 27.832050] x19: 0000000000000000 x18: 0000000000000000
[ 27.837352] x17: 0000000000000000 x16: 0000000000000000
[ 27.842653] x15: 0000000000000000 x14: 0000000000000000
[ 27.847955] x13: 0000000000000000 x12: 0000000000000000
[ 27.853256] x11: 0000000000000000 x10: 0000000000000040
[ 27.858558] x9 : ffffffc0112b3eb0 x8 : ffffffc0112b3ea8
[ 27.863859] x7 : ffffff803e400048 x6 : 0000000000000000
[ 27.869161] x5 : ffffff803e400000 x4 : 0000000000000000
[ 27.874462] x3 : 0000000000000001 x2 : 0000000000007615
[ 27.879764] x1 : 0000000000000068 x0 : ffffffc0088ccc58
[ 27.885066] Call trace:
[ 27.887505] mt7615_register_ext_phy+0x60/0x2c8 [mt7615_common]
[ 27.893416] mt7615_init_debugfs+0x99c/0x18e0 [mt7615_common]
[ 27.899156] simple_attr_write+0xf0/0x178
[ 27.903158] debugfs_attr_write+0x4c/0x70
[ 27.907159] full_proxy_write+0x60/0x90
[ 27.910987] __vfs_write+0x18/0x40
[ 27.914379] vfs_write+0xb0/0x1b8
[ 27.917685] ksys_write+0x4c/0xc8
[ 27.920989] __arm64_sys_write+0x18/0x20
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Diffstat (limited to 'drivers/net/wireless/mediatek/mt76/mt7615/init.c')
| -rw-r--r-- | drivers/net/wireless/mediatek/mt76/mt7615/init.c | 18 |
1 files changed, 9 insertions, 9 deletions
diff --git a/drivers/net/wireless/mediatek/mt76/mt7615/init.c b/drivers/net/wireless/mediatek/mt76/mt7615/init.c index 18a570ffb815..0d105e4abdfd 100644 --- a/drivers/net/wireless/mediatek/mt76/mt7615/init.c +++ b/drivers/net/wireless/mediatek/mt76/mt7615/init.c @@ -372,15 +372,6 @@ int mt7615_register_ext_phy(struct mt7615_dev *dev) if (phy) return 0; - INIT_DELAYED_WORK(&phy->mac_work, mt7615_mac_work); - INIT_DELAYED_WORK(&phy->scan_work, mt7615_scan_work); - skb_queue_head_init(&phy->scan_event_list); - - INIT_WORK(&phy->ps_work, mt7615_ps_work); - INIT_WORK(&phy->roc_work, mt7615_roc_work); - timer_setup(&phy->roc_timer, mt7615_roc_timer, 0); - init_waitqueue_head(&phy->roc_wait); - mt7615_cap_dbdc_enable(dev); mphy = mt76_alloc_phy(&dev->mt76, sizeof(*phy), &mt7615_ops); if (!mphy) @@ -393,6 +384,15 @@ int mt7615_register_ext_phy(struct mt7615_dev *dev) mphy->antenna_mask = BIT(hweight8(phy->chainmask)) - 1; mt7615_init_wiphy(mphy->hw); + INIT_DELAYED_WORK(&phy->mac_work, mt7615_mac_work); + INIT_DELAYED_WORK(&phy->scan_work, mt7615_scan_work); + skb_queue_head_init(&phy->scan_event_list); + + INIT_WORK(&phy->ps_work, mt7615_ps_work); + INIT_WORK(&phy->roc_work, mt7615_roc_work); + timer_setup(&phy->roc_timer, mt7615_roc_timer, 0); + init_waitqueue_head(&phy->roc_wait); + mt7615_mac_set_scs(phy, true); /* |