From: Greg KH <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: torvalds@linux-foundation.org, akpm@linux-foundation.org,
alan@lxorguk.ukuu.org.uk, Clemens Eisserer <linuxhippy@gmail.com>,
Stanislaw Gruszka <sgruszka@redhat.com>,
"John W. Linville" <linville@tuxdriver.com>
Subject: [ 8/9] iwl3945: fix possible il->txq NULL pointer dereference in delayed works
Date: Wed, 21 Mar 2012 14:15:40 -0700 [thread overview]
Message-ID: <20120321211533.461417061@linuxfoundation.org> (raw)
In-Reply-To: <20120321211539.GA28899@kroah.com>
3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stanislaw Gruszka <sgruszka@redhat.com>
commit 210787e82a0ac1ffb5d7be1c796f0c51050849ad upstream.
On il3945_down procedure we free tx queue data and nullify il->txq
pointer. After that we drop mutex and then cancel delayed works. There
is possibility, that after drooping mutex and before the cancel, some
delayed work will start and crash while trying to send commands to
the device. For example, here is reported crash in
il3945_bg_reg_txpower_periodic():
https://bugzilla.kernel.org/show_bug.cgi?id=42766#c10
Patch fix problem by adding il->txq check on works that send commands,
hence utilize tx queue.
Reported-by: Clemens Eisserer <linuxhippy@gmail.com>
Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
---
drivers/net/wireless/iwlegacy/iwl-3945.c | 7 ++++---
drivers/net/wireless/iwlegacy/iwl3945-base.c | 2 +-
2 files changed, 5 insertions(+), 4 deletions(-)
--- a/drivers/net/wireless/iwlegacy/iwl-3945.c
+++ b/drivers/net/wireless/iwlegacy/iwl-3945.c
@@ -1870,11 +1870,12 @@ static void iwl3945_bg_reg_txpower_perio
struct iwl_priv *priv = container_of(work, struct iwl_priv,
_3945.thermal_periodic.work);
- if (test_bit(STATUS_EXIT_PENDING, &priv->status))
- return;
-
mutex_lock(&priv->mutex);
+ if (test_bit(STATUS_EXIT_PENDING, &priv->status) || priv->txq == NULL)
+ goto out;
+
iwl3945_reg_txpower_periodic(priv);
+out:
mutex_unlock(&priv->mutex);
}
--- a/drivers/net/wireless/iwlegacy/iwl3945-base.c
+++ b/drivers/net/wireless/iwlegacy/iwl3945-base.c
@@ -2513,7 +2513,7 @@ static void iwl3945_bg_alive_start(struc
container_of(data, struct iwl_priv, alive_start.work);
mutex_lock(&priv->mutex);
- if (test_bit(STATUS_EXIT_PENDING, &priv->status))
+ if (test_bit(STATUS_EXIT_PENDING, &priv->status) || priv->txq == NULL)
goto out;
iwl3945_alive_start(priv);
next prev parent reply other threads:[~2012-03-21 21:19 UTC|newest]
Thread overview: 10+ messages / expand[flat|nested] mbox.gz Atom feed top
2012-03-21 21:15 [ 0/9] 3.2.13-stable review Greg KH
2012-03-21 21:15 ` [ 1/9] nilfs2: fix NULL pointer dereference in nilfs_load_super_block() Greg KH
2012-03-21 21:15 ` [ 2/9] afs: Read of file returns EBADMSG Greg KH
2012-03-21 21:15 ` [ 3/9] afs: Remote abort can cause BUG in rxrpc code Greg KH
2012-03-21 21:15 ` [ 4/9] perf tools: Incorrect use of snprintf results in SEGV Greg KH
2012-03-21 21:15 ` [ 5/9] perf tools: Use scnprintf where applicable Greg KH
2012-03-21 21:15 ` [ 6/9] tcp: fix syncookie regression Greg KH
2012-03-21 21:15 ` [ 7/9] ipv6: Dont dev_hold(dev) in ip6_mc_find_dev_rcu Greg KH
2012-03-21 21:15 ` Greg KH [this message]
2012-03-21 21:15 ` [ 9/9] powerpc/pmac: Fix SMP kernels on pre-core99 UP machines Greg KH
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20120321211533.461417061@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=akpm@linux-foundation.org \
--cc=alan@lxorguk.ukuu.org.uk \
--cc=linux-kernel@vger.kernel.org \
--cc=linuxhippy@gmail.com \
--cc=linville@tuxdriver.com \
--cc=sgruszka@redhat.com \
--cc=stable@vger.kernel.org \
--cc=torvalds@linux-foundation.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox