diff options
| author |   Tetsuo Handa <penguin-kernel@i-love.sakura.ne.jp> | 2021-09-21 22:06:26 +0900 |
|---|---|---|
| committer |   Kalle Valo <quic_kvalo@quicinc.com> | 2021-12-20 18:08:58 +0200 |
| commit | 8b3046abc99eefe11438090bcc4ec3a3994b55d0 (patch) | |
| tree | 21c8c7571a1e80ce6fe9785f82b5e46b8256accf /drivers/net/wireless/ath/ath9k/htc_drv_txrx.c | |
| parent | ath9k_htc: fix NULL pointer dereference at ath9k_htc_rxep() (diff) | |
| download | wireguard-linux-8b3046abc99eefe11438090bcc4ec3a3994b55d0.tar.xz wireguard-linux-8b3046abc99eefe11438090bcc4ec3a3994b55d0.zip | |
ath9k_htc: fix NULL pointer dereference at ath9k_htc_tx_get_packet()
syzbot is reporting lockdep warning at ath9k_wmi_event_tasklet() followed
by kernel panic at get_htc_epid_queue() from ath9k_htc_tx_get_packet() from
ath9k_htc_txstatus() [1], for ath9k_wmi_event_tasklet(WMI_TXSTATUS_EVENTID)
depends on spin_lock_init() from ath9k_init_priv() being already completed.
Since ath9k_wmi_event_tasklet() is set by ath9k_init_wmi() from
ath9k_htc_probe_device(), it is possible that ath9k_wmi_event_tasklet() is
called via tasklet interrupt before spin_lock_init() from ath9k_init_priv()
from ath9k_init_device() from ath9k_htc_probe_device() is called.
Let's hold ath9k_wmi_event_tasklet(WMI_TXSTATUS_EVENTID) no-op until
ath9k_tx_init() completes.
Link: https://syzkaller.appspot.com/bug?extid=31d54c60c5b254d6f75b [1]
Reported-by: syzbot <syzbot+31d54c60c5b254d6f75b@syzkaller.appspotmail.com>
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Tested-by: syzbot <syzbot+31d54c60c5b254d6f75b@syzkaller.appspotmail.com>
Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
Link: https://lore.kernel.org/r/77b76ac8-2bee-6444-d26c-8c30858b8daa@i-love.sakura.ne.jp
Diffstat (limited to 'drivers/net/wireless/ath/ath9k/htc_drv_txrx.c')
| -rw-r--r-- | drivers/net/wireless/ath/ath9k/htc_drv_txrx.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c b/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c index e7a21eaf3a68..6a850a0bfa8a 100644 --- a/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c +++ b/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c @@ -813,6 +813,11 @@ int ath9k_tx_init(struct ath9k_htc_priv *priv) skb_queue_head_init(&priv->tx.data_vi_queue); skb_queue_head_init(&priv->tx.data_vo_queue); skb_queue_head_init(&priv->tx.tx_failed); + + /* Allow ath9k_wmi_event_tasklet(WMI_TXSTATUS_EVENTID) to operate. */ + smp_wmb(); + priv->tx.initialized = true; + return 0; } |