From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Balamurugan S <quic_bselvara@quicinc.com>,
Kalle Valo <quic_kvalo@quicinc.com>,
Sasha Levin <sashal@kernel.org>,
kvalo@kernel.org, ath12k@lists.infradead.org,
linux-wireless@vger.kernel.org
Subject: [PATCH AUTOSEL 6.4 15/26] wifi: ath12k: Avoid NULL pointer access during management transmit cleanup
Date: Sun, 9 Jul 2023 11:12:44 -0400 [thread overview]
Message-ID: <20230709151255.512931-15-sashal@kernel.org> (raw)
In-Reply-To: <20230709151255.512931-1-sashal@kernel.org>
From: Balamurugan S <quic_bselvara@quicinc.com>
[ Upstream commit 054b5580a36e435692c203c19abdcb9f7734320e ]
Currently 'ar' reference is not added in skb_cb.
Though this is generally not used during transmit completion
callbacks, on interface removal the remaining idr cleanup callback
uses the ar pointer from skb_cb from management txmgmt_idr. Hence fill them
during transmit call for proper usage to avoid NULL pointer dereference.
Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.0.1-00029-QCAHKSWPL_SILICONZ-1
Signed-off-by: Balamurugan S <quic_bselvara@quicinc.com>
Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
Link: https://lore.kernel.org/r/20230518071046.14337-1-quic_bselvara@quicinc.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/ath/ath12k/mac.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/net/wireless/ath/ath12k/mac.c b/drivers/net/wireless/ath/ath12k/mac.c
index ee792822b4113..58acfe8fdf8c0 100644
--- a/drivers/net/wireless/ath/ath12k/mac.c
+++ b/drivers/net/wireless/ath/ath12k/mac.c
@@ -4425,6 +4425,7 @@ static int ath12k_mac_mgmt_tx_wmi(struct ath12k *ar, struct ath12k_vif *arvif,
int buf_id;
int ret;
+ ATH12K_SKB_CB(skb)->ar = ar;
spin_lock_bh(&ar->txmgmt_idr_lock);
buf_id = idr_alloc(&ar->txmgmt_idr, skb, 0,
ATH12K_TX_MGMT_NUM_PENDING_MAX, GFP_ATOMIC);
--
2.39.2
--
ath12k mailing list
ath12k@lists.infradead.org
https://lists.infradead.org/mailman/listinfo/ath12k
WARNING: multiple messages have this Message-ID (diff)
From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Balamurugan S <quic_bselvara@quicinc.com>,
Kalle Valo <quic_kvalo@quicinc.com>,
Sasha Levin <sashal@kernel.org>,
kvalo@kernel.org, ath12k@lists.infradead.org,
linux-wireless@vger.kernel.org
Subject: [PATCH AUTOSEL 6.4 15/26] wifi: ath12k: Avoid NULL pointer access during management transmit cleanup
Date: Sun, 9 Jul 2023 11:12:44 -0400 [thread overview]
Message-ID: <20230709151255.512931-15-sashal@kernel.org> (raw)
In-Reply-To: <20230709151255.512931-1-sashal@kernel.org>
From: Balamurugan S <quic_bselvara@quicinc.com>
[ Upstream commit 054b5580a36e435692c203c19abdcb9f7734320e ]
Currently 'ar' reference is not added in skb_cb.
Though this is generally not used during transmit completion
callbacks, on interface removal the remaining idr cleanup callback
uses the ar pointer from skb_cb from management txmgmt_idr. Hence fill them
during transmit call for proper usage to avoid NULL pointer dereference.
Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.0.1-00029-QCAHKSWPL_SILICONZ-1
Signed-off-by: Balamurugan S <quic_bselvara@quicinc.com>
Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
Link: https://lore.kernel.org/r/20230518071046.14337-1-quic_bselvara@quicinc.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/ath/ath12k/mac.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/net/wireless/ath/ath12k/mac.c b/drivers/net/wireless/ath/ath12k/mac.c
index ee792822b4113..58acfe8fdf8c0 100644
--- a/drivers/net/wireless/ath/ath12k/mac.c
+++ b/drivers/net/wireless/ath/ath12k/mac.c
@@ -4425,6 +4425,7 @@ static int ath12k_mac_mgmt_tx_wmi(struct ath12k *ar, struct ath12k_vif *arvif,
int buf_id;
int ret;
+ ATH12K_SKB_CB(skb)->ar = ar;
spin_lock_bh(&ar->txmgmt_idr_lock);
buf_id = idr_alloc(&ar->txmgmt_idr, skb, 0,
ATH12K_TX_MGMT_NUM_PENDING_MAX, GFP_ATOMIC);
--
2.39.2
next prev parent reply other threads:[~2023-07-09 15:13 UTC|newest]
Thread overview: 38+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-07-09 15:12 [PATCH AUTOSEL 6.4 01/26] wifi: ath11k: fix registration of 6Ghz-only phy without the full channel range Sasha Levin
2023-07-09 15:12 ` Sasha Levin
2023-07-09 15:12 ` [PATCH AUTOSEL 6.4 02/26] bpf: Print a warning only if writing to unprivileged_bpf_disabled Sasha Levin
2023-07-09 15:12 ` [PATCH AUTOSEL 6.4 03/26] wifi: rtw89: 8851be: add 8851BE PCI entry and fill PCI capabilities Sasha Levin
2023-07-10 0:25 ` Ping-Ke Shih
2023-07-20 19:11 ` Sasha Levin
2023-07-09 15:12 ` [PATCH AUTOSEL 6.4 04/26] spi: s3c64xx: change polling mode to optional Sasha Levin
2023-07-09 15:12 ` Sasha Levin
2023-07-09 21:14 ` Mark Brown
2023-07-09 21:14 ` Mark Brown
2023-07-20 19:11 ` Sasha Levin
2023-07-20 19:11 ` Sasha Levin
2023-07-09 15:12 ` [PATCH AUTOSEL 6.4 05/26] bpf: Address KCSAN report on bpf_lru_list Sasha Levin
2023-07-09 15:12 ` [PATCH AUTOSEL 6.4 06/26] spi: cadence-quadspi: Add compatible for AMD Pensando Elba SoC Sasha Levin
2023-07-09 15:12 ` [PATCH AUTOSEL 6.4 07/26] bpf: drop unnecessary user-triggerable WARN_ONCE in verifierl log Sasha Levin
2023-07-09 15:12 ` [PATCH AUTOSEL 6.4 08/26] bpf: tcp: Avoid taking fast sock lock in iterator Sasha Levin
2023-07-09 15:12 ` [PATCH AUTOSEL 6.4 09/26] wifi: rtw88: sdio: Check the HISR RX_REQUEST bit in rtw_sdio_rx_isr() Sasha Levin
2023-07-09 15:12 ` [PATCH AUTOSEL 6.4 10/26] bpf: Silence a warning in btf_type_id_size() Sasha Levin
2023-07-09 15:12 ` [PATCH AUTOSEL 6.4 11/26] devlink: make health report on unregistered instance warn just once Sasha Levin
2023-07-09 15:12 ` [PATCH AUTOSEL 6.4 12/26] wifi: ath11k: add support default regdb while searching board-2.bin for WCN6855 Sasha Levin
2023-07-09 15:12 ` Sasha Levin
2023-07-09 15:12 ` [PATCH AUTOSEL 6.4 13/26] wifi: mac80211_hwsim: Fix possible NULL dereference Sasha Levin
2023-07-09 15:12 ` [PATCH AUTOSEL 6.4 14/26] spi: dw: Add compatible for Intel Mount Evans SoC Sasha Levin
2023-07-09 15:12 ` Sasha Levin [this message]
2023-07-09 15:12 ` [PATCH AUTOSEL 6.4 15/26] wifi: ath12k: Avoid NULL pointer access during management transmit cleanup Sasha Levin
2023-07-09 15:12 ` [PATCH AUTOSEL 6.4 16/26] wifi: ath11k: fix memory leak in WMI firmware stats Sasha Levin
2023-07-09 15:12 ` Sasha Levin
2023-07-09 15:12 ` [PATCH AUTOSEL 6.4 17/26] wifi: iwlwifi: mvm: fix potential array out of bounds access Sasha Levin
2023-07-09 15:12 ` [PATCH AUTOSEL 6.4 18/26] net: ethernet: litex: add support for 64 bit stats Sasha Levin
2023-07-09 15:12 ` [PATCH AUTOSEL 6.4 19/26] devlink: report devlink_port_type_warn source device Sasha Levin
2023-07-09 15:12 ` [PATCH AUTOSEL 6.4 20/26] wifi: iwlwifi: mvm: Add NULL check before dereferencing the pointer Sasha Levin
2023-07-09 15:12 ` [PATCH AUTOSEL 6.4 21/26] wifi: wext-core: Fix -Wstringop-overflow warning in ioctl_standard_iw_point() Sasha Levin
2023-07-09 15:12 ` [PATCH AUTOSEL 6.4 22/26] wifi: iwlwifi: Add support for new PCI Id Sasha Levin
2023-07-09 15:12 ` [PATCH AUTOSEL 6.4 23/26] wifi: iwlwifi: mvm: avoid baid size integer overflow Sasha Levin
2023-07-09 15:12 ` [PATCH AUTOSEL 6.4 24/26] wifi: iwlwifi: pcie: add device id 51F1 for killer 1675 Sasha Levin
2023-07-09 15:12 ` [Intel-wired-lan] [PATCH AUTOSEL 6.4 25/26] igb: Fix igb_down hung on surprise removal Sasha Levin
2023-07-09 15:12 ` Sasha Levin
2023-07-09 15:12 ` [PATCH AUTOSEL 6.4 26/26] net: hns3: fix strncpy() not using dest-buf length as length issue Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20230709151255.512931-15-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=ath12k@lists.infradead.org \
--cc=kvalo@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-wireless@vger.kernel.org \
--cc=quic_bselvara@quicinc.com \
--cc=quic_kvalo@quicinc.com \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.