linux-kernel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
To: Ganapathi Bhat <ganapathi.bhat@nxp.com>,
	Brian Norris <briannorris@chromium.org>
Cc: amitkarwar@gmail.com, andreyknvl@google.com, davem@davemloft.net,
	dvyukov@google.com, huxinming820@gmail.com, kvalo@codeaurora.org,
	linux-kernel@vger.kernel.org, linux-usb@vger.kernel.org,
	linux-wireless@vger.kernel.org, netdev@vger.kernel.org,
	nishants@marvell.com, syzkaller-bugs@googlegroups.com,
	syzbot <syzbot+373e6719b49912399d21@syzkaller.appspotmail.com>,
	Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>,
	syzbot <syzbot+dc4127f950da51639216@syzkaller.appspotmail.com>
Subject: [PATCH v2] mwifiex: don't call del_timer_sync() on uninitialized timer
Date: Fri, 21 Aug 2020 17:27:19 +0900	[thread overview]
Message-ID: <20200821082720.7716-1-penguin-kernel@I-love.SAKURA.ne.jp> (raw)
In-Reply-To: <MN2PR18MB2637D7C742BC235FE38367F0A09C0@MN2PR18MB2637.namprd18.prod.outlook.com>

syzbot is reporting that del_timer_sync() is called from
mwifiex_usb_cleanup_tx_aggr() from mwifiex_unregister_dev() without
checking timer_setup() from mwifiex_usb_tx_init() was called [1].

Ganapathi Bhat proposed a possibly cleaner fix, but it seems that
that fix was forgotten [2].

"grep -FrB1 'del_timer' drivers/ | grep -FA1 '.function)'" says that
currently there are 28 locations which call del_timer[_sync]() only if
that timer's function field was initialized (because timer_setup() sets
that timer's function field). Therefore, let's use same approach here.

[1] https://syzkaller.appspot.com/bug?id=26525f643f454dd7be0078423e3cdb0d57744959
[2] https://lkml.kernel.org/r/CA+ASDXMHt2gq9Hy+iP_BYkWXsSreWdp3_bAfMkNcuqJ3K+-jbQ@mail.gmail.com

Reported-by: syzbot <syzbot+dc4127f950da51639216@syzkaller.appspotmail.com>
Cc: Ganapathi Bhat <ganapathi.bhat@nxp.com>
Cc: Brian Norris <briannorris@chromium.org>
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
---
 drivers/net/wireless/marvell/mwifiex/usb.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/net/wireless/marvell/mwifiex/usb.c b/drivers/net/wireless/marvell/mwifiex/usb.c
index 6f3cfde4654c..426e39d4ccf0 100644
--- a/drivers/net/wireless/marvell/mwifiex/usb.c
+++ b/drivers/net/wireless/marvell/mwifiex/usb.c
@@ -1353,7 +1353,8 @@ static void mwifiex_usb_cleanup_tx_aggr(struct mwifiex_adapter *adapter)
 				skb_dequeue(&port->tx_aggr.aggr_list)))
 				mwifiex_write_data_complete(adapter, skb_tmp,
 							    0, -1);
-		del_timer_sync(&port->tx_aggr.timer_cnxt.hold_timer);
+		if (port->tx_aggr.timer_cnxt.hold_timer.function)
+			del_timer_sync(&port->tx_aggr.timer_cnxt.hold_timer);
 		port->tx_aggr.timer_cnxt.is_hold_timer_set = false;
 		port->tx_aggr.timer_cnxt.hold_tmo_msecs = 0;
 	}
-- 
2.18.4


  parent reply	other threads:[~2020-08-21  8:27 UTC|newest]

Thread overview: 20+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2019-04-12 14:26 INFO: trying to register non-static key in del_timer_sync (2) syzbot
2019-06-01 17:52 ` [EXT] " Ganapathi Bhat
2019-06-03  5:20   ` Dmitry Vyukov
2019-06-03  8:41     ` Ganapathi Bhat
2019-06-12 16:01       ` Ganapathi Bhat
2019-06-12 16:13         ` Andrey Konovalov
2019-06-12 16:59           ` syzbot
2019-08-13 13:36         ` [EXT] " Andrey Konovalov
2019-08-13 13:58           ` Kalle Valo
2019-08-14 14:08             ` Ganapathi Bhat
2019-10-01 16:40               ` Andrey Konovalov
2019-10-02 14:28                 ` Ganapathi Bhat
2020-07-28  1:44                   ` [PATCH] mwifiex: don't call del_timer_sync() on uninitialized timer Tetsuo Handa
2020-07-28 17:29                     ` Andy Shevchenko
2020-07-28 18:45                     ` Brian Norris
2020-08-17 13:06                       ` Tetsuo Handa
2020-08-21  8:27                   ` Tetsuo Handa [this message]
2020-08-24 18:52                     ` [PATCH v2] " Brian Norris
2020-08-27  4:50                       ` [EXT] " Ganapathi Bhat
2020-08-27 10:00                     ` Kalle Valo

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20200821082720.7716-1-penguin-kernel@I-love.SAKURA.ne.jp \
    --to=penguin-kernel@i-love.sakura.ne.jp \
    --cc=amitkarwar@gmail.com \
    --cc=andreyknvl@google.com \
    --cc=briannorris@chromium.org \
    --cc=davem@davemloft.net \
    --cc=dvyukov@google.com \
    --cc=ganapathi.bhat@nxp.com \
    --cc=huxinming820@gmail.com \
    --cc=kvalo@codeaurora.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-usb@vger.kernel.org \
    --cc=linux-wireless@vger.kernel.org \
    --cc=netdev@vger.kernel.org \
    --cc=nishants@marvell.com \
    --cc=syzbot+373e6719b49912399d21@syzkaller.appspotmail.com \
    --cc=syzbot+dc4127f950da51639216@syzkaller.appspotmail.com \
    --cc=syzkaller-bugs@googlegroups.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).