Uri Mashiach c13c92acfa wlcore/wl12xx: spi: fix NULL pointer dereference (Oops) ... commit e47301b06d upstream. Fix the below Oops when trying to modprobe wlcore_spi. The oops occurs because the wl1271_power_{off,on}() function doesn't check the power() function pointer. [ 23.401447] Unable to handle kernel NULL pointer dereference at virtual address 00000000 [ 23.409954] pgd = c0004000 [ 23.412922] [00000000] *pgd=00000000 [ 23.416693] Internal error: Oops: 80000007 [#1] SMP ARM [ 23.422168] Modules linked in: wl12xx wlcore mac80211 cfg80211 musb_dsps musb_hdrc usbcore usb_common snd_soc_simple_card evdev joydev omap_rng wlcore_spi snd_soc_tlv320aic23_i2c rng_core snd_soc_tlv320aic23 c_can_platform c_can can_dev snd_soc_davinci_mcasp snd_soc_edma snd_soc_omap omap_wdt musb_am335x cpufreq_dt thermal_sys hwmon [ 23.453253] CPU: 0 PID: 36 Comm: kworker/0:2 Not tainted 4.2.0-00002-g951efee-dirty #233 [ 23.461720] Hardware name: Generic AM33XX (Flattened Device Tree) [ 23.468123] Workqueue: events request_firmware_work_func [ 23.473690] task: de32efc0 ti: de4ee000 task.ti: de4ee000 [ 23.479341] PC is at 0x0 [ 23.482112] LR is at wl12xx_set_power_on+0x28/0x124 [wlcore] [ 23.488074] pc : [<00000000>] lr : [<bf2581f0>] psr: 60000013 [ 23.488074] sp : de4efe50 ip : 00000002 fp : 00000000 [ 23.500162] r10: de7cdd00 r9 : dc848800 r8 : bf27af00 [ 23.505663] r7 : bf27a1a8 r6 : dcbd8a80 r5 : dce0e2e0 r4 : dce0d2e0 [ 23.512536] r3 : 00000000 r2 : 00000000 r1 : 00000001 r0 : dc848810 [ 23.519412] Flags: nZCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment kernel [ 23.527109] Control: 10c5387d Table: 9cb78019 DAC: 00000015 [ 23.533160] Process kworker/0:2 (pid: 36, stack limit = 0xde4ee218) [ 23.539760] Stack: (0xde4efe50 to 0xde4f0000) [...] [ 23.665030] [<bf2581f0>] (wl12xx_set_power_on [wlcore]) from [<bf25f7ac>] (wlcore_nvs_cb+0x118/0xa4c [wlcore]) [ 23.675604] [<bf25f7ac>] (wlcore_nvs_cb [wlcore]) from [<c04387ec>] (request_firmware_work_func+0x30/0x58) [ 23.685784] [<c04387ec>] (request_firmware_work_func) from [<c0058e2c>] (process_one_work+0x1b4/0x4b4) [ 23.695591] [<c0058e2c>] (process_one_work) from [<c0059168>] (worker_thread+0x3c/0x4a4) [ 23.704124] [<c0059168>] (worker_thread) from [<c005ee68>] (kthread+0xd4/0xf0) [ 23.711747] [<c005ee68>] (kthread) from [<c000f598>] (ret_from_fork+0x14/0x3c) [ 23.719357] Code: bad PC value [ 23.722760] ---[ end trace 981be8510db9b3a9 ]--- Prevent oops by validationg power() pointer value before calling the function. Signed-off-by: Uri Mashiach <uri.mashiach@compulab.co.il> Acked-by: Igor Grinberg <grinberg@compulab.co.il> Signed-off-by: Kalle Valo <kvalo@codeaurora.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2016-02-17 12:30:56 -08:00
..
appletalk
arcnet	arcnet/com20020: add LEDS_CLASS dependency	2015-11-03 11:29:56 -05:00
bonding	bonding: Prevent IPv6 link local address on enslaved devices	2016-01-31 11:29:00 -08:00
caif	net: caif: check return value of alloc_netdev	2015-11-09 11:31:13 -05:00
can	can: remove obsolete assignment for CAN protocol error type	2015-11-23 09:37:38 +01:00
cris
dsa	net: dsa: mv88e6060: replace magic values with register defines	2015-11-15 20:16:16 -05:00
ethernet	net/mlx5_core: Fix trimming down IRQ number	2016-01-31 11:29:01 -08:00
fddi
fjes	fjes: fix inconsistent indenting	2015-11-15 17:09:23 -05:00
hamradio	mkiss: fix scribble on freed memory	2016-01-06 15:06:27 -05:00
hippi
hyperv
ieee802154	spi: Updates for v4.4	2015-11-05 13:15:12 -08:00
ipvlan	ipvlan: fix use after free of skb	2015-11-17 14:39:29 -05:00
irda
phy	net: phy: mdio-mux: Check return value of mdiobus_alloc()	2015-12-14 14:27:40 -05:00
plip
ppp	pptp: verify sockaddr_len in pptp_bind() and pptp_connect()	2015-12-15 00:29:34 -05:00
slip	ppp, slip: Validate VJ compression slot parameters completely	2015-11-02 16:25:00 -05:00
team	team: Replace rcu_read_lock with a mutex in team_vlan_rx_kill_vid	2016-01-31 11:29:01 -08:00
usb	net: qmi_wwan: Add WeTelecom-WPD600N	2016-01-06 15:50:00 -05:00
vmxnet3	Driver: Vmxnet3: Fix regression caused by 5738a09	2016-01-06 16:20:13 -05:00
wan	wan/x25: Fix use-after-free in x25_asy_open_tty()	2015-12-01 15:17:42 -05:00
wimax
wireless	wlcore/wl12xx: spi: fix NULL pointer dereference (Oops)	2016-02-17 12:30:56 -08:00
xen-netback	xen: bug fixes for 4.4-rc5	2015-12-18 12:24:52 -08:00
dummy.c	net: dummy: add more features	2015-10-21 19:36:10 -07:00
eql.c
geneve.c	geneve: initialize needed_headroom	2015-12-23 22:28:29 -05:00
ifb.c
Kconfig	net: Add IPv6 support to VRF device	2015-10-13 04:55:07 -07:00
LICENSE.SRC
loopback.c
macvlan.c	macvlan: fix leak in macvlan_handle_frame	2015-11-17 14:39:29 -05:00
macvtap.c	net: rename SOCK_ASYNC_NOSPACE and SOCK_ASYNC_WAITDATA	2015-12-01 15:45:05 -05:00
Makefile
mdio.c
mii.c
netconsole.c	netconsole: use per-attribute show and store methods	2015-10-13 22:17:51 -07:00
nlmon.c
ntb_netdev.c
rionet.c
sb1000.c
Space.c
sungem_phy.c
tun.c	net: rename SOCK_ASYNC_NOSPACE and SOCK_ASYNC_WAITDATA	2015-12-01 15:45:05 -05:00
veth.c	veth: don’t modify ip_summed; doing so treats packets with bad checksums as good.	2015-12-22 15:15:34 -05:00
virtio_net.c	virtio-net: Stop doing DMA from the stack	2015-12-07 16:10:53 +02:00
vrf.c	net: Propagate lookup failure in l3mdev_get_saddr to caller	2016-01-04 22:58:30 -05:00
vxlan.c	vxlan: fix test which detect duplicate vxlan iface	2016-01-31 11:28:59 -08:00
xen-netfront.c	xen: features for 4.4-rc0	2015-11-04 17:32:42 -08:00