From: Kalle Valo <kvalo@codeaurora.org>
To: Pavel Skripkin <paskripkin@gmail.com>
Cc: ath9k-devel@qca.qualcomm.com, davem@davemloft.net,
kuba@kernel.org, Sujith.Manoharan@atheros.com,
linville@tuxdriver.com, vasanth@atheros.com,
senthilkumar@atheros.com, linux-wireless@vger.kernel.org,
netdev@vger.kernel.org, linux-kernel@vger.kernel.org,
syzbot+03110230a11411024147@syzkaller.appspotmail.com,
syzbot+c6dde1f690b60e0b9fbe@syzkaller.appspotmail.com
Subject: Re: [PATCH RESEND] net: ath9k: fix use-after-free in ath9k_hif_usb_rx_cb
Date: Sat, 02 Oct 2021 16:11:18 +0300 [thread overview]
Message-ID: <87pmsnh8qx.fsf@codeaurora.org> (raw)
In-Reply-To: <9bbf1f36-2878-69d1-f262-614d3cb66328@gmail.com> (Pavel Skripkin's message of "Sat, 2 Oct 2021 16:05:47 +0300")
Pavel Skripkin <paskripkin@gmail.com> writes:
> On 9/22/21 19:42, Pavel Skripkin wrote:
>> Syzbot reported use-after-free Read in ath9k_hif_usb_rx_cb(). The
>> problem was in incorrect htc_handle->drv_priv initialization.
>>
>> Probable call trace which can trigger use-after-free:
>>
>> ath9k_htc_probe_device()
>> /* htc_handle->drv_priv = priv; */
>> ath9k_htc_wait_for_target() <--- Failed
>> ieee80211_free_hw() <--- priv pointer is freed
>>
>> <IRQ>
>> ...
>> ath9k_hif_usb_rx_cb()
>> ath9k_hif_usb_rx_stream()
>> RX_STAT_INC() <--- htc_handle->drv_priv access
>>
>> In order to not add fancy protection for drv_priv we can move
>> htc_handle->drv_priv initialization at the end of the
>> ath9k_htc_probe_device() and add helper macro to make
>> all *_STAT_* macros NULL save.
>>
>> Fixes: fb9987d0f748 ("ath9k_htc: Support for AR9271 chipset.")
>> Reported-and-tested-by: syzbot+03110230a11411024147@syzkaller.appspotmail.com
>> Reported-and-tested-by: syzbot+c6dde1f690b60e0b9fbe@syzkaller.appspotmail.com
>> Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
>> ---
>>
>> Why resend?
>> No activity on this patch since 8/6/21, Kalle Valo has asked around,
>> for review and no one claimed it.
>>
>> Resend changes:
>> 1. Rebased on top of v5.15-rc2
>> 2. Removed clean ups for macros
>> 3. Added 1 more syzbot tag, since this patch has passed 2 syzbot
>> tests
>>
>
> Hi, ath9k maintainers!
>
> Does this patch need any further work? I can't see any comments on it
> since 8/6/21 and I can't see it on wireless patchwork.
>
> If this bug is already fixed and I've overlooked a fix commit, please,
> let me know. As I see syzbot hits this bug really often [1]
See my other mail I just sent about ath9k syzbot patches:
https://lore.kernel.org/linux-wireless/87tuhzhdyq.fsf@codeaurora.org/
In summary: please wait patiently once I'm able to test the syzbot
patches on a real device.
--
https://patchwork.kernel.org/project/linux-wireless/list/
https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches
next prev parent reply other threads:[~2021-10-02 13:11 UTC|newest]
Thread overview: 10+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-08-04 19:48 [PATCH] net: ath9k: fix use-after-free in ath9k_hif_usb_rx_cb Pavel Skripkin
2021-08-04 19:57 ` Pavel Skripkin
2021-08-31 10:43 ` Pavel Skripkin
2021-09-19 17:28 ` Pavel Skripkin
2021-09-22 16:42 ` [PATCH RESEND] " Pavel Skripkin
2021-10-02 13:05 ` Pavel Skripkin
2021-10-02 13:11 ` Kalle Valo [this message]
2021-10-02 13:14 ` Pavel Skripkin
2021-08-06 9:06 ` [PATCH] " Kalle Valo
2021-08-13 15:01 ` Pavel Skripkin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=87pmsnh8qx.fsf@codeaurora.org \
--to=kvalo@codeaurora.org \
--cc=Sujith.Manoharan@atheros.com \
--cc=ath9k-devel@qca.qualcomm.com \
--cc=davem@davemloft.net \
--cc=kuba@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-wireless@vger.kernel.org \
--cc=linville@tuxdriver.com \
--cc=netdev@vger.kernel.org \
--cc=paskripkin@gmail.com \
--cc=senthilkumar@atheros.com \
--cc=syzbot+03110230a11411024147@syzkaller.appspotmail.com \
--cc=syzbot+c6dde1f690b60e0b9fbe@syzkaller.appspotmail.com \
--cc=vasanth@atheros.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.