From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Venkateswara Naralasetty <vnaralas@codeaurora.org>,
Kalle Valo <kvalo@codeaurora.org>,
Sasha Levin <sashal@kernel.org>,
ath10k@lists.infradead.org, linux-wireless@vger.kernel.org,
netdev@vger.kernel.org
Subject: [PATCH AUTOSEL 5.7 092/274] ath10k: fix kernel null pointer dereference
Date: Mon, 8 Jun 2020 19:03:05 -0400 [thread overview]
Message-ID: <20200608230607.3361041-92-sashal@kernel.org> (raw)
In-Reply-To: <20200608230607.3361041-1-sashal@kernel.org>
From: Venkateswara Naralasetty <vnaralas@codeaurora.org>
[ Upstream commit acb31476adc9ff271140cdd4d3c707ff0c97f5a4 ]
Currently sta airtime is updated without any lock in case of
host based airtime calculation. Which may result in accessing the
invalid sta pointer in case of continuous station connect/disconnect.
This patch fix the kernel null pointer dereference by updating the
station airtime with proper RCU lock in case of host based airtime
calculation.
Proceeding with the analysis of "ARM Kernel Panic".
The APSS crash happened due to OOPS on CPU 0.
Crash Signature : Unable to handle kernel NULL pointer dereference
at virtual address 00000300
During the crash,
PC points to "ieee80211_sta_register_airtime+0x1c/0x448 [mac80211]"
LR points to "ath10k_txrx_tx_unref+0x17c/0x364 [ath10k_core]".
The Backtrace obtained is as follows:
[<bf880238>] (ieee80211_sta_register_airtime [mac80211]) from
[<bf945a38>] (ath10k_txrx_tx_unref+0x17c/0x364 [ath10k_core])
[<bf945a38>] (ath10k_txrx_tx_unref [ath10k_core]) from
[<bf9428e4>] (ath10k_htt_txrx_compl_task+0xa50/0xfc0 [ath10k_core])
[<bf9428e4>] (ath10k_htt_txrx_compl_task [ath10k_core]) from
[<bf9b9bc8>] (ath10k_pci_napi_poll+0x50/0xf8 [ath10k_pci])
[<bf9b9bc8>] (ath10k_pci_napi_poll [ath10k_pci]) from
[<c059e3b0>] (net_rx_action+0xac/0x160)
[<c059e3b0>] (net_rx_action) from [<c02329a4>] (__do_softirq+0x104/0x294)
[<c02329a4>] (__do_softirq) from [<c0232b64>] (run_ksoftirqd+0x30/0x90)
[<c0232b64>] (run_ksoftirqd) from [<c024e358>] (smpboot_thread_fn+0x25c/0x274)
[<c024e358>] (smpboot_thread_fn) from [<c02482fc>] (kthread+0xd8/0xec)
Tested HW: QCA9888
Tested FW: 10.4-3.10-00047
Signed-off-by: Venkateswara Naralasetty <vnaralas@codeaurora.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/1585736290-17661-1-git-send-email-vnaralas@codeaurora.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/ath/ath10k/txrx.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/net/wireless/ath/ath10k/txrx.c b/drivers/net/wireless/ath/ath10k/txrx.c
index 39abf8b12903..f46b9083bbf1 100644
--- a/drivers/net/wireless/ath/ath10k/txrx.c
+++ b/drivers/net/wireless/ath/ath10k/txrx.c
@@ -84,9 +84,11 @@ int ath10k_txrx_tx_unref(struct ath10k_htt *htt,
wake_up(&htt->empty_tx_wq);
spin_unlock_bh(&htt->tx_lock);
+ rcu_read_lock();
if (txq && txq->sta && skb_cb->airtime_est)
ieee80211_sta_register_airtime(txq->sta, txq->tid,
skb_cb->airtime_est, 0);
+ rcu_read_unlock();
if (ar->bus_param.dev_type != ATH10K_DEV_TYPE_HL)
dma_unmap_single(dev, skb_cb->paddr, msdu->len, DMA_TO_DEVICE);
--
2.25.1
next prev parent reply other threads:[~2020-06-09 1:00 UTC|newest]
Thread overview: 36+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <20200608230607.3361041-1-sashal@kernel.org>
2020-06-08 23:01 ` [PATCH AUTOSEL 5.7 002/274] ath10k: Fix the race condition in firmware dump work queue Sasha Levin
2020-06-08 23:01 ` [PATCH AUTOSEL 5.7 003/274] ath9x: Fix stack-out-of-bounds Write in ath9k_hif_usb_rx_cb Sasha Levin
2020-06-08 23:01 ` [PATCH AUTOSEL 5.7 004/274] ath9k: Fix use-after-free Write in ath9k_htc_rx_msg Sasha Levin
2020-06-08 23:01 ` [PATCH AUTOSEL 5.7 005/274] ath9k: Fix use-after-free Read in htc_connect_service Sasha Levin
2020-06-08 23:02 ` [PATCH AUTOSEL 5.7 031/274] ath10k: remove the max_sched_scan_reqs value Sasha Levin
2020-06-08 23:02 ` [PATCH AUTOSEL 5.7 035/274] rtw88: fix an issue about leak system resources Sasha Levin
2020-06-08 23:02 ` [PATCH AUTOSEL 5.7 044/274] mt76: mt7615: fix aid configuration in mt7615_mcu_wtbl_generic_tlv Sasha Levin
2020-06-08 23:02 ` [PATCH AUTOSEL 5.7 058/274] ath11k: Fix some resource leaks in error path in 'ath11k_thermal_register()' Sasha Levin
2020-06-08 23:03 ` [PATCH AUTOSEL 5.7 089/274] ath11k: fix error message to correctly report the command that failed Sasha Levin
2020-06-08 23:03 ` [PATCH AUTOSEL 5.7 091/274] ath11k: Avoid mgmt tx count underflow Sasha Levin
2020-06-08 23:03 ` Sasha Levin [this message]
2020-06-08 23:03 ` [PATCH AUTOSEL 5.7 093/274] ath9k: Fix use-after-free Read in ath9k_wmi_ctrl_rx Sasha Levin
2020-06-08 23:03 ` [PATCH AUTOSEL 5.7 094/274] ath9k: Fix general protection fault in ath9k_hif_usb_rx_cb Sasha Levin
2020-06-08 23:03 ` [PATCH AUTOSEL 5.7 099/274] brcmfmac: fix wrong location to get firmware feature Sasha Levin
2020-06-08 23:03 ` [PATCH AUTOSEL 5.7 113/274] ath10k: add flush tx packets for SDIO chip Sasha Levin
2020-06-08 23:03 ` [PATCH AUTOSEL 5.7 125/274] ath11k: use GFP_ATOMIC under spin lock Sasha Levin
2020-06-08 23:04 ` [PATCH AUTOSEL 5.7 156/274] ath10k: fix possible memory leak in ath10k_bmi_lz_data_large() Sasha Levin
2020-06-08 23:04 ` [PATCH AUTOSEL 5.7 157/274] ath11k: fix error return code in ath11k_dp_alloc() Sasha Levin
2020-06-08 23:04 ` [PATCH AUTOSEL 5.7 162/274] ath11k: fix kernel panic by freeing the msdu received with invalid length Sasha Levin
2020-06-08 23:04 ` [PATCH AUTOSEL 5.7 163/274] ath9k_htc: Silence undersized packet warnings Sasha Levin
2020-06-08 23:04 ` [PATCH AUTOSEL 5.7 164/274] libertas_tf: avoid a null dereference in pointer priv Sasha Levin
2020-06-08 23:04 ` [PATCH AUTOSEL 5.7 179/274] iwlwifi: avoid debug max amsdu config overwriting itself Sasha Levin
2020-06-08 23:04 ` [PATCH AUTOSEL 5.7 184/274] ath10k: Skip handling del_server during driver exit Sasha Levin
2020-06-08 23:04 ` [PATCH AUTOSEL 5.7 185/274] ath10k: Remove msdu from idr when management pkt send fails Sasha Levin
2020-06-08 23:04 ` [PATCH AUTOSEL 5.7 186/274] wcn36xx: Fix error handling path in 'wcn36xx_probe()' Sasha Levin
2020-06-08 23:04 ` [PATCH AUTOSEL 5.7 190/274] mt76: mt7663: fix mt7615_mac_cca_stats_reset routine Sasha Levin
2020-06-08 23:04 ` [PATCH AUTOSEL 5.7 191/274] mt76: mt7615: do not always reset the dfs state setting the channel Sasha Levin
2020-06-08 23:04 ` [PATCH AUTOSEL 5.7 192/274] mt76: mt7622: fix DMA unmap length Sasha Levin
2020-06-08 23:04 ` [PATCH AUTOSEL 5.7 193/274] mt76: mt7663: " Sasha Levin
2020-06-08 23:04 ` [PATCH AUTOSEL 5.7 194/274] mt76: mt7615: fix mt7615_firmware_own for mt7663e Sasha Levin
2020-06-08 23:04 ` [PATCH AUTOSEL 5.7 195/274] mt76: mt7615: fix mt7615_driver_own routine Sasha Levin
2020-06-08 23:04 ` [PATCH AUTOSEL 5.7 196/274] mt76: avoid rx reorder buffer overflow Sasha Levin
2020-06-08 23:04 ` [PATCH AUTOSEL 5.7 198/274] brcmfmac: fix WPA/WPA2-PSK 4-way handshake offload and SAE offload failures Sasha Levin
2020-06-08 23:05 ` [PATCH AUTOSEL 5.7 210/274] rtlwifi: Fix a double free in _rtl_usb_tx_urb_setup() Sasha Levin
2020-06-08 23:05 ` [PATCH AUTOSEL 5.7 211/274] mwifiex: Fix memory corruption in dump_station Sasha Levin
2020-06-08 23:05 ` [PATCH AUTOSEL 5.7 253/274] iwlwifi: mvm: fix aux station leak Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200608230607.3361041-92-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=ath10k@lists.infradead.org \
--cc=kvalo@codeaurora.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-wireless@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=stable@vger.kernel.org \
--cc=vnaralas@codeaurora.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).