diff options
| author | Tetsuo Handa <penguin-kernel@i-love.sakura.ne.jp> | 2021-09-21 22:06:26 +0900 |
|---|---|---|
| committer | Kalle Valo <quic_kvalo@quicinc.com> | 2021-12-20 18:08:58 +0200 |
| commit | 8b3046abc99eefe11438090bcc4ec3a3994b55d0 (patch) | |
| tree | 21c8c7571a1e80ce6fe9785f82b5e46b8256accf /drivers/net/wireless/ath/ath9k/htc.h | |
| parent | b0ec7e55fce65f125bd1d7f02e2dc4de62abee34 (diff) | |
| download | linux-8b3046abc99eefe11438090bcc4ec3a3994b55d0.tar.gz | |
ath9k_htc: fix NULL pointer dereference at ath9k_htc_tx_get_packet()
syzbot is reporting lockdep warning at ath9k_wmi_event_tasklet() followed
by kernel panic at get_htc_epid_queue() from ath9k_htc_tx_get_packet() from
ath9k_htc_txstatus() [1], for ath9k_wmi_event_tasklet(WMI_TXSTATUS_EVENTID)
depends on spin_lock_init() from ath9k_init_priv() being already completed.
Since ath9k_wmi_event_tasklet() is set by ath9k_init_wmi() from
ath9k_htc_probe_device(), it is possible that ath9k_wmi_event_tasklet() is
called via tasklet interrupt before spin_lock_init() from ath9k_init_priv()
from ath9k_init_device() from ath9k_htc_probe_device() is called.
Let's hold ath9k_wmi_event_tasklet(WMI_TXSTATUS_EVENTID) no-op until
ath9k_tx_init() completes.
Link: https://syzkaller.appspot.com/bug?extid=31d54c60c5b254d6f75b [1]
Reported-by: syzbot <syzbot+31d54c60c5b254d6f75b@syzkaller.appspotmail.com>
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Tested-by: syzbot <syzbot+31d54c60c5b254d6f75b@syzkaller.appspotmail.com>
Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
Link: https://lore.kernel.org/r/77b76ac8-2bee-6444-d26c-8c30858b8daa@i-love.sakura.ne.jp
Diffstat (limited to 'drivers/net/wireless/ath/ath9k/htc.h')
| -rw-r--r-- | drivers/net/wireless/ath/ath9k/htc.h | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/drivers/net/wireless/ath/ath9k/htc.h b/drivers/net/wireless/ath/ath9k/htc.h index 4f71e962279a..6b45e63fae4b 100644 --- a/drivers/net/wireless/ath/ath9k/htc.h +++ b/drivers/net/wireless/ath/ath9k/htc.h @@ -306,6 +306,7 @@ struct ath9k_htc_tx { DECLARE_BITMAP(tx_slot, MAX_TX_BUF_NUM); struct timer_list cleanup_timer; spinlock_t tx_lock; + bool initialized; }; struct ath9k_htc_tx_ctl { |