Re: [PATCH wireless-next] wifi: brcmfmac: fix crash while sending Action Frames in standalone AP Mode

Arend van Spriel <[email protected]> Sun, 12 Oct 2025 08:14:24 +0200
Newsgroups dev.linux.lists.brcm80211,org.kernel.vger.linux-wireless
Message-ID <[email protected]>
On 10/9/2025 9:39 AM, Gokul Sivakumar wrote:
> Currently, whenever there is a need to transmit an Action frame,
> the brcmfmac driver always uses the P2P vif to send the "actframe" IOVAR to
> firmware. The P2P interfaces were available when wpa_supplicant is managing
> the wlan interface.
> 
> However, the P2P interfaces are not created/initialized when only hostapd
> is managing the wlan interface. And if hostapd receives an ANQP Query REQ
> Action frame even from an un-associated STA, the brcmfmac driver tries
> to use an uninitialized P2P vif pointer for sending the IOVAR to firmware.
> This NULL pointer dereferencing triggers a driver crash.

Hi Gokul,

One more thing. I think the crash warrants that this patch is submitted 
against the wireless tree iso wireless-next.

Gr. AvS