Stanislaw Gruszka 21f8aaee0c ath9k: protect tid->sched check ... We check tid->sched without a lock taken on ath_tx_aggr_sleep(). That is race condition which can result of doing list_del(&tid->list) twice (second time with poisoned list node) and cause crash like shown below: [424271.637220] BUG: unable to handle kernel paging request at 00100104 [424271.637328] IP: [<f90fc072>] ath_tx_aggr_sleep+0x62/0xe0 [ath9k] ... [424271.639953] Call Trace: [424271.639998] [<f90f6900>] ? ath9k_get_survey+0x110/0x110 [ath9k] [424271.640083] [<f90f6942>] ath9k_sta_notify+0x42/0x50 [ath9k] [424271.640177] [<f809cfef>] sta_ps_start+0x8f/0x1c0 [mac80211] [424271.640258] [<c10f730e>] ? free_compound_page+0x2e/0x40 [424271.640346] [<f809e915>] ieee80211_rx_handlers+0x9d5/0x2340 [mac80211] [424271.640437] [<c112f048>] ? kmem_cache_free+0x1d8/0x1f0 [424271.640510] [<c1345a84>] ? kfree_skbmem+0x34/0x90 [424271.640578] [<c10fc23c>] ? put_page+0x2c/0x40 [424271.640640] [<c1345a84>] ? kfree_skbmem+0x34/0x90 [424271.640706] [<c1345a84>] ? kfree_skbmem+0x34/0x90 [424271.640787] [<f809dde3>] ? ieee80211_rx_handlers_result+0x73/0x1d0 [mac80211] [424271.640897] [<f80a07a0>] ieee80211_prepare_and_rx_handle+0x520/0xad0 [mac80211] [424271.641009] [<f809e22d>] ? ieee80211_rx_handlers+0x2ed/0x2340 [mac80211] [424271.641104] [<c13846ce>] ? ip_output+0x7e/0xd0 [424271.641182] [<f80a1057>] ieee80211_rx+0x307/0x7c0 [mac80211] [424271.641266] [<f90fa6ee>] ath_rx_tasklet+0x88e/0xf70 [ath9k] [424271.641358] [<f80a0f2c>] ? ieee80211_rx+0x1dc/0x7c0 [mac80211] [424271.641445] [<f90f82db>] ath9k_tasklet+0xcb/0x130 [ath9k] Bug report: https://bugzilla.kernel.org/show_bug.cgi?id=70551 Reported-and-tested-by: Max Sydorenko <maxim.stargazer@gmail.com> Cc: stable@vger.kernel.org Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>		2014-02-20 15:53:20 -05:00
..
accessibility
acpi	ACPI and power management updates for 3.14-rc1	2014-01-24 15:51:02 -08:00
amba
ata	ACPI and power management updates for 3.14-rc1	2014-01-24 15:51:02 -08:00
atm
auxdisplay
base	regmap: Updates for v3.14	2014-01-25 13:18:00 -08:00
bcma
block	Merge branch 'for-3.14/drivers' of git://git.kernel.dk/linux-block	2014-01-30 11:40:10 -08:00
bluetooth
bus
cdrom	Merge branch 'for-3.14/drivers' of git://git.kernel.dk/linux-block	2014-01-30 11:40:10 -08:00
char	ipmi: Add missing rv in ipmi_parisc_probe()	2014-01-30 10:02:54 -08:00
clk	The second half of the clock framework pull requeust for 3.14 is	2014-01-28 18:44:53 -08:00
clocksource	ARM: SoC DT updates for 3.14	2014-01-23 18:45:38 -08:00
connector
cpufreq	Merge branch 'next' of git://git.kernel.org/pub/scm/linux/kernel/git/rzhang/linux	2014-01-24 17:13:49 -08:00
cpuidle
crypto	ARM: driver updates for 3.14	2014-01-23 18:49:36 -08:00
dca
devfreq	ARM: SoC cleanups for 3.14	2014-01-23 18:36:55 -08:00
dio
dma	Merge branch 'for-linus' of git://git.infradead.org/users/vkoul/slave-dma	2014-01-29 20:27:23 -08:00
edac	Merge branch 'x86-ras-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip	2014-01-20 12:10:27 -08:00
eisa
extcon
firewire	firewire: Enable remote DMA above 4 GB	2014-01-20 01:11:13 +01:00
firmware	firmware/google: drop 'select EFI' to avoid recursive dependency	2014-01-27 21:02:40 -08:00
fmc
gpio	ARM: driver updates for 3.14	2014-01-23 18:49:36 -08:00
gpu	Merge branch 'drm-next' of git://people.freedesktop.org/~airlied/linux	2014-01-29 20:49:12 -08:00
hid	ACPI and power management updates for 3.14-rc1	2014-01-24 15:51:02 -08:00
hsi
hv	hyperv: Add support for physically discontinuous receive buffer	2014-01-27 16:40:45 -08:00
hwmon	Merge branch 'hwmon-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jdelvare/staging	2014-01-29 18:56:27 -08:00
hwspinlock
i2c	Merge branch 'i2c/for-current' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux	2014-01-29 19:56:20 -08:00
ide	drivers: ide: Include appropriate header file in ide-pio-blacklist.c	2014-01-28 23:35:09 -08:00
idle	ACPI and power management updates for 3.14-rc1	2014-01-24 15:51:02 -08:00
iio	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial	2014-01-22 21:21:55 -08:00
infiniband	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next	2014-01-25 11:17:34 -08:00
input	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input	2014-01-24 17:17:30 -08:00
iommu	IOMMU Updates for Linux v3.14	2014-01-29 20:00:13 -08:00
ipack
irqchip	Xtensa patchset for 3.14-rc1	2014-01-25 10:49:30 -08:00
isdn	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next	2014-01-25 11:17:34 -08:00
leds	Merge branch 'for-next' of git://git.kernel.org/pub/scm/linux/kernel/git/cooloney/linux-leds	2014-01-28 18:53:01 -08:00
lguest
macintosh	Merge branch 'next' of git://git.kernel.org/pub/scm/linux/kernel/git/benh/powerpc	2014-01-27 21:11:26 -08:00
mailbox	drivers/mailbox/omap: make mbox->irq signed for error handling	2014-01-23 16:36:53 -08:00
md	Merge branch 'for-3.14/drivers' of git://git.kernel.dk/linux-block	2014-01-30 11:40:10 -08:00
media	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next	2014-01-25 11:17:34 -08:00
memory
memstick	drivers/memstick/host/rtsx_pci_ms.c: fix ms card data transfer bug	2014-01-23 16:37:04 -08:00
message	Merge branch 'for-3.14/core' of git://git.kernel.dk/linux-block	2014-01-30 11:19:05 -08:00
mfd	regulator: Updates for v3.14	2014-01-25 13:19:10 -08:00
misc	Merge branch 'hwmon-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jdelvare/staging	2014-01-29 18:56:27 -08:00
mmc	MMC highlights for 3.14:	2014-01-26 11:00:41 -08:00
mtd	MTD updates for 3.14:	2014-01-28 18:56:37 -08:00
net	ath9k: protect tid->sched check	2014-02-20 15:53:20 -05:00
nfc
ntb
nubus
of	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next	2014-01-25 11:17:34 -08:00
oprofile
parisc
parport	TTY/Serial driver patches for 3.14-rc1	2014-01-20 16:05:23 -08:00
pci	ACPI and power management updates for 3.14-rc1	2014-01-24 15:51:02 -08:00
pcmcia	PCI changes for the v3.14 merge window:	2014-01-22 16:39:28 -08:00
phy	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next	2014-01-25 11:17:34 -08:00
pinctrl	ARM: SoC DT updates for 3.14	2014-01-23 18:45:38 -08:00
platform	platform/chrome: Cleanups and improvements	2014-01-29 20:06:01 -08:00
pnp
power	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next	2014-01-25 11:17:34 -08:00
powercap
pps
ps3
ptp
pwm	pwm: Changes for v3.14-rc1	2014-01-27 08:15:51 -08:00
rapidio
regulator	regulator: Updates for v3.14	2014-01-25 13:19:10 -08:00
remoteproc
reset
rpmsg
rtc	Merge branch 'akpm' (incoming from Andrew)	2014-01-23 19:11:50 -08:00
s390	Merge branch 'for-3.14/core' of git://git.kernel.dk/linux-block	2014-01-30 11:19:05 -08:00
sbus	sparc: delete non-required instances of include <linux/init.h>	2014-01-28 23:38:23 -08:00
scsi	Merge branch 'for-3.14/core' of git://git.kernel.dk/linux-block	2014-01-30 11:19:05 -08:00
sfi
sh
sn
spi	spi: Updates for v3.14	2014-01-25 13:20:36 -08:00
ssb
staging	Merge branch 'for-3.14/core' of git://git.kernel.dk/linux-block	2014-01-30 11:19:05 -08:00
target
tc
thermal	Merge branch 'next' of git://git.kernel.org/pub/scm/linux/kernel/git/rzhang/linux	2014-01-24 17:13:49 -08:00
tty	Serial fixes for 3.14-rc1	2014-01-28 18:50:24 -08:00
uio
usb	ACPI and power management updates for 3.14-rc1	2014-01-24 15:51:02 -08:00
uwb
vfio	Merge branch 'next' of git://git.kernel.org/pub/scm/linux/kernel/git/benh/powerpc	2014-01-27 21:11:26 -08:00
vhost
video	Merge branch 'drm-next' of git://people.freedesktop.org/~airlied/linux	2014-01-29 20:49:12 -08:00
virt
virtio	A few simple fixes. Quiet cycle.	2014-01-22 22:24:35 -08:00
vlynq	drivers/vlynq/vlynq.c: fix another resource size off by 1 error	2014-01-23 16:36:55 -08:00
vme
w1	drivers/w1/masters/w1-gpio.c: add strong pullup emulation	2014-01-23 16:37:04 -08:00
watchdog	watchdog: w83627hf_wdt: Reset watchdog trigger during initialization	2014-01-28 21:35:40 +01:00
xen	ACPI and power management updates for 3.14-rc1	2014-01-24 15:51:02 -08:00
zorro
Kconfig
Makefile