Re: [PATCH v2] brcmfmac: Fix NULL pointer dereference in P2P action frame handling

Arend van Spriel <[email protected]> Sun, 12 Oct 2025 08:12:21 +0200
Newsgroups dev.linux.lists.brcm80211,org.kernel.vger.linux-wireless
Message-ID <[email protected]>
On 10/7/2025 1:13 AM, Richard Reigh wrote:
> When iPhones query network information via the WiFi settings "i" button,
> the brcmfmac driver crashes with a NULL pointer dereference. This occurs
> because the P2P device vif is not initialized when handling certain action
> frames.
> 
> Added an early check in brcmf_cfg80211_mgmt_tx() to verify P2P device vif
> availability before attepting to send action frames. Also added a defensive
> check in brcmf_p2p_tx_action_frame() as a safety net.
> 
> Tested on Raspberry Pi Zero 2 W with kernel 6.1.21-v8+

Hi, Richard

Thanks for sending the patch and putting us on the right track to fix 
this issue. Very much appreciated. As you may agree the proposed fix 
from Gokul is preferred. So I will drop this patch.

Regards,
Arend