From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 06A19C4332F for ; Sun, 9 Oct 2022 22:23:02 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:MIME-Version:References:In-Reply-To: Message-Id:Date:Subject:Cc:To:From:Reply-To:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: List-Owner; bh=fxomnX/ALilwb8QY6UUZ0YGiQ5wlEO+TEgnGkWVFN9E=; b=05OOOhMkZ5DfyU FC0uE4d86dtt13HxZwO7HFm1+NATgbZdoJwMI9QDzswxjB+fUojs9w8G9rLbKW4osw6cHLmwKezSq Os9wm8BrS3tQyG9vd9rJhm3dQaOe8oz0MqoV0wIUEvvEEWx5kvvXx67HkGnijS8DkSyta3KpfYf6w XcsLRJs4D6dB04Zne/c7doVwpDHpjo4o2temj7M6T6hCJ4DMA1dSvhBKs8aP1wGPYUvYrPy1iHarG MNHwMjNTeliPI9FhmxW6Rzw+QAwva2MiqKZXYWDL56cC/EpLtQUIEnqdKdOm+We2n36/edbAqbHIH E9xQ3gWHwtajhHQPJ93w==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.94.2 #2 (Red Hat Linux)) id 1oheh4-00GKG6-VS; Sun, 09 Oct 2022 22:22:47 +0000 Received: from dfw.source.kernel.org ([139.178.84.217]) by bombadil.infradead.org with esmtps (Exim 4.94.2 #2 (Red Hat Linux)) id 1oheh0-00GKEw-SR for ath10k@lists.infradead.org; Sun, 09 Oct 2022 22:22:46 +0000 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id E923A60D2B; Sun, 9 Oct 2022 22:22:40 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 7211CC433D6; Sun, 9 Oct 2022 22:22:39 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1665354160; bh=XiV1yhcURTqPLmoZcX5KUzmWfOZN2WAvBvCSNKE+L3o=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=NHf943wezLyN82i58mnD1AKGlQqLw1utTAAmadX72fj0EOMri0uPFXgahEIMkJQGX toeaBpPntcv9OLwUu5ZP2xZ2XKNfdcpDzJZEyPx5WYWlCsItKKz5mO3qiJklDQa7F/ j02Bqw7In/e2cFAxa7AmTfGujzEIFreVcwKzDRIYy6/0CQ6QoIEtuqXUpBtpysdoor m+Yr1OfEqL9ERIAfTPOcljw1gCeLNh7W6XThhut6ulKxmjKZgPZ1XKEwz3k0t3ohaU H227bK228MR2gkK+pydacXgk8Pz0dVG457ovgLuJBgrrmE1u6rTpUDICce/7i8MDJF UslB5KUTHsahQ== From: Sasha Levin To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Wen Gong , Kalle Valo , Sasha Levin , kvalo@kernel.org, davem@davemloft.net, edumazet@google.com, kuba@kernel.org, pabeni@redhat.com, ath10k@lists.infradead.org, linux-wireless@vger.kernel.org, netdev@vger.kernel.org Subject: [PATCH AUTOSEL 5.10 24/34] wifi: ath10k: reset pointer after memory free to avoid potential use-after-free Date: Sun, 9 Oct 2022 18:21:18 -0400 Message-Id: <20221009222129.1218277-24-sashal@kernel.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20221009222129.1218277-1-sashal@kernel.org> References: <20221009222129.1218277-1-sashal@kernel.org> MIME-Version: 1.0 X-stable: review X-Patchwork-Hint: Ignore X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20221009_152242_975087_330EA1BD X-CRM114-Status: GOOD ( 11.08 ) X-BeenThere: ath10k@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: "ath10k" Errors-To: ath10k-bounces+ath10k=archiver.kernel.org@lists.infradead.org From: Wen Gong [ Upstream commit 1e1cb8e0b73e6f39a9d4a7a15d940b1265387eb5 ] When running suspend test, kernel crash happened in ath10k, and it is fixed by commit b72a4aff947b ("ath10k: skip ath10k_halt during suspend for driver state RESTARTING"). Currently the crash is fixed, but as a common code style, it is better to set the pointer to NULL after memory is free. This is to address the code style and it will avoid potential bug of use-after-free. Tested-on: QCA6174 hw3.2 PCI WLAN.RM.4.4.1-00110-QCARMSWP-1 Signed-off-by: Wen Gong Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20220505092248.787-1-quic_wgong@quicinc.com Signed-off-by: Sasha Levin --- drivers/net/wireless/ath/ath10k/htt_rx.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/net/wireless/ath/ath10k/htt_rx.c b/drivers/net/wireless/ath/ath10k/htt_rx.c index 28ec3c5b4d1f..1b34f12b7eca 100644 --- a/drivers/net/wireless/ath/ath10k/htt_rx.c +++ b/drivers/net/wireless/ath/ath10k/htt_rx.c @@ -297,12 +297,16 @@ void ath10k_htt_rx_free(struct ath10k_htt *htt) ath10k_htt_get_vaddr_ring(htt), htt->rx_ring.base_paddr); + ath10k_htt_config_paddrs_ring(htt, NULL); + dma_free_coherent(htt->ar->dev, sizeof(*htt->rx_ring.alloc_idx.vaddr), htt->rx_ring.alloc_idx.vaddr, htt->rx_ring.alloc_idx.paddr); + htt->rx_ring.alloc_idx.vaddr = NULL; kfree(htt->rx_ring.netbufs_ring); + htt->rx_ring.netbufs_ring = NULL; } static inline struct sk_buff *ath10k_htt_rx_netbuf_pop(struct ath10k_htt *htt) @@ -823,8 +827,10 @@ int ath10k_htt_rx_alloc(struct ath10k_htt *htt) ath10k_htt_get_rx_ring_size(htt), vaddr_ring, htt->rx_ring.base_paddr); + ath10k_htt_config_paddrs_ring(htt, NULL); err_dma_ring: kfree(htt->rx_ring.netbufs_ring); + htt->rx_ring.netbufs_ring = NULL; err_netbuf: return -ENOMEM; } -- 2.35.1 _______________________________________________ ath10k mailing list ath10k@lists.infradead.org http://lists.infradead.org/mailman/listinfo/ath10k