From mboxrd@z Thu Jan 1 00:00:00 1970 Return-path: Received: from smtp.codeaurora.org ([198.145.29.96]) by bombadil.infradead.org with esmtps (Exim 4.90_1 #2 (Red Hat Linux)) id 1ga1Y6-0005yE-0M for ath10k@lists.infradead.org; Thu, 20 Dec 2018 16:51:51 +0000 MIME-Version: 1.0 Subject: Re: [PATCH] ath10k: Fix kernel panic due to use after free From: Kalle Valo In-Reply-To: <1541753646-11533-1-git-send-email-periyasa@codeaurora.org> References: <1541753646-11533-1-git-send-email-periyasa@codeaurora.org> Message-Id: <20181220165139.8CBA6606CF@smtp.codeaurora.org> Date: Thu, 20 Dec 2018 16:51:39 +0000 (UTC) List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: "ath10k" Errors-To: ath10k-bounces+kvalo=adurom.com@lists.infradead.org To: Karthikeyan Periyasamy Cc: linux-wireless@vger.kernel.org, ath10k@lists.infradead.org Karthikeyan Periyasamy wrote: > This issue arise in a race condition between ath10k_sta_state() and > ath10k_htt_fetch_peer_stats(), explained in below scenario > > Steps: > 1. In ath10k_sta_state(), arsta->tx_stats get deallocated before peer deletion > when the station moves from IEEE80211_STA_NONE to IEEE80211_STA_NOTEXIST > state. > 2. Meanwhile ath10k receive HTT_T2H_MSG_TYPE_PEER_STATS message. > In ath10k_htt_fetch_peer_stats(), arsta->tx_stats get accessed after > the peer validation check. > > Since arsta->tx_stats get freed before the peer deletion [1]. > ath10k_htt_fetch_peer_stats() ended up in "use after free" situation. > > Fixed this issue by moving the arsta->tx_stats free handling after the > peer deletion. so that ath10k_htt_fetch_peer_stats() will not end up in > "use after free" situation. > > Kernel Panic: > > Unable to handle kernel NULL pointer dereference at virtual address 00000286 > pgd = d8754000 > [00000286] *pgd=00000000 > Internal error: Oops: 5 [#1] PREEMPT SMP ARM > ... > CPU: 0 PID: 6245 Comm: hostapd Not tainted > task: dc44cac0 ti: d4a38000 task.ti: d4a38000 > PC is at kmem_cache_alloc+0x7c/0x114 > LR is at ath10k_sta_state+0x190/0xd58 [ath10k_core] > pc : [] lr : [] psr: 20000013 > sp : d4a39b88 ip : 00000000 fp : 00000001 > r10: 00000000 r9 : 1d3bc000 r8 : 00000dc0 > r7 : 000080d0 r6 : d4a38000 r5 : dd401b00 r4 : 00000286 > r3 : 00000000 r2 : d4a39ba0 r1 : 000080d0 r0 : dd401b00 > Flags: nzCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment user > Control: 10c5787d Table: 5a75406a DAC: 00000015 > Process hostapd (pid: 6245, stack limit = 0xd4a38238) > Stack: (0xd4a39b88 to 0xd4a3a000) > ... > [] (kmem_cache_alloc) from [] (ath10k_sta_state+0x190/0xd58 [ath10k_core]) > [] (ath10k_sta_state [ath10k_core]) from [] (sta_info_insert_rcu+0x418/0x61c [mac80211]) > [] (sta_info_insert_rcu [mac80211]) from [] (ieee80211_add_station+0xf0/0x134 [mac80211]) > [] (ieee80211_add_station [mac80211]) from [] (nl80211_new_station+0x330/0x36c [cfg80211]) > [] (nl80211_new_station [cfg80211]) from [] (extack_doit+0x2c/0x74 [compat]) > [] (extack_doit [compat]) from [] (genl_rcv_msg+0x274/0x30c) > [] (genl_rcv_msg) from [] (netlink_rcv_skb+0x58/0xac) > [] (netlink_rcv_skb) from [] (genl_rcv+0x20/0x34) > [] (genl_rcv) from [] (netlink_unicast+0x11c/0x204) > [] (netlink_unicast) from [] (netlink_sendmsg+0x30c/0x370) > [] (netlink_sendmsg) from [] (sock_sendmsg+0x70/0x84) > [] (sock_sendmsg) from [] (___sys_sendmsg.part.3+0x188/0x228) > [] (___sys_sendmsg.part.3) from [] (__sys_sendmsg+0x4c/0x70) > [] (__sys_sendmsg) from [] (ret_fast_syscall+0x0/0x44) > Code: ebfffec1 e1a04000 ea00001b e5953014 (e7940003) > ath10k_pci 0000:01:00.0: SWBA overrun on vdev 0, skipped old beacon > > Hardware tested: QCA9984 > Firmware tested: 10.4-3.6.0.1-00004 > > Fixes: a904417fc ("ath10k: add extended per sta tx statistics support") > Signed-off-by: Karthikeyan Periyasamy > Signed-off-by: Kalle Valo Patch applied to ath-next branch of ath.git, thanks. 553a7cca769d ath10k: fix kernel panic due to use after free -- https://patchwork.kernel.org/patch/10675533/ https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches _______________________________________________ ath10k mailing list ath10k@lists.infradead.org http://lists.infradead.org/mailman/listinfo/ath10k