From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 5EA8EC433FE for ; Sun, 9 Oct 2022 22:25:37 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:MIME-Version:References:In-Reply-To: Message-Id:Date:Subject:Cc:To:From:Reply-To:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: List-Owner; bh=yGjiFw3rv1wU0+g6lT1GkqB2PAiU9JqXR+14gHJjAoA=; b=QPRUPC2o0QBYZC YUI1EpoCzheCyEaaaXTbu9FYZ0HXo9QpU+18eY2TTDtpWScoK2XWGqquxJYW3Ch8ErsdbO8nzxzK1 4PnjU5QcIBbmc7EFoaPaInYB1tdZDTeoD9yo5c8iT53HNjV4MXDN3qM5qe9YLAsPL+V1Q1LM9ALRh jYagnEESDEkhHRyovq2+3n6rjR88h4+MBwdlSCrfP8ZG8pA8s5k7kw6fpahDYNQ9g3gqHZMwFv4oM EKR3AJsqn8vPowR+Q4mQ8UinvfcLtC5EiimOiMwx+0qbmUy50UzncD78OOB9BwDrDtQhvzaAZW3r2 g1mInfaD8ndzvPXJSX2w==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.94.2 #2 (Red Hat Linux)) id 1ohejm-00GL0d-BZ; Sun, 09 Oct 2022 22:25:34 +0000 Received: from ams.source.kernel.org ([145.40.68.75]) by bombadil.infradead.org with esmtps (Exim 4.94.2 #2 (Red Hat Linux)) id 1ohejj-00GKzs-EH for ath10k@lists.infradead.org; Sun, 09 Oct 2022 22:25:32 +0000 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 2BDD1B80DDF; Sun, 9 Oct 2022 22:25:30 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 84B8DC4347C; Sun, 9 Oct 2022 22:25:28 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1665354329; bh=Z88gscPgKN76zJ93T2DPK3bjOaxFlCelhKvCEzfYnJU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=AB5bPMorY5Bkg+dfOZi/q5qkU0lhBEZEbAb64JK0R5fcMNy5q0LJ/J1Q32u25fSyF herpFWANCArn92ChaEll8uaT4eccxEX7CEmElZZVycXLfxd+q6K2NPxJYHZOWm/7Ub ABOzvk4nv7xDgoRJqtz4BSgKAQkP1jOphLW41AsycI/1yiE0IHE09yR/Tb4qzmZzul o2v5cPfFlJXOO7Qe+UlbJzBGPoVcRRhtbaug3xiC6eM/H08t+SFIoeag9YelMJXeMc 6u8KgyTjs7yjd2WONwuD2JECgHDWA9Nfmfdv7Ru/i8hEllcL3Ui6uEpEtoDgokRkcL oXsm8C39vmFxg== From: Sasha Levin To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Wen Gong , Kalle Valo , Sasha Levin , kvalo@kernel.org, davem@davemloft.net, edumazet@google.com, kuba@kernel.org, pabeni@redhat.com, ath10k@lists.infradead.org, linux-wireless@vger.kernel.org, netdev@vger.kernel.org Subject: [PATCH AUTOSEL 4.19 16/25] wifi: ath10k: reset pointer after memory free to avoid potential use-after-free Date: Sun, 9 Oct 2022 18:24:21 -0400 Message-Id: <20221009222436.1219411-16-sashal@kernel.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20221009222436.1219411-1-sashal@kernel.org> References: <20221009222436.1219411-1-sashal@kernel.org> MIME-Version: 1.0 X-stable: review X-Patchwork-Hint: Ignore X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20221009_152531_647289_473F60C9 X-CRM114-Status: GOOD ( 11.08 ) X-BeenThere: ath10k@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: "ath10k" Errors-To: ath10k-bounces+ath10k=archiver.kernel.org@lists.infradead.org From: Wen Gong [ Upstream commit 1e1cb8e0b73e6f39a9d4a7a15d940b1265387eb5 ] When running suspend test, kernel crash happened in ath10k, and it is fixed by commit b72a4aff947b ("ath10k: skip ath10k_halt during suspend for driver state RESTARTING"). Currently the crash is fixed, but as a common code style, it is better to set the pointer to NULL after memory is free. This is to address the code style and it will avoid potential bug of use-after-free. Tested-on: QCA6174 hw3.2 PCI WLAN.RM.4.4.1-00110-QCARMSWP-1 Signed-off-by: Wen Gong Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20220505092248.787-1-quic_wgong@quicinc.com Signed-off-by: Sasha Levin --- drivers/net/wireless/ath/ath10k/htt_rx.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/net/wireless/ath/ath10k/htt_rx.c b/drivers/net/wireless/ath/ath10k/htt_rx.c index 0a7551dc0f94..68728cba6df3 100644 --- a/drivers/net/wireless/ath/ath10k/htt_rx.c +++ b/drivers/net/wireless/ath/ath10k/htt_rx.c @@ -302,12 +302,16 @@ void ath10k_htt_rx_free(struct ath10k_htt *htt) ath10k_htt_get_vaddr_ring(htt), htt->rx_ring.base_paddr); + ath10k_htt_config_paddrs_ring(htt, NULL); + dma_free_coherent(htt->ar->dev, sizeof(*htt->rx_ring.alloc_idx.vaddr), htt->rx_ring.alloc_idx.vaddr, htt->rx_ring.alloc_idx.paddr); + htt->rx_ring.alloc_idx.vaddr = NULL; kfree(htt->rx_ring.netbufs_ring); + htt->rx_ring.netbufs_ring = NULL; } static inline struct sk_buff *ath10k_htt_rx_netbuf_pop(struct ath10k_htt *htt) @@ -641,8 +645,10 @@ int ath10k_htt_rx_alloc(struct ath10k_htt *htt) ath10k_htt_get_rx_ring_size(htt), vaddr_ring, htt->rx_ring.base_paddr); + ath10k_htt_config_paddrs_ring(htt, NULL); err_dma_ring: kfree(htt->rx_ring.netbufs_ring); + htt->rx_ring.netbufs_ring = NULL; err_netbuf: return -ENOMEM; } -- 2.35.1 _______________________________________________ ath10k mailing list ath10k@lists.infradead.org http://lists.infradead.org/mailman/listinfo/ath10k