AuxXxilium/linux_dsm_epyc7002
1
0
Fork 0
mirror of https://github.com/AuxXxilium/linux_dsm_epyc7002.git synced 2024-12-17 09:07:49 +07:00
Code Issues Actions Packages Projects Releases Wiki Activity

ath10k: ensure peer_map references are cleaned up

Browse Source 
While debugging OS crashes due to firmware crashes, I enabled
kasan, and it noticed that peer objects were being used-after-freed.

Looks like there are two places we could be leaving stale references
in the peer-map, so clean that up.

Signed-off-by: Ben Greear <greearb@candelatech.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
This commit is contained in:
Ben Greear 2016-06-30 15:23:53 +03:00 committed by Kalle Valo
parent de0170beaa
commit 6d68f7900d
1 changed files with 17 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
drivers/net/wireless/ath/ath10k/mac.c
View File

@ -802,6 +802,7 @@ static void ath10k_peer_cleanup(struct ath10k *ar, u32 vdev_id)
{
struct ath10k_peer *peer, *tmp;
int peer_id;
int i;
lockdep_assert_held(&ar->conf_mutex);
@ -818,6 +819,17 @@ static void ath10k_peer_cleanup(struct ath10k *ar, u32 vdev_id)
ar->peer_map[peer_id] = NULL;
}
/* Double check that peer is properly un-referenced from
* the peer_map
*/
for (i = 0; i < ARRAY_SIZE(ar->peer_map); i++) {
if (ar->peer_map[i] == peer) {
ath10k_warn(ar, "removing stale peer_map entry for %pM (ptr %p idx %d)\n",
peer->addr, peer, i);
ar->peer_map[i] = NULL;
}
}
list_del(&peer->list);
kfree(peer);
ar->num_peers--;
@ -828,6 +840,7 @@ static void ath10k_peer_cleanup(struct ath10k *ar, u32 vdev_id)
static void ath10k_peer_cleanup_all(struct ath10k *ar)
{
struct ath10k_peer *peer, *tmp;
int i;
lockdep_assert_held(&ar->conf_mutex);
@ -836,6 +849,10 @@ static void ath10k_peer_cleanup_all(struct ath10k *ar)
list_del(&peer->list);
kfree(peer);
}
for (i = 0; i < ARRAY_SIZE(ar->peer_map); i++)
ar->peer_map[i] = NULL;
spin_unlock_bh(&ar->data_lock);
ar->num_peers = 0;