• Avinash Patil's avatar
    mwifiex: fix a crash in extended scan event processing · 21445049
    Avinash Patil authored
    [113.967694] Unable to handle kernel NULL pointer dereference
                   at virtual address 00000020
    ............
    [113.967859] PC is at mwifiex_update_rxreor_flags+0xfc/0x430
    ............
    [113.968110] mwifiex_update_rxreor_flags+0xfc/0x430
    [113.968129] mwifiex_handle_event_ext_scan_report+0x1e4/0x21c
    [113.968148] mwifiex_process_sta_event+0x410/0x508
    [113.968165] mwifiex_process_event+0x184/0x1e0
    [113.968181] mwifiex_main_process+0x220/0x48c
    [113.968197] mwifiex_sdio_interrupt+0xc8/0x1cc
    [113.968210] sdio_irq_thread+0x11c/0x290
    
    In case of legacy scan, adapter->curr_cmd is guranteed to be
    non-NULL in check_next_scan_cmd. This may not be case in
    extended scan where scan command response would come earlier and
    set curr_cmd to NULL. Extended scan event comes later and while
    trying to complete IOCTL for scan, driver would crash in
    dereferencing adapter->curr_cmd->wait_q_enabled.
    
    Avoid this by completing IOCTL in case of legacy scans only.
    Internal scan would be completed while handling extended scan
    command response.
    Signed-off-by: default avatarAvinash Patil <patila@marvell.com>
    Signed-off-by: default avatarBing Zhao <bzhao@marvell.com>
    Signed-off-by: default avatarJohn W. Linville <linville@tuxdriver.com>
    21445049
scan.c 68.2 KB