Bug 97441
| Summary: | rtlwifi null pointer dereference crashes kernel | ||
|---|---|---|---|
| Product: | Drivers | Reporter: | e-kernel |
| Component: | network-wireless | Assignee: | drivers_network-wireless (drivers_network-wireless) |
| Status: | NEW --- | ||
| Severity: | high | CC: | artas360, bugs, jwboyer, Larry.Finger, lfdominguez, szg00000, wking |
| Priority: | P1 | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Kernel Version: | 4.0 | Subsystem: | |
| Regression: | No | Bisected commit-id: | |
| Attachments: |
Proposed patch
Correct patch |
||
|
Description
e-kernel
2015-04-28 14:22:38 UTC
This looks like the same bug that was discussed briefly on linux-wireless on 2015-06-05 [1]. [1]: http://thread.gmane.org/gmane.linux.kernel.wireless.general/138645 Currently I have to run kernel 3.19.7 because all 4.x.x kernels crash at boot time See more details at https://bugzilla.redhat.com/show_bug.cgi?id=1235414 Hello,
I think I fix the problem, I just add two lines and all work (the AP mode) fine without problems.
Here go: (Sorry I have no git and no internet to download code and upload changes)
Into file /drivers/net/wireless/rtlwifi/core.c
Inside (line 1013):
static void send_beacon_frame(struct ieee80211_hw *hw,
struct ieee80211_vif *vif)
{
struct rtl_priv *rtlpriv = rtl_priv(hw);
struct sk_buff *skb = ieee80211_beacon_get(hw, vif);
//Here I add this two lines
struct rtl_tcb_desc tcb_desc;
memset (&tcb_desc, 0, sizeof(struct rtl_tcb_desc));
if(skb) // I replace the last NULL parametter
rtlpriv->intf_ops->adapter_tx(hw, NULL, skb, &tcb_desc)
}
I think the problem was the last NULL parametter.
Created attachment 184001 [details]
Proposed patch
This version of the patch is reworked a little, but is essentially as proposed by Dominguez.
Please, make sure all affected drivers are fixed, not only rtl8821ae It is happening too at a system using the rtl8192ce driver. The patch is for rtlwifi, which is used by all of the drivers. Now i'm using the RTL 8188ee module. All works fine.... (In reply to Larry Finger from comment #4) > Created attachment 184001 [details] > Proposed patch > > This version of the patch is reworked a little, but is essentially as > proposed by Dominguez. I'm confused. This patch looks like bringing in register definitions and no longer including ../reg.h. It doesn't look at all like the two lines of code in comment #3. How is this the same? Is there an upstream patch that was sent for this? Yes. It is commit 7c62940165e9ae4004ce4e6b5117330bab94df68 in the wireless-drivers repo. The real patch is as follows:
diff --git a/drivers/net/wireless/rtlwifi/core.c b/drivers/net/wireless/rtlwifi/core.c
index 3b3a88b..585d088 100644
--- a/drivers/net/wireless/rtlwifi/core.c
+++ b/drivers/net/wireless/rtlwifi/core.c
@@ -1015,9 +1015,12 @@ static void send_beacon_frame(struct ieee80211_hw *hw,
{
struct rtl_priv *rtlpriv = rtl_priv(hw);
struct sk_buff *skb = ieee80211_beacon_get(hw, vif);
+ struct rtl_tcb_desc tcb_desc;
- if (skb)
- rtlpriv->intf_ops->adapter_tx(hw, NULL, skb, NULL);
+ if (skb) {
+ memset(&tcb_desc, 0, sizeof(struct rtl_tcb_desc));
+ rtlpriv->intf_ops->adapter_tx(hw, NULL, skb, &tcb_desc);
+ }
}
static void rtl_op_bss_info_changed(struct ieee80211_hw *hw,
Created attachment 184141 [details]
Correct patch
The wrong patch was previously attached. It is replaced with the correct one.
The problem has been fixed in at least couple of recent kernel releases. I am now running 4.2.6 on a Fedora 23 and it is working fine. Please close this with a CODE FIX. I do not have the necessary privilege. |