| Message ID | 20220328122820.1004-1-xiam0nd.tong@gmail.com |
|---|---|
| State | Superseded |
| Headers | show |
| Series | [v2] carl9170: tx: fix an incorrect use of list iterator | expand |
Xiaomeng Tong <xiam0nd.tong@gmail.com> wrote: > If the previous list_for_each_entry_continue_rcu() don't exit early > (no goto hit inside the loop), the iterator 'cvif' after the loop > will be a bogus pointer to an invalid structure object containing > the HEAD (&ar->vif_list). As a result, the use of 'cvif' after that > will lead to a invalid memory access (i.e., 'cvif->id': the invalid > pointer dereference when return back to/after the callsite in the > carl9170_update_beacon()). > > The original intention should have been to return the valid 'cvif' > when found in list, NULL otherwise. So just return NULL when no > entry found, to fix this bug. > > Cc: stable@vger.kernel.org > Fixes: 1f1d9654e183c ("carl9170: refactor carl9170_update_beacon") > Signed-off-by: Xiaomeng Tong <xiam0nd.tong@gmail.com> > Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com> Christian, is this ok to take?
diff --git a/drivers/net/wireless/ath/carl9170/tx.c b/drivers/net/wireless/ath/carl9170/tx.c index 1b76f4434c06..791f9f120af3 100644 --- a/drivers/net/wireless/ath/carl9170/tx.c +++ b/drivers/net/wireless/ath/carl9170/tx.c @@ -1558,6 +1558,9 @@ static struct carl9170_vif_info *carl9170_pick_beaconing_vif(struct ar9170 *ar) goto out; } } while (ar->beacon_enabled && i--); + + /* no entry found in list */ + return NULL; } out:
If the previous list_for_each_entry_continue_rcu() don't exit early (no goto hit inside the loop), the iterator 'cvif' after the loop will be a bogus pointer to an invalid structure object containing the HEAD (&ar->vif_list). As a result, the use of 'cvif' after that will lead to a invalid memory access (i.e., 'cvif->id': the invalid pointer dereference when return back to/after the callsite in the carl9170_update_beacon()). The original intention should have been to return the valid 'cvif' when found in list, NULL otherwise. So just return NULL when no entry found, to fix this bug. Cc: stable@vger.kernel.org Fixes: 1f1d9654e183c ("carl9170: refactor carl9170_update_beacon") Signed-off-by: Xiaomeng Tong <xiam0nd.tong@gmail.com> --- changes since v1: - just return NULL when no entry found (Christian Lamparter) v1:https://lore.kernel.org/lkml/20220327072947.10744-1-xiam0nd.tong@gmail.com/ --- drivers/net/wireless/ath/carl9170/tx.c | 3 +++ 1 file changed, 3 insertions(+)