From 4c04f25dd449a825fbcd7610c7f20be1e51b088d Mon Sep 17 00:00:00 2001
From: Lorenzo Bianconi <lorenzo@kernel.org>
Date: Sat, 16 May 2020 14:56:33 +0200
Subject: [PATCH] mt76: mt7615: fix NULL pointer deref in mt7615_register_ext_phy
Git-commit: 4c04f25dd449a825fbcd7610c7f20be1e51b088d
Patch-mainline: v5.8-rc1
References: jsc#SLE-13430
Fix following NULL pointer dereference in mt7615_register_ext_phy routine
[ 27.648860] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000060
[ 27.657697] Mem abort info:
[ 27.660495] ESR = 0x96000046
[ 27.663549] EC = 0x25: DABT (current EL), IL = 32 bits
[ 27.668857] SET = 0, FnV = 0
[ 27.671910] EA = 0, S1PTW = 0
[ 27.675040] Data abort info:
[ 27.677918] ISV = 0, ISS = 0x00000046
[ 27.681751] CM = 0, WnR = 1
[ 27.684717] user pgtable: 4k pages, 39-bit VAs, pgdp=000000007d8cc000
[ 27.691156] [0000000000000060] pgd=000000007d281003, pud=000000007d281003, pmd=0000000000000000
[ 27.699857] Internal error: Oops: 96000046 [#1] SMP
[ 27.774939] CPU: 1 PID: 701 Comm: ash Not tainted 5.4.41 #0
[ 27.780500] Hardware name: Bananapi BPI-R64 (DT)
[ 27.785108] pstate: 60000005 (nZCv daif -PAN -UAO)
[ 27.789897] pc : mt7615_register_ext_phy+0x60/0x2c8 [mt7615_common]
[ 27.796156] lr : mt7615_init_debugfs+0x99c/0x18e0 [mt7615_common]
[ 27.802237] sp : ffffffc0115dbcb0
[ 27.805541] x29: ffffffc0115dbcb0 x28: ffffff803e309600
[ 27.810843] x27: 0000000000000000 x26: 0000000000000000
[ 27.816144] x25: ffffff803d936928 x24: ffffff803d936950
[ 27.821447] x23: 0000000000000000 x22: 0000000fffffffe0
[ 27.826749] x21: 0000000000000002 x20: ffffff8001e82620
[ 27.832050] x19: 0000000000000000 x18: 0000000000000000
[ 27.837352] x17: 0000000000000000 x16: 0000000000000000
[ 27.842653] x15: 0000000000000000 x14: 0000000000000000
[ 27.847955] x13: 0000000000000000 x12: 0000000000000000
[ 27.853256] x11: 0000000000000000 x10: 0000000000000040
[ 27.858558] x9 : ffffffc0112b3eb0 x8 : ffffffc0112b3ea8
[ 27.863859] x7 : ffffff803e400048 x6 : 0000000000000000
[ 27.869161] x5 : ffffff803e400000 x4 : 0000000000000000
[ 27.874462] x3 : 0000000000000001 x2 : 0000000000007615
[ 27.879764] x1 : 0000000000000068 x0 : ffffffc0088ccc58
[ 27.885066] Call trace:
[ 27.887505] mt7615_register_ext_phy+0x60/0x2c8 [mt7615_common]
[ 27.893416] mt7615_init_debugfs+0x99c/0x18e0 [mt7615_common]
[ 27.899156] simple_attr_write+0xf0/0x178
[ 27.903158] debugfs_attr_write+0x4c/0x70
[ 27.907159] full_proxy_write+0x60/0x90
[ 27.910987] __vfs_write+0x18/0x40
[ 27.914379] vfs_write+0xb0/0x1b8
[ 27.917685] ksys_write+0x4c/0xc8
[ 27.920989] __arm64_sys_write+0x18/0x20
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Acked-by: Takashi Iwai <tiwai@suse.de>
---
drivers/net/wireless/mediatek/mt76/mt7615/init.c | 18 +++++++++---------
1 file changed, 9 insertions(+), 9 deletions(-)
diff --git a/drivers/net/wireless/mediatek/mt76/mt7615/init.c b/drivers/net/wireless/mediatek/mt76/mt7615/init.c
index 18a570ffb815..0d105e4abdfd 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7615/init.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7615/init.c
@@ -372,15 +372,6 @@ int mt7615_register_ext_phy(struct mt7615_dev *dev)
if (phy)
return 0;
- INIT_DELAYED_WORK(&phy->mac_work, mt7615_mac_work);
- INIT_DELAYED_WORK(&phy->scan_work, mt7615_scan_work);
- skb_queue_head_init(&phy->scan_event_list);
-
- INIT_WORK(&phy->ps_work, mt7615_ps_work);
- INIT_WORK(&phy->roc_work, mt7615_roc_work);
- timer_setup(&phy->roc_timer, mt7615_roc_timer, 0);
- init_waitqueue_head(&phy->roc_wait);
-
mt7615_cap_dbdc_enable(dev);
mphy = mt76_alloc_phy(&dev->mt76, sizeof(*phy), &mt7615_ops);
if (!mphy)
@@ -393,6 +384,15 @@ int mt7615_register_ext_phy(struct mt7615_dev *dev)
mphy->antenna_mask = BIT(hweight8(phy->chainmask)) - 1;
mt7615_init_wiphy(mphy->hw);
+ INIT_DELAYED_WORK(&phy->mac_work, mt7615_mac_work);
+ INIT_DELAYED_WORK(&phy->scan_work, mt7615_scan_work);
+ skb_queue_head_init(&phy->scan_event_list);
+
+ INIT_WORK(&phy->ps_work, mt7615_ps_work);
+ INIT_WORK(&phy->roc_work, mt7615_roc_work);
+ timer_setup(&phy->roc_timer, mt7615_roc_timer, 0);
+ init_waitqueue_head(&phy->roc_wait);
+
mt7615_mac_set_scs(phy, true);
/*
--
2.16.4