diff mbox

iwlwifi: fix kernel crash when unregistering thermal zone

Message ID b6a2209c-1343-cbda-c6c2-ae5eb93148d3@kernel.dk (mailing list archive)
State Accepted
Commit 92549cdc288f47f3a98cf80ac5890c91f5876a06
Delegated to: Kalle Valo
Headers show

Commit Message

Jens Axboe Jan. 17, 2017, 10:22 p.m. UTC
A recent firmware change seems to have enabled thermal zones on the
iwlwifi driver. Unfortunately, my device fails when registering the
thermal zone. This doesn't stop the driver from attempting to unregister
the thermal zone at unload time, triggering a NULL pointer deference in
strlen() off the thermal_zone_device_unregister() path.

Don't unregister if name is NULL, for that case we failed registering.
Do the same for the cooling zone.

Signed-off-by: Jens Axboe <axboe@fb.com>

---

Would be great if this could go into the current series, as sometimes I
have to reload the driver. Right now I can't, since it crashes...

Comments

Kalle Valo Jan. 21, 2017, 7:56 a.m. UTC | #1
Jens Axboe <axboe@kernel.dk> writes:

> A recent firmware change seems to have enabled thermal zones on the
> iwlwifi driver. Unfortunately, my device fails when registering the
> thermal zone. This doesn't stop the driver from attempting to unregister
> the thermal zone at unload time, triggering a NULL pointer deference in
> strlen() off the thermal_zone_device_unregister() path.
>
> Don't unregister if name is NULL, for that case we failed registering.
> Do the same for the cooling zone.
>
> Signed-off-by: Jens Axboe <axboe@fb.com>
>
> ---
>
> Would be great if this could go into the current series, as sometimes I
> have to reload the driver. Right now I can't, since it crashes...

Luca, can I take this directly to wireless-drivers? This is an important
fix and we should get it to Linus' tree ASAP.
Kalle Valo Jan. 21, 2017, 12:59 p.m. UTC | #2
Jens Axboe <axboe@kernel.dk> wrote:
> A recent firmware change seems to have enabled thermal zones on the
> iwlwifi driver. Unfortunately, my device fails when registering the
> thermal zone. This doesn't stop the driver from attempting to unregister
> the thermal zone at unload time, triggering a NULL pointer deference in
> strlen() off the thermal_zone_device_unregister() path.
> 
> Don't unregister if name is NULL, for that case we failed registering.
> Do the same for the cooling zone.
> 
> Signed-off-by: Jens Axboe <axboe@fb.com>

Patch applied to wireless-drivers.git, thanks.

92549cdc288f iwlwifi: fix kernel crash when unregistering thermal zone
Jens Axboe Jan. 27, 2017, 7:48 p.m. UTC | #3
On 01/21/2017 05:59 AM, Kalle Valo wrote:
> Jens Axboe <axboe@kernel.dk> wrote:
>> A recent firmware change seems to have enabled thermal zones on the
>> iwlwifi driver. Unfortunately, my device fails when registering the
>> thermal zone. This doesn't stop the driver from attempting to unregister
>> the thermal zone at unload time, triggering a NULL pointer deference in
>> strlen() off the thermal_zone_device_unregister() path.
>>
>> Don't unregister if name is NULL, for that case we failed registering.
>> Do the same for the cooling zone.
>>
>> Signed-off-by: Jens Axboe <axboe@fb.com>
> 
> Patch applied to wireless-drivers.git, thanks.
> 
> 92549cdc288f iwlwifi: fix kernel crash when unregistering thermal zone

When is this going out?
Kalle Valo Jan. 27, 2017, 7:54 p.m. UTC | #4
Jens Axboe <axboe@kernel.dk> writes:

> On 01/21/2017 05:59 AM, Kalle Valo wrote:
>> Jens Axboe <axboe@kernel.dk> wrote:
>>> A recent firmware change seems to have enabled thermal zones on the
>>> iwlwifi driver. Unfortunately, my device fails when registering the
>>> thermal zone. This doesn't stop the driver from attempting to unregister
>>> the thermal zone at unload time, triggering a NULL pointer deference in
>>> strlen() off the thermal_zone_device_unregister() path.
>>>
>>> Don't unregister if name is NULL, for that case we failed registering.
>>> Do the same for the cooling zone.
>>>
>>> Signed-off-by: Jens Axboe <axboe@fb.com>
>> 
>> Patch applied to wireless-drivers.git, thanks.
>> 
>> 92549cdc288f iwlwifi: fix kernel crash when unregistering thermal zone
>
> When is this going out?

Trying to send a pull request to Dave tomorrow.
Jens Axboe Jan. 27, 2017, 7:55 p.m. UTC | #5
On 01/27/2017 12:54 PM, Kalle Valo wrote:
> Jens Axboe <axboe@kernel.dk> writes:
> 
>> On 01/21/2017 05:59 AM, Kalle Valo wrote:
>>> Jens Axboe <axboe@kernel.dk> wrote:
>>>> A recent firmware change seems to have enabled thermal zones on the
>>>> iwlwifi driver. Unfortunately, my device fails when registering the
>>>> thermal zone. This doesn't stop the driver from attempting to unregister
>>>> the thermal zone at unload time, triggering a NULL pointer deference in
>>>> strlen() off the thermal_zone_device_unregister() path.
>>>>
>>>> Don't unregister if name is NULL, for that case we failed registering.
>>>> Do the same for the cooling zone.
>>>>
>>>> Signed-off-by: Jens Axboe <axboe@fb.com>
>>>
>>> Patch applied to wireless-drivers.git, thanks.
>>>
>>> 92549cdc288f iwlwifi: fix kernel crash when unregistering thermal zone
>>
>> When is this going out?
> 
> Trying to send a pull request to Dave tomorrow.

Great, thanks!
diff mbox

Patch

diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/tt.c b/drivers/net/wireless/intel/iwlwifi/mvm/tt.c
index 63a051be832e..bec7d9c46087 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/tt.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/tt.c
@@ -843,8 +843,10 @@  static void iwl_mvm_thermal_zone_unregister(struct iwl_mvm *mvm)
 		return;
 
 	IWL_DEBUG_TEMP(mvm, "Thermal zone device unregister\n");
-	thermal_zone_device_unregister(mvm->tz_device.tzone);
-	mvm->tz_device.tzone = NULL;
+	if (mvm->tz_device.tzone) {
+		thermal_zone_device_unregister(mvm->tz_device.tzone);
+		mvm->tz_device.tzone = NULL;
+	}
 }
 
 static void iwl_mvm_cooling_device_unregister(struct iwl_mvm *mvm)
@@ -853,8 +855,10 @@  static void iwl_mvm_cooling_device_unregister(struct iwl_mvm *mvm)
 		return;
 
 	IWL_DEBUG_TEMP(mvm, "Cooling device unregister\n");
-	thermal_cooling_device_unregister(mvm->cooling_dev.cdev);
-	mvm->cooling_dev.cdev = NULL;
+	if (mvm->cooling_dev.cdev) {
+		thermal_cooling_device_unregister(mvm->cooling_dev.cdev);
+		mvm->cooling_dev.cdev = NULL;
+	}
 }
 #endif /* CONFIG_THERMAL */