From: Kalle Valo <kvalo@codeaurora.org>
To: zhichen@codeaurora.org
Cc: ath10k@lists.infradead.org, linux-wireless@vger.kernel.org,
Zhi Chen <zhichen@codeaurora.org>
Subject: Re: [PATCH v1 1/2] ath10k: fix peer stats null pointer dereference
Date: Thu, 20 Dec 2018 17:09:10 +0000 (UTC) [thread overview]
Message-ID: <20181220170910.9095060595@smtp.codeaurora.org> (raw)
In-Reply-To: <1544497705-21593-1-git-send-email-zhichen@codeaurora.org>
zhichen@codeaurora.org wrote:
> There was a race condition in SMP that an ath10k_peer was created but its
> member sta was null. Following are procedures of ath10k_peer creation and
> member sta access in peer statistics path.
>
> 1. Peer creation:
> ath10k_peer_create()
> =>ath10k_wmi_peer_create()
> =>ath10k_wait_for_peer_created()
> ...
>
> # another kernel path, RX from firmware
> ath10k_htt_t2h_msg_handler()
> =>ath10k_peer_map_event()
> =>wake_up()
> # ar->peer_map[id] = peer //add peer to map
>
> #wake up original path from waiting
> ...
> # peer->sta = sta //sta assignment
>
> 2. RX path of statistics
> ath10k_htt_t2h_msg_handler()
> =>ath10k_update_per_peer_tx_stats()
> =>ath10k_htt_fetch_peer_stats()
> # peer->sta //sta accessing
>
> Any access of peer->sta after peer was added to peer_map but before sta was
> assigned could cause a null pointer issue. And because these two steps are
> asynchronous, no proper lock can protect them. So both peer and sta need to
> be checked before access.
>
> Tested: QCA9984 with firmware ver 10.4-3.9.0.1-00005
> Signed-off-by: Zhi Chen <zhichen@codeaurora.org>
> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2 patches applied to ath-next branch of ath.git, thanks.
2d3b55853b12 ath10k: fix peer stats null pointer dereference
386f97e3b201 ath10k: fix tx_stats memory leak
--
https://patchwork.kernel.org/patch/10722983/
https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches
prev parent reply other threads:[~2018-12-20 17:09 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-12-11 3:08 [PATCH v1 1/2] ath10k: fix peer stats null pointer dereference zhichen
2018-12-11 3:08 ` zhichen
2018-12-11 3:08 ` [PATCH v1 2/2] ath10k: fix tx_stats memory leak zhichen
2018-12-11 3:08 ` zhichen
2018-12-20 17:09 ` [PATCH v1 1/2] ath10k: fix peer stats null pointer dereference Kalle Valo
2018-12-20 17:09 ` Kalle Valo [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20181220170910.9095060595@smtp.codeaurora.org \
--to=kvalo@codeaurora.org \
--cc=ath10k@lists.infradead.org \
--cc=linux-wireless@vger.kernel.org \
--cc=zhichen@codeaurora.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.