From: Felix Fietkau <nbd@nbd.name>
To: Kalle Valo <kvalo@codeaurora.org>,
Shuah Khan <skhan@linuxfoundation.org>
Cc: davem@davemloft.net, kuba@kernel.org,
ath9k-devel@qca.qualcomm.com, linux-wireless@vger.kernel.org,
netdev@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: Re: [PATCH 2/2] ath9k: fix ath_tx_process_buffer() potential null ptr dereference
Date: Tue, 16 Feb 2021 08:53:51 +0100 [thread overview]
Message-ID: <0fd9a538-e269-e10e-a7f9-02d4c5848420@nbd.name> (raw)
In-Reply-To: <20210216070336.D138BC43463@smtp.codeaurora.org>
On 2021-02-16 08:03, Kalle Valo wrote:
> Shuah Khan <skhan@linuxfoundation.org> wrote:
>
>> ath_tx_process_buffer() references ieee80211_find_sta_by_ifaddr()
>> return pointer (sta) outside null check. Fix it by moving the code
>> block under the null check.
>>
>> This problem was found while reviewing code to debug RCU warn from
>> ath10k_wmi_tlv_parse_peer_stats_info() and a subsequent manual audit
>> of other callers of ieee80211_find_sta_by_ifaddr() that don't hold
>> RCU read lock.
>>
>> Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
>> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
>
> Patch applied to ath-next branch of ath.git, thanks.
>
> a56c14bb21b2 ath9k: fix ath_tx_process_buffer() potential null ptr dereference
I just took another look at this patch, and it is completely bogus.
Not only does the stated reason not make any sense (sta is simply passed
to other functions, not dereferenced without checks), but this also
introduces a horrible memory leak by skipping buffer completion if sta
is NULL.
Please drop it, the code is fine as-is.
- Felix
next prev parent reply other threads:[~2021-02-16 7:54 UTC|newest]
Thread overview: 15+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <cover.1613090339.git.skhan@linuxfoundation.org>
2021-02-12 2:13 ` [PATCH 1/2] ath9k: hold RCU lock when calling ieee80211_find_sta_by_ifaddr() Shuah Khan
2021-02-12 2:13 ` [PATCH] mt76: " Shuah Khan
2021-02-12 5:36 ` Felix Fietkau
2021-02-12 17:20 ` Shuah Khan
2021-02-12 2:13 ` [PATCH] rtw88: " Shuah Khan
2021-02-12 6:34 ` Felix Fietkau
2021-02-12 6:31 ` [PATCH 1/2] ath9k: " Felix Fietkau
2021-02-12 2:13 ` [PATCH 2/2] ath9k: fix ath_tx_process_buffer() potential null ptr dereference Shuah Khan
2021-02-16 7:03 ` Kalle Valo
2021-02-16 7:53 ` Felix Fietkau [this message]
2021-02-16 15:22 ` Shuah Khan
2021-02-17 7:30 ` Kalle Valo
2021-02-17 14:56 ` Shuah Khan
2021-02-17 20:28 ` Shuah Khan
2021-02-17 21:36 ` Felix Fietkau
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=0fd9a538-e269-e10e-a7f9-02d4c5848420@nbd.name \
--to=nbd@nbd.name \
--cc=ath9k-devel@qca.qualcomm.com \
--cc=davem@davemloft.net \
--cc=kuba@kernel.org \
--cc=kvalo@codeaurora.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-wireless@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=skhan@linuxfoundation.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).