Re: [PATCH wireless-next] wifi: brcmfmac: fix crash while sending Action Frames in standalone AP Mode

On 10/10/2025 8:35 PM, Richard Reigh wrote:
> On Thu, Oct 9, 2025 at 2:41 AM Gokul Sivakumar
> <[email protected]> wrote:
>>
>> Currently, whenever there is a need to transmit an Action frame,
>> the brcmfmac driver always uses the P2P vif to send the "actframe" IOVAR to
>> firmware. The P2P interfaces were available when wpa_supplicant is managing
>> the wlan interface.
>>
>> However, the P2P interfaces are not created/initialized when only hostapd
>> is managing the wlan interface. And if hostapd receives an ANQP Query REQ
>> Action frame even from an un-associated STA, the brcmfmac driver tries
>> to use an uninitialized P2P vif pointer for sending the IOVAR to firmware.
>> This NULL pointer dereferencing triggers a driver crash.

[...]

>> +bool brcmf_p2p_send_action_frame(struct brcmf_if *ifp,
>>                                   struct brcmf_fil_af_params_le *af_params);
>>   bool brcmf_p2p_scan_finding_common_channel(struct brcmf_cfg80211_info *cfg,
>>                                             struct brcmf_bss_info_le *bi);
>>
>> base-commit: 94aced6ed9e2630bae0b5631e384a5302c4b6783
>> --
>> 2.25.1
> 
> 
> Hi Gokul,
> 
> I tested your patch on Raspberry Pi Zero 2 W with kernel 6.1.21-v8+
> and can confirm it fixes the crash. The iPhone now successfully
> queries network information without causing a NULL pointer
> dereference.
> 
> Tested-by: Richard Reigh <[email protected]>

Hi Richard,

Thanks for testing the patch.

Regards,
Arend