Larry Finger 2d838bb608 b43legacy: Fix crash on unload when firmware not available ... When b43legacy is loaded without the firmware being available, a following unload generates a kernel NULL pointer dereference BUG as follows: [ 214.330789] BUG: unable to handle kernel NULL pointer dereference at 0000004c [ 214.330997] IP: [<c104c395>] drain_workqueue+0x15/0x170 [ 214.331179] *pde = 00000000 [ 214.331311] Oops: 0000 [#1] SMP [ 214.331471] Modules linked in: b43legacy(-) ssb pcmcia mac80211 cfg80211 af_packet mperf arc4 ppdev sr_mod cdrom sg shpchp yenta_socket pcmcia_rsrc pci_hotplug pcmcia_core battery parport_pc parport floppy container ac button edd autofs4 ohci_hcd ehci_hcd usbcore usb_common thermal processor scsi_dh_rdac scsi_dh_hp_sw scsi_dh_emc scsi_dh_alua scsi_dh fan thermal_sys hwmon ata_generic pata_ali libata [last unloaded: cfg80211] [ 214.333421] Pid: 3639, comm: modprobe Not tainted 3.6.0-rc6-wl+ #163 Source Technology VIC 9921/ALI Based Notebook [ 214.333580] EIP: 0060:[<c104c395>] EFLAGS: 00010246 CPU: 0 [ 214.333687] EIP is at drain_workqueue+0x15/0x170 [ 214.333788] EAX: c162ac40 EBX: cdfb8360 ECX: 0000002a EDX: 00002a2a [ 214.333890] ESI: 00000000 EDI: 00000000 EBP: cd767e7c ESP: cd767e5c [ 214.333957] DS: 007b ES: 007b FS: 00d8 GS: 0033 SS: 0068 [ 214.333957] CR0: 8005003b CR2: 0000004c CR3: 0c96a000 CR4: 00000090 [ 214.333957] DR0: 00000000 DR1: 00000000 DR2: 00000000 DR3: 00000000 [ 214.333957] DR6: ffff0ff0 DR7: 00000400 [ 214.333957] Process modprobe (pid: 3639, ti=cd766000 task=cf802e90 task.ti=cd766000) [ 214.333957] Stack: [ 214.333957] 00000292 cd767e74 c12c5e09 00000296 00000296 cdfb8360 cdfb9220 00000000 [ 214.333957] cd767e90 c104c4fd cdfb8360 cdfb9220 cd682800 cd767ea4 d0c10184 cd682800 [ 214.333957] cd767ea4 cba31064 cd767eb8 d0867908 cba31064 d087e09c cd96f034 cd767ec4 [ 214.333957] Call Trace: [ 214.333957] [<c12c5e09>] ? skb_dequeue+0x49/0x60 [ 214.333957] [<c104c4fd>] destroy_workqueue+0xd/0x150 [ 214.333957] [<d0c10184>] ieee80211_unregister_hw+0xc4/0x100 [mac80211] [ 214.333957] [<d0867908>] b43legacy_remove+0x78/0x80 [b43legacy] [ 214.333957] [<d083654d>] ssb_device_remove+0x1d/0x30 [ssb] [ 214.333957] [<c126f15a>] __device_release_driver+0x5a/0xb0 [ 214.333957] [<c126fb07>] driver_detach+0x87/0x90 [ 214.333957] [<c126ef4c>] bus_remove_driver+0x6c/0xe0 [ 214.333957] [<c1270120>] driver_unregister+0x40/0x70 [ 214.333957] [<d083686b>] ssb_driver_unregister+0xb/0x10 [ssb] [ 214.333957] [<d087c488>] b43legacy_exit+0xd/0xf [b43legacy] [ 214.333957] [<c1089dde>] sys_delete_module+0x14e/0x2b0 [ 214.333957] [<c110a4a7>] ? vfs_write+0xf7/0x150 [ 214.333957] [<c1240050>] ? tty_write_lock+0x50/0x50 [ 214.333957] [<c110a6f8>] ? sys_write+0x38/0x70 [ 214.333957] [<c1397c55>] syscall_call+0x7/0xb [ 214.333957] Code: bc 27 00 00 00 00 a1 74 61 56 c1 55 89 e5 e8 a3 fc ff ff 5d c3 90 55 89 e5 57 56 89 c6 53 b8 40 ac 62 c1 83 ec 14 e8 bb b7 34 00 <8b> 46 4c 8d 50 01 85 c0 89 56 4c 75 03 83 0e 40 80 05 40 ac 62 [ 214.333957] EIP: [<c104c395>] drain_workqueue+0x15/0x170 SS:ESP 0068:cd767e5c [ 214.333957] CR2: 000000000000004c [ 214.341110] ---[ end trace c7e90ec026d875a6 ]---Index: wireless-testing/drivers/net/wireless/b43legacy/main.c The problem is fixed by making certain that the ucode pointer is not NULL before deregistering the driver in mac80211. Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net> Cc: Stable <stable@vger.kernel.org> [v 3.3.0+] Signed-off-by: John W. Linville <linville@tuxdriver.com>		2012-09-28 13:54:07 -04:00
..
appletalk	drivers: net: Remove casts to same type	2012-06-06 09:31:33 -07:00
arcnet
bonding	bond_sysfs: use real_num_tx_queues rather than params.tx_queue	2012-07-20 11:07:00 -07:00
caif	caif: fix NULL pointer check	2012-07-24 13:54:16 -07:00
can	net/c_can: remove conditional compilation of clk code	2012-07-30 17:25:12 -07:00
cris	net: Properly define functions with no parameters	2012-07-10 23:13:45 -07:00
dsa
ethernet	bnx2x: fix mem leak when command is unknown	2012-08-02 00:19:17 -07:00
fddi	drivers: net: Remove casts to same type	2012-06-06 09:31:33 -07:00
hamradio	drivers: net: Remove casts to same type	2012-06-06 09:31:33 -07:00
hippi
hyperv	hyperv: Add error handling to rndis_filter_device_add()	2012-07-25 15:31:30 -07:00
irda	Merge branch 'for-linus' of git://git.linaro.org/people/rmk/linux-arm	2012-07-27 15:14:26 -07:00
phy	Merge branch 'upstream' of git://git.linux-mips.org/pub/scm/ralf/upstream-linus	2012-07-30 11:45:52 -07:00
plip
ppp
slip	drivers: net: Remove casts to same type	2012-06-06 09:31:33 -07:00
team	team: init error value to 0 in team_netpoll_setup()	2012-07-24 13:54:15 -07:00
usb	netvm: propagate page->pfmemalloc from skb_alloc_page to skb	2012-07-31 18:42:46 -07:00
vmxnet3	drivers: net: Remove casts to same type	2012-06-06 09:31:33 -07:00
wan	drivers: net: Remove casts to same type	2012-06-06 09:31:33 -07:00
wimax	wimax: fix printk format warnings	2012-07-22 12:18:39 -07:00
wireless	b43legacy: Fix crash on unload when firmware not available	2012-09-28 13:54:07 -04:00
xen-netback	xen/netback: only non-freed SKB is queued into tx_queue	2012-06-29 00:50:20 -07:00
dummy.c	net: fix race condition in several drivers when reading stats	2012-07-22 12:12:32 -07:00
eql.c
ifb.c
Kconfig
LICENSE.SRC
loopback.c	net: fix race condition in several drivers when reading stats	2012-07-22 12:12:32 -07:00
macvlan.c
macvtap.c	macvtap: use prepare_to_wait/finish_wait to ensure mb	2012-06-07 13:18:54 -07:00
Makefile
mdio.c
mii.c
netconsole.c
rionet.c
sb1000.c
Space.c
sungem_phy.c
tun.c	tun: Fix formatting.	2012-07-30 14:52:48 -07:00
veth.c
virtio_net.c	net: fix race condition in several drivers when reading stats	2012-07-22 12:12:32 -07:00
xen-netfront.c	xen/netfront: teardown the device before unregistering it.	2012-06-27 01:25:41 -07:00