From patchwork Wed Nov 28 14:39:59 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Amit Pundir X-Patchwork-Id: 152294 Delivered-To: patch@linaro.org Received: by 2002:a2e:299d:0:0:0:0:0 with SMTP id p29-v6csp1170798ljp; Wed, 28 Nov 2018 06:40:23 -0800 (PST) X-Google-Smtp-Source: AFSGD/XMQA1XjED2TSFbPkEYd8A+ka4YwRnWAGhOhUBP1nnExpu7WyU4xrir5tiOblrifh3f5CZ8 X-Received: by 2002:a63:504d:: with SMTP id q13mr33804045pgl.319.1543416023292; Wed, 28 Nov 2018 06:40:23 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1543416023; cv=none; d=google.com; s=arc-20160816; b=IX5Qzif0Kr0HLS4gZh2MY5x0AxeNvqo/2yZV6Ukx6doF2BsLNwkGYklYLfjS28hHa+ Ws2xRMiboStkJlhUCIB9poCXx8vbYimSFPwdyTK8zp+XONAZjT3IoMhUE05qG8iSW6lw Ts1UxRpOOJ+KVwop2Qwms3v4yFHNGEWEuE1cENLwaq4rNg0lmhsxl8s7HeDnc6YZ5X+a qnOQKwEPxat+f7G7pcYJQq90G3EdQ9MTd5+QaxEtq4qcJjVhk/s8mZ3fZvBZQ5UB2gfg b6khmq8qQbic5qTnTQmB0Hl4fyI6pQQfddN2bZY9Hew6NPXGqvT7CmVuKvmSJuNGG+Z2 73LQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:references:in-reply-to:message-id:date :subject:cc:to:from:dkim-signature; bh=TJJM3S/GlfdzGCFa4boe/exQVE5zZNojxEAJ8t7OChw=; b=jrzQy2Bx2ZIeS/tp5YX7+0shFUAG3SfG/VYbGNSqpedjlR8tCQliRAfhgNIUEcb1XB 8KOWfU4zWYSuRzJHDBnTaypNL3Wo5LJE9pHS41YXASN3QVt3blXoPlQM1dn7asgElUTm OtryqrNlrIrJHs7we+FQ6JZq1h+to+tFg0RFkHRUAJNPF4fdIBcmJPUqiKdfDuTkZY1J LfaJZ36tVeogAik4JRJSQcWBG3IuZBXeA5wd3+ulJzVZRcARVFRnTB5c4zGNKF2ui06S HmYaC01dXJwqOf0XKY/qRm2IwofiSgVLJ3JYOOgYKPE03g5Fn+k5ZFzi9AUFnN4+XMlD IYyA== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=ONMBDQhu; spf=pass (google.com: best guess record for domain of stable-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=stable-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id l23si7489048pgh.533.2018.11.28.06.40.23; Wed, 28 Nov 2018 06:40:23 -0800 (PST) Received-SPF: pass (google.com: best guess record for domain of stable-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=ONMBDQhu; spf=pass (google.com: best guess record for domain of stable-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=stable-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728413AbeK2BmP (ORCPT + 15 others); Wed, 28 Nov 2018 20:42:15 -0500 Received: from mail-pg1-f194.google.com ([209.85.215.194]:33655 "EHLO mail-pg1-f194.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1728223AbeK2BmO (ORCPT ); Wed, 28 Nov 2018 20:42:14 -0500 Received: by mail-pg1-f194.google.com with SMTP id z11so9599315pgu.0 for ; Wed, 28 Nov 2018 06:40:21 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=TJJM3S/GlfdzGCFa4boe/exQVE5zZNojxEAJ8t7OChw=; b=ONMBDQhuMhRiquRM1vAC5JTnbSWhfNf25ZqN5Ml4S7GSO9nDzD3y7ZOcPyzT1ZTPze 09IHypJVh24gTzVZj0HFLdi2ESgqdKbNgWMU/zhMg8K9bUYkpTgXEFm5eAD8p10yi1hq EKsA8xsMm3ILp3NYpd3SA5eig8fHLUOoBHOw0= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=TJJM3S/GlfdzGCFa4boe/exQVE5zZNojxEAJ8t7OChw=; b=ob1zGObq49q6IlDng34sN2TBt+PBdvp+Irhvx2kbW8cqgs+bivmCM4Nfzc4yAhcMTg bXxozAtd7ANTgqOF1faSh9NPqxsxQ8RfbhJjH1E719VScAFoj7+zW6FN0PqIPjcLQgSC wBGShysDKeISf+bSJztaHauF0npKLt4rxq3IsX7lf4v4F7emfTbjIYlJWNEtAklNBdj8 gudmHb1d7WbOLDlHLV/gEu0x82AGFQPBqgQTZattYiBbmF69rPaMjEY3DciuBkcYjH9p Rnt8XZnZPfOEB4YovyCRRny25MT6tuohC9ZXSXiJfJzPhkxA6+2iHO9pcn+kINtVSpnH OZMA== X-Gm-Message-State: AA+aEWabMsIjV7ag3ZCNUMN2NawHwYh0mN9kNF/96ZWNHrOaG/wBm2Jg 8I4VGak7kt23rX4CiuAXZ6x5ChjRY4I= X-Received: by 2002:a62:29c3:: with SMTP id p186mr5568586pfp.117.1543416021165; Wed, 28 Nov 2018 06:40:21 -0800 (PST) Received: from localhost.localdomain ([49.207.53.6]) by smtp.gmail.com with ESMTPSA id b26sm24227637pfe.91.2018.11.28.06.40.19 (version=TLS1_2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Wed, 28 Nov 2018 06:40:20 -0800 (PST) From: Amit Pundir To: Greg KH Cc: Stable , Amitkumar Karwar , Kalle Valo Subject: [PATCH for-4.9.y 05/10] mwifiex: Fix NULL pointer dereference in skb_dequeue() Date: Wed, 28 Nov 2018 20:09:59 +0530 Message-Id: <1543416004-1547-6-git-send-email-amit.pundir@linaro.org> X-Mailer: git-send-email 2.7.4 In-Reply-To: <1543416004-1547-1-git-send-email-amit.pundir@linaro.org> References: <1543416004-1547-1-git-send-email-amit.pundir@linaro.org> Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Amitkumar Karwar commit c44c040300d7afd79294710313a4989683e2afb1 upstream. At couple of places in cleanup path, we are just going through the skb queue and freeing them without unlinking. This leads to a crash when other thread tries to do skb_dequeue() and use already freed node. The problem is freed by unlinking skb before freeing it. Signed-off-by: Amitkumar Karwar Signed-off-by: Kalle Valo Signed-off-by: Amit Pundir --- drivers/net/wireless/marvell/mwifiex/cfg80211.c | 4 +++- drivers/net/wireless/marvell/mwifiex/wmm.c | 12 +++++++++--- 2 files changed, 12 insertions(+), 4 deletions(-) -- 2.7.4 diff --git a/drivers/net/wireless/marvell/mwifiex/cfg80211.c b/drivers/net/wireless/marvell/mwifiex/cfg80211.c index 48d51be11f9b..2054948050e2 100644 --- a/drivers/net/wireless/marvell/mwifiex/cfg80211.c +++ b/drivers/net/wireless/marvell/mwifiex/cfg80211.c @@ -3079,8 +3079,10 @@ int mwifiex_del_virtual_intf(struct wiphy *wiphy, struct wireless_dev *wdev) mwifiex_stop_net_dev_queue(priv->netdev, adapter); - skb_queue_walk_safe(&priv->bypass_txq, skb, tmp) + skb_queue_walk_safe(&priv->bypass_txq, skb, tmp) { + skb_unlink(skb, &priv->bypass_txq); mwifiex_write_data_complete(priv->adapter, skb, 0, -1); + } if (netif_carrier_ok(priv->netdev)) netif_carrier_off(priv->netdev); diff --git a/drivers/net/wireless/marvell/mwifiex/wmm.c b/drivers/net/wireless/marvell/mwifiex/wmm.c index 0eb246502e1d..dea2fe671dfe 100644 --- a/drivers/net/wireless/marvell/mwifiex/wmm.c +++ b/drivers/net/wireless/marvell/mwifiex/wmm.c @@ -503,8 +503,10 @@ mwifiex_wmm_del_pkts_in_ralist_node(struct mwifiex_private *priv, struct mwifiex_adapter *adapter = priv->adapter; struct sk_buff *skb, *tmp; - skb_queue_walk_safe(&ra_list->skb_head, skb, tmp) + skb_queue_walk_safe(&ra_list->skb_head, skb, tmp) { + skb_unlink(skb, &ra_list->skb_head); mwifiex_write_data_complete(adapter, skb, 0, -1); + } } /* @@ -600,11 +602,15 @@ mwifiex_clean_txrx(struct mwifiex_private *priv) priv->adapter->if_ops.clean_pcie_ring(priv->adapter); spin_unlock_irqrestore(&priv->wmm.ra_list_spinlock, flags); - skb_queue_walk_safe(&priv->tdls_txq, skb, tmp) + skb_queue_walk_safe(&priv->tdls_txq, skb, tmp) { + skb_unlink(skb, &priv->tdls_txq); mwifiex_write_data_complete(priv->adapter, skb, 0, -1); + } - skb_queue_walk_safe(&priv->bypass_txq, skb, tmp) + skb_queue_walk_safe(&priv->bypass_txq, skb, tmp) { + skb_unlink(skb, &priv->bypass_txq); mwifiex_write_data_complete(priv->adapter, skb, 0, -1); + } atomic_set(&priv->adapter->bypass_tx_pending, 0); idr_for_each(&priv->ack_status_frames, mwifiex_free_ack_frame, NULL);