Doug / smarc-fsl-linux-kernel

Download as
Browse Code ยป

Commit 346ece0b7ba2730b4d633b9e371fe55488803102

Authored by Bing Zhao
Committed by John W. Linville
1 parent bd1c6142ed
Exists in smarc-imx_3.14.28_1.0.0_ga and in 1 other branch imx_3.14.28_1.0.0_ga

mwifiex: fix NULL pointer dereference in usb suspend handler 

Bug 60815 - Interface hangs in mwifiex_usb
https://bugzilla.kernel.org/show_bug.cgi?id=60815

[ 2.883807] BUG: unable to handle kernel NULL pointer dereference
            at 0000000000000048
[ 2.883813] IP: [<ffffffff815a65e0>] pfifo_fast_enqueue+0x90/0x90

[ 2.883834] CPU: 1 PID: 3220 Comm: kworker/u8:90 Not tainted
            3.11.1-monotone-l0 #6
[ 2.883834] Hardware name: Microsoft Corporation Surface with
            Windows 8 Pro/Surface with Windows 8 Pro,
            BIOS 1.03.0450 03/29/2013

On Surface Pro, suspend to ram gives a NULL pointer dereference in
pfifo_fast_enqueue(). The stack trace reveals that the offending
call is clearing carrier in mwifiex_usb suspend handler.

Since commit 1499d9f "mwifiex: don't drop carrier flag over suspend"
has removed the carrier flag handling over suspend/resume in SDIO
and PCIe drivers, I'm removing it in USB driver too. This also fixes
the bug for Surface Pro.

Cc: <stable@vger.kernel.org> # 3.5+
Tested-by: Dmitry Khromov <icechrome@gmail.com>
Signed-off-by: Bing Zhao <bzhao@marvell.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

Showing 1 changed file with 0 additions and 7 deletions Side-by-side Diff

drivers/net/wireless/mwifiex/usb.c
Diff comments   View file @ 346ece0
... ... @@ -447,9 +447,6 @@
447 447 */
448 448 adapter->is_suspended = true;
449 449  
450   - for (i = 0; i < adapter->priv_num; i++)
451   - netif_carrier_off(adapter->priv[i]->netdev);
452   -
453 450 if (atomic_read(&card->rx_cmd_urb_pending) && card->rx_cmd.urb)
454 451 usb_kill_urb(card->rx_cmd.urb);
455 452  
... ... @@ -508,10 +505,6 @@
508 505 mwifiex_usb_submit_rx_urb(&card->rx_cmd,
509 506 MWIFIEX_RX_CMD_BUF_SIZE);
510 507 }
511   -
512   - for (i = 0; i < adapter->priv_num; i++)
513   - if (adapter->priv[i]->media_connected)
514   - netif_carrier_on(adapter->priv[i]->netdev);
515 508  
516 509 /* Disable Host Sleep */
517 510 if (adapter->hs_activated)