Re: [PATCH wireless-next] wifi: brcmfmac: fix crash while sending Action Frames in standalone AP Mode
Arend van Spriel <[email protected]> Sun, 12 Oct 2025 08:14:24 +0200
| Newsgroups | dev.linux.lists.brcm80211,org.kernel.vger.linux-wireless |
|---|---|
| Message-ID | <[email protected]> |
On 10/9/2025 9:39 AM, Gokul Sivakumar wrote: > Currently, whenever there is a need to transmit an Action frame, > the brcmfmac driver always uses the P2P vif to send the "actframe" IOVAR to > firmware. The P2P interfaces were available when wpa_supplicant is managing > the wlan interface. > > However, the P2P interfaces are not created/initialized when only hostapd > is managing the wlan interface. And if hostapd receives an ANQP Query REQ > Action frame even from an un-associated STA, the brcmfmac driver tries > to use an uninitialized P2P vif pointer for sending the IOVAR to firmware. > This NULL pointer dereferencing triggers a driver crash. Hi Gokul, One more thing. I think the crash warrants that this patch is submitted against the wireless tree iso wireless-next. Gr. AvS