lkml.org 
[lkml]   [2022]   [Jan]   [24]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.15 571/846] ath9k_htc: fix NULL pointer dereference at ath9k_htc_tx_get_packet()
    Date
    From: Tetsuo Handa <penguin-kernel@i-love.sakura.ne.jp>

    [ Upstream commit 8b3046abc99eefe11438090bcc4ec3a3994b55d0 ]

    syzbot is reporting lockdep warning at ath9k_wmi_event_tasklet() followed
    by kernel panic at get_htc_epid_queue() from ath9k_htc_tx_get_packet() from
    ath9k_htc_txstatus() [1], for ath9k_wmi_event_tasklet(WMI_TXSTATUS_EVENTID)
    depends on spin_lock_init() from ath9k_init_priv() being already completed.

    Since ath9k_wmi_event_tasklet() is set by ath9k_init_wmi() from
    ath9k_htc_probe_device(), it is possible that ath9k_wmi_event_tasklet() is
    called via tasklet interrupt before spin_lock_init() from ath9k_init_priv()
    from ath9k_init_device() from ath9k_htc_probe_device() is called.

    Let's hold ath9k_wmi_event_tasklet(WMI_TXSTATUS_EVENTID) no-op until
    ath9k_tx_init() completes.

    Link: https://syzkaller.appspot.com/bug?extid=31d54c60c5b254d6f75b [1]
    Reported-by: syzbot <syzbot+31d54c60c5b254d6f75b@syzkaller.appspotmail.com>
    Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
    Tested-by: syzbot <syzbot+31d54c60c5b254d6f75b@syzkaller.appspotmail.com>
    Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
    Link: https://lore.kernel.org/r/77b76ac8-2bee-6444-d26c-8c30858b8daa@i-love.sakura.ne.jp
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/net/wireless/ath/ath9k/htc.h | 1 +
    drivers/net/wireless/ath/ath9k/htc_drv_txrx.c | 5 +++++
    drivers/net/wireless/ath/ath9k/wmi.c | 4 ++++
    3 files changed, 10 insertions(+)

    diff --git a/drivers/net/wireless/ath/ath9k/htc.h b/drivers/net/wireless/ath/ath9k/htc.h
    index 4f71e962279af..6b45e63fae4ba 100644
    --- a/drivers/net/wireless/ath/ath9k/htc.h
    +++ b/drivers/net/wireless/ath/ath9k/htc.h
    @@ -306,6 +306,7 @@ struct ath9k_htc_tx {
    DECLARE_BITMAP(tx_slot, MAX_TX_BUF_NUM);
    struct timer_list cleanup_timer;
    spinlock_t tx_lock;
    + bool initialized;
    };

    struct ath9k_htc_tx_ctl {
    diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c b/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c
    index e7a21eaf3a68d..6a850a0bfa8ad 100644
    --- a/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c
    +++ b/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c
    @@ -813,6 +813,11 @@ int ath9k_tx_init(struct ath9k_htc_priv *priv)
    skb_queue_head_init(&priv->tx.data_vi_queue);
    skb_queue_head_init(&priv->tx.data_vo_queue);
    skb_queue_head_init(&priv->tx.tx_failed);
    +
    + /* Allow ath9k_wmi_event_tasklet(WMI_TXSTATUS_EVENTID) to operate. */
    + smp_wmb();
    + priv->tx.initialized = true;
    +
    return 0;
    }

    diff --git a/drivers/net/wireless/ath/ath9k/wmi.c b/drivers/net/wireless/ath/ath9k/wmi.c
    index fe29ad4b9023c..f315c54bd3ac0 100644
    --- a/drivers/net/wireless/ath/ath9k/wmi.c
    +++ b/drivers/net/wireless/ath/ath9k/wmi.c
    @@ -169,6 +169,10 @@ void ath9k_wmi_event_tasklet(struct tasklet_struct *t)
    &wmi->drv_priv->fatal_work);
    break;
    case WMI_TXSTATUS_EVENTID:
    + /* Check if ath9k_tx_init() completed. */
    + if (!data_race(priv->tx.initialized))
    + break;
    +
    spin_lock_bh(&priv->tx.tx_lock);
    if (priv->tx.flags & ATH9K_HTC_OP_TX_DRAIN) {
    spin_unlock_bh(&priv->tx.tx_lock);
    --
    2.34.1


    \
     
     \ /
      Last update: 2022-01-24 22:41    [W:7.678 / U:0.000 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site