From: Kalle Valo <kvalo@kernel.org>
To: Xiaomeng Tong <xiam0nd.tong@gmail.com>
Cc: davem@davemloft.net, kuba@kernel.org, pabeni@redhat.com,
linville@tuxdriver.com, linux-wireless@vger.kernel.org,
netdev@vger.kernel.org, linux-kernel@vger.kernel.org,
Xiaomeng Tong <xiam0nd.tong@gmail.com>,
stable@vger.kernel.org
Subject: Re: [PATCH v2] carl9170: tx: fix an incorrect use of list iterator
Date: Mon, 2 May 2022 14:00:52 +0000 (UTC) [thread overview]
Message-ID: <165150005048.16977.15575451697134497197.kvalo@kernel.org> (raw)
In-Reply-To: <20220328122820.1004-1-xiam0nd.tong@gmail.com>
Xiaomeng Tong <xiam0nd.tong@gmail.com> wrote:
> If the previous list_for_each_entry_continue_rcu() don't exit early
> (no goto hit inside the loop), the iterator 'cvif' after the loop
> will be a bogus pointer to an invalid structure object containing
> the HEAD (&ar->vif_list). As a result, the use of 'cvif' after that
> will lead to a invalid memory access (i.e., 'cvif->id': the invalid
> pointer dereference when return back to/after the callsite in the
> carl9170_update_beacon()).
>
> The original intention should have been to return the valid 'cvif'
> when found in list, NULL otherwise. So just return NULL when no
> entry found, to fix this bug.
>
> Cc: stable@vger.kernel.org
> Fixes: 1f1d9654e183c ("carl9170: refactor carl9170_update_beacon")
> Signed-off-by: Xiaomeng Tong <xiam0nd.tong@gmail.com>
> Acked-by: Christian Lamparter <chunkeey@gmail.com>
> Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
Patch applied to ath-next branch of ath.git, thanks.
54a6f29522da carl9170: tx: fix an incorrect use of list iterator
--
https://patchwork.kernel.org/project/linux-wireless/patch/20220328122820.1004-1-xiam0nd.tong@gmail.com/
https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches
next prev parent reply other threads:[~2022-05-02 14:01 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-03-28 12:28 [PATCH v2] carl9170: tx: fix an incorrect use of list iterator Xiaomeng Tong
2022-04-05 8:10 ` Kalle Valo
2022-05-01 9:37 ` Christian Lamparter
2022-05-02 14:00 ` Kalle Valo [this message]
-- strict thread matches above, loose matches on Subject: below --
2022-03-28 12:17 Xiaomeng Tong
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=165150005048.16977.15575451697134497197.kvalo@kernel.org \
--to=kvalo@kernel.org \
--cc=davem@davemloft.net \
--cc=kuba@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-wireless@vger.kernel.org \
--cc=linville@tuxdriver.com \
--cc=netdev@vger.kernel.org \
--cc=pabeni@redhat.com \
--cc=stable@vger.kernel.org \
--cc=xiam0nd.tong@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.