This is a note to let you know that I've just added the patch titled ath10k: fix napi crash during rmmod when probe firmware fails to the 4.9-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: ath10k-fix-napi-crash-during-rmmod-when-probe-firmware-fails.patch and it can be found in the queue-4.9 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable@xxxxxxxxxxxxxxx> know about it. >From 1427228d5869f5804b03d47acfa4a88122572a78 Mon Sep 17 00:00:00 2001 From: Kalle Valo <kvalo@xxxxxxxxxxxxxxxx> Date: Mon, 13 Feb 2017 12:38:39 +0200 Subject: ath10k: fix napi crash during rmmod when probe firmware fails From: Kalle Valo <kvalo@xxxxxxxxxxxxxxxx> commit 1427228d5869f5804b03d47acfa4a88122572a78 upstream. This fixes the below crash when ath10k probe firmware fails, NAPI polling tries to access a rx ring resource which was never allocated. An easy way to reproduce this is easy to remove all the firmware files, load ath10k modules and ath10k will crash when calling 'rmmod ath10k_pci'. The fix is to call napi_enable() from ath10k_pci_hif_start() so that it matches with napi_disable() being called from ath10k_pci_hif_stop(). Big thanks to Mohammed Shafi Shajakhan who debugged this and provided first version of the fix. In this patch I just fix the actual problem in pci.c instead of having a workaround in core.c. BUG: unable to handle kernel NULL pointer dereference at (null) IP: __ath10k_htt_rx_ring_fill_n+0x19/0x230 [ath10k_core] __ath10k_htt_rx_ring_fill_n+0x19/0x230 [ath10k_core] Call Trace: [<ffffffffa113ec62>] ath10k_htt_rx_msdu_buff_replenish+0x42/0x90 [ath10k_core] [<ffffffffa113f393>] ath10k_htt_txrx_compl_task+0x433/0x17d0 [ath10k_core] [<ffffffff8114406d>] ? __wake_up_common+0x4d/0x80 [<ffffffff811349ec>] ? cpu_load_update+0xdc/0x150 [<ffffffffa119301d>] ? ath10k_pci_read32+0xd/0x10 [ath10k_pci] [<ffffffffa1195b17>] ath10k_pci_napi_poll+0x47/0x110 [ath10k_pci] [<ffffffff817863af>] net_rx_action+0x20f/0x370 Reported-by: Ben Greear <greearb@xxxxxxxxxxxxxxx> Fixes: 3c97f5de1f28 ("ath10k: implement NAPI support") Signed-off-by: Kalle Valo <kvalo@xxxxxxxxxxxxxxxx> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> --- drivers/net/wireless/ath/ath10k/pci.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) --- a/drivers/net/wireless/ath/ath10k/pci.c +++ b/drivers/net/wireless/ath/ath10k/pci.c @@ -1647,6 +1647,8 @@ static int ath10k_pci_hif_start(struct a ath10k_dbg(ar, ATH10K_DBG_BOOT, "boot hif start\n"); + napi_enable(&ar->napi); + ath10k_pci_irq_enable(ar); ath10k_pci_rx_post(ar); @@ -2531,7 +2533,6 @@ static int ath10k_pci_hif_power_up(struc ath10k_err(ar, "could not wake up target CPU: %d\n", ret); goto err_ce; } - napi_enable(&ar->napi); return 0; Patches currently in stable-queue which might be from kvalo@xxxxxxxxxxxxxxxx are queue-4.9/ath10k-fix-napi-crash-during-rmmod-when-probe-firmware-fails.patch