Hi Mark, Thanks for the patch. > From: "Mark A. Greer" <mgreer@xxxxxxxxxxxxxxx> > > When reading the contents of '/sys/kernel/debug/mwifiex/p2p0/info', > the following panic occurs: > > $ cat /sys/kernel/debug/mwifiex/p2p0/info > Unable to handle kernel paging request at virtual address 74706164 > pgd = de530000 > [74706164] *pgd=00000000 > Internal error: Oops: 5 [#1] SMP ARM > Modules linked in: phy_twl4030_usb omap2430 musb_hdrc mwifiex_sdio mwifiex > CPU: 0 PID: 1635 Comm: cat Not tainted 3.10.0-rc1-00010-g1268390 #1 > task: de16b6c0 ti: de048000 task.ti: de048000 > PC is at strnlen+0xc/0x4c > LR is at string+0x3c/0xf8 > pc : [<c02c123c>] lr : [<c02c2d1c>] psr: a0000013 > sp : de049e10 ip : c06efba0 fp : de6d2092 > r10: bf01a260 r9 : ffffffff r8 : 74706164 > r7 : 0000ffff r6 : ffffffff r5 : de6d209c r4 : 00000000 > r3 : ff0a0004 r2 : 74706164 r1 : ffffffff r0 : 74706164 > Flags: NzCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment user > Control: 10c5387d Table: 9e530019 DAC: 00000015 > Process cat (pid: 1635, stack limit = 0xde048240) > Stack: (0xde049e10 to 0xde04a000) > 9e00: de6d2092 00000002 bf01a25e de6d209c > 9e20: de049e80 c02c438c 0000000a ff0a0004 ffffffff 00000000 00000000 de049e48 > 9e40: 00000000 2192df6d ff0a0004 ffffffff 00000000 de6d2092 de049ef8 bef3cc00 > 9e60: de6b0000 dc358000 de6d2000 00000000 00000003 c02c45a4 bf01790c bf01a254 > 9e80: 74706164 bf018698 00000000 de59c3c0 de048000 de049f80 00001000 bef3cc00 > 9ea0: 00000008 00000000 00000000 00000000 00000000 00000000 00000000 00000000 > 9ec0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 > 9ee0: 00000000 00000000 00000000 00000001 00000000 00000000 6669776d 20786569 > 9f00: 20302e31 2e343128 392e3636 3231702e 00202933 00000000 00000003 c0294898 > 9f20: 00000000 00000000 00000000 00000000 de59c3c0 c0107c04 de554000 de59c3c0 > 9f40: 00001000 bef3cc00 de049f80 bef3cc00 de049f80 00000000 00000003 c0108a00 > 9f60: de048000 de59c3c0 00000000 00000000 de59c3c0 00001000 bef3cc00 c0108b60 > 9f80: 00000000 00000000 00001000 bef3cc00 00000003 00000003 c0014128 de048000 > 9fa0: 00000000 c0013f80 00001000 bef3cc00 00000003 bef3cc00 00001000 00000000 > 9fc0: 00001000 bef3cc00 00000003 00000003 00000001 00000001 00000001 00000003 > 9fe0: 00000000 bef3cbdc 00011984 b6f1127c 60000010 00000003 18dbdd2c 7f7bfffd > [<c02c123c>] (strnlen+0xc/0x4c) from [<c02c2d1c>] (string+0x3c/0xf8) > [<c02c2d1c>] (string+0x3c/0xf8) from [<c02c438c>] (vsnprintf+0x1e8/0x3e8) > [<c02c438c>] (vsnprintf+0x1e8/0x3e8) from [<c02c45a4>] (sprintf+0x18/0x24) > [<c02c45a4>] (sprintf+0x18/0x24) from [<bf01790c>] (mwifiex_info_read+0xfc/0x3e8 [mwifiex]) > [<bf01790c>] (mwifiex_info_read+0xfc/0x3e8 [mwifiex]) from [<c0108a00>] (vfs_read+0xb0/0x144) > [<c0108a00>] (vfs_read+0xb0/0x144) from [<c0108b60>] (SyS_read+0x44/0x70) > [<c0108b60>] (SyS_read+0x44/0x70) from [<c0013f80>] (ret_fast_syscall+0x0/0x30) > Code: e12fff1e e3510000 e1a02000 0a00000d (e5d03000) > ---[ end trace ca98273dc605a04f ]--- > > The panic is caused by the mwifiex_info_read() routine assuming that > there can only be four modes (0-3) which is an invalid assumption. > For example, when testing P2P, the mode is '8' (P2P_CLIENT) so the > code accesses data beyond the bounds of the bss_modes[] array which > causes the panic. Fix this by updating bss_modes[] to support the > current list of modes and adding a check to prevent the out-of-bounds > access from occuring in the future when more modes are added. > > Signed-off-by: Mark A. Greer <mgreer@xxxxxxxxxxxxxxx> Acked-by: Bing Zhao <bzhao@xxxxxxxxxxx> Hi John, This patch is for 3.10. Thanks, Bing -- To unsubscribe from this list: send the line "unsubscribe linux-wireless" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
