mwifiex causes kernel oops when AP mode is enabled

[Jesse Sung]

When it's in AP mode, there's quite a chance to find kernel oops during reboot.

This is caused by the wiphy may be NULL for some reason. It's likely a bug in mwifiex. We've already pinged Marvell and Murata. Before there's a real fix available, we should check wiphy before accessing it.

I've tried a 4.13-rc6 kernel. Though it has oops for NULL pointer deference too, it happens in a different function in mwifiex. Thus the workaround for Xenial may or may not help for other series. Will need to reproduce this issue with Zesty and then we can decide whether this workaround should be applied to Zesty.

[ 30.701441] BUG: unable to handle kernel NULL pointer dereference at 00000000000000f0
[ 30.709511] IP: [<ffffffffc05781b9>] mwifiex_get_cfp+0x49/0x150 [mwifiex]
[ 30.716494] PGD 0
[ 30.718575] Oops: 0000 [#1] SMP
[ 30.721918] Modules linked in: ipt_MASQUERADE nf_nat_masquerade_ipv4 iptable_nat nf_conntrack_ipv4 nf_defrag_ipv4 nf_nat_ipv4 nf_nat nf_conni
[ 30.836915] CPU: 1 PID: 679 Comm: kworker/u5:0 Not tainted 4.4.0-57-generic #78-Ubuntu
[ 30.845018] Hardware name: Dell Inc. Edge Gateway 5000/ , BIOS 01.05.00 10/18/2016
[ 30.853218] Workqueue: MWIFIEX_WORK_QUEUE mwifiex_main_work_queue [mwifiex]
[ 30.860362] task: ffff880077c11980 ti: ffff880075e48000 task.ti: ffff880075e48000
[ 30.868018] RIP: 0010:[<ffffffffc05781b9>] [<ffffffffc05781b9>] mwifiex_get_cfp+0x49/0x150 [mwifiex]
[ 30.877484] RSP: 0018:ffff880075e4bbf8 EFLAGS: 00010202
[ 30.882920] RAX: 0000000000000000 RBX: 0000000000000004 RCX: 0000000000000004
[ 30.890221] RDX: 0010000000110010 RSI: 0000000000000004 RDI: 0000000000000004
[ 30.897520] RBP: ffff880075e4bc28 R08: 0000000000000003 R09: 0000000000000001
[ 30.904821] R10: 0000000000000001 R11: 00000000000002ff R12: 0000000000000095
[ 30.912123] R13: 0000000000000000 R14: ffff880075e40000 R15: 0000000000000095
[ 30.919425] FS: 0000000000000000(0000) GS:ffff880071300000(0000) knlGS:0000000000000000
[ 30.927701] CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b
[ 30.933581] CR2: 00000000000000f0 CR3: 0000000001e0a000 CR4: 00000000001006e0
[ 30.940882] Stack:
[ 30.942944] 0000000000000118 ffff880075e40000 ffff8800750c4000 ffff880075e3ed59
[ 30.950592] 0000000000000095 ffff880075e3ee01 ffff880075e4bcd0 ffffffffc05846fc
[ 30.958232] 0000000000000000 ffff880075e4bc50 ffffffff8140bcb5 ffff880075e4bc70
[ 30.965873] Call Trace:
[ 30.968397] [<ffffffffc05846fc>] mwifiex_parse_single_response_buf+0x1fc/0x560 [mwifiex]
[ 30.976772] [<ffffffff8140bcb5>] ? find_next_bit+0x15/0x20
[ 30.982490] [<ffffffffc0584d9c>] mwifiex_handle_event_ext_scan_report+0x15c/0x340 [mwifiex]
[ 30.991139] [<ffffffffc058f4c6>] mwifiex_process_sta_event+0x276/0xb40 [mwifiex]
[ 30.998806] [<ffffffffc0578952>] mwifiex_process_event+0x102/0x1c0 [mwifiex]
[ 31.006120] [<ffffffffc057677e>] mwifiex_main_process+0x5de/0x8d0 [mwifiex]
[ 31.013346] [<ffffffffc0576a8f>] mwifiex_main_work_queue+0x1f/0x30 [mwifiex]
[ 31.020650] [<ffffffff8109a575>] process_one_work+0x165/0x480
[ 31.026624] [<ffffffff8109a8db>] worker_thread+0x4b/0x4c0
[ 31.032240] [<ffffffff8109a890>] ? process_one_work+0x480/0x480
[ 31.038387] [<ffffffff810a0c08>] kthread+0xd8/0xf0
[ 31.043384] [<ffffffff810a0b30>] ? kthread_create_on_node+0x1e0/0x1e0
[ 31.050071] [<ffffffff8183788f>] ret_from_fork+0x3f/0x70
[ 31.055596] [<ffffffff810a0b30>] ? kthread_create_on_node+0x1e0/0x1e0
[ 31.062276] Code: 85 c9 0f 84 ef 00 00 00 40 0f b6 de 49 89 fe 41 89 cd 89 df 41 89 d4 e8 46 f1 00 00 84 c0 49 8b 86 e0 13 00 00 0f 84 98 00
[ 31.082756] RIP [<ffffffffc05781b9>] mwifiex_get_cfp+0x49/0x150 [mwifiex]
[ 31.089820] RSP <ffff880075e4bbf8>
[ 31.093392] CR2: 00000000000000f0
[ 31.096787] ---[ end trace f3a762be5787f138 ]---

[Kleber Sacilotto de Souza (kleber-souza)]

This bug is awaiting verification that the kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-xenial' to 'verification-done-xenial'. If the problem still exists, change the tag 'verification-needed-xenial' to 'verification-failed-xenial'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux - 4.4.0-96.119

---------------
linux (4.4.0-96.119) xenial; urgency=low

  * linux: 4.4.0-96.119 -proposed tracker (LP: #1716613)

  * kernel panic -not syncing: Fatal exception: panic_on_oops (LP: #1708399)
    - s390/mm: no local TLB flush for clearing-by-ASCE IDTE
    - SAUCE: s390/mm: fix local TLB flushing vs. detach of an mm address space
    - SAUCE: s390/mm: fix race on mm->context.flush_mm

  * CVE-2017-1000251
    - Bluetooth: Properly check L2CAP config option output buffer length

linux (4.4.0-95.118) xenial; urgency=low

  * linux: 4.4.0-95.118 -proposed tracker (LP: #1715651)

  * Xenial update to 4.4.78 stable release broke Address Sanitizer
    (LP: #1715636)
    - mm: revert x86_64 and arm64 ELF_ET_DYN_BASE base changes

linux (4.4.0-94.117) xenial; urgency=low

  * linux: 4.4.0-94.117 -proposed tracker (LP: #1713462)

  * mwifiex causes kernel oops when AP mode is enabled (LP: #1712746)
    - SAUCE: net/wireless: do not dereference invalid pointer
    - SAUCE: mwifiex: do not dereference invalid pointer

  * Backport more recent Broadcom bnxt_en driver (LP: #1711056)
    - SAUCE: bnxt_en_bpo: Import bnxt_en driver version 1.8.1
    - SAUCE: bnxt_en_bpo: Drop distro out-of-tree detection logic
    - SAUCE: bnxt_en_bpo: Remove unnecessary compile flags
    - SAUCE: bnxt_en_bpo: Move config settings to Kconfig
    - SAUCE: bnxt_en_bpo: Remove PCI_IDs handled by the regular driver
    - SAUCE: bnxt_en_bpo: Rename the backport driver to bnxt_en_bpo
    - bnxt_en_bpo: [Config] Enable CONFIG_BNXT_BPO=m

  * HID: multitouch: Support ALPS PTP Stick and Touchpad devices (LP: #1712481)
    - HID: multitouch: Support PTP Stick and Touchpad device
    - SAUCE: HID: multitouch: Support ALPS PTP stick with pid 0x120A

  * igb: Support using Broadcom 54616 as PHY (LP: #1712024)
    - SAUCE: igb: add support for using Broadcom 54616 as PHY

  * IPR driver causes multipath to fail paths/stuck IO on Medium Errors
    (LP: #1682644)
    - scsi: ipr: do not set DID_PASSTHROUGH on CHECK CONDITION

  * accessing /dev/hvc1 with stress-ng on Ubuntu xenial causes crash
    (LP: #1711401)
    - tty/hvc: Use IRQF_SHARED for OPAL hvc consoles

  * memory-hotplug test needs to be fixed (LP: #1710868)
    - selftests: typo correction for memory-hotplug test
    - selftests: check hot-pluggagble memory for memory-hotplug test
    - selftests: check percentage range for memory-hotplug test
    - selftests: add missing test name in memory-hotplug test
    - selftests: fix memory-hotplug test

  * HP lt4132 LTE/HSPA+ 4G Module (03f0:a31d) does not work (LP: #1707643)
    - net: cdc_mbim: apply "NDP to end" quirk to HP lt4132

  * Migrating KSM page causes the VM lock up as the KSM page merging list is too
    large (LP: #1680513)
    - ksm: introduce ksm_max_page_sharing per page deduplication limit
    - ksm: fix use after free with merge_across_nodes = 0
    - ksm: cleanup stable_node chain collapse case
    - ksm: swap the two output parameters of chain/chain_prune
    - ksm: optimize refile of stable_node_dup at the head of the chain

  * sort ABI files with C.UTF-8 locale (LP: #1712345)
    - [Packaging] sort ABI ...