AuxXxilium/linux_dsm_epyc7002
1
0
Fork 0
mirror of https://github.com/AuxXxilium/linux_dsm_epyc7002.git synced 2024-12-23 05:36:35 +07:00
Code Issues Actions Packages Projects Releases Wiki Activity
553a7cca76
linux_dsm_epyc7002/drivers/net/wireless
History
Karthikeyan Periyasamy 553a7cca76 ath10k: fix kernel panic due to use after free 
This issue arise in a race condition between ath10k_sta_state() and
ath10k_htt_fetch_peer_stats(), explained in below scenario

Steps:
1. In ath10k_sta_state(), arsta->tx_stats get deallocated before peer deletion
   when the station moves from IEEE80211_STA_NONE to IEEE80211_STA_NOTEXIST
   state.
2. Meanwhile ath10k receive HTT_T2H_MSG_TYPE_PEER_STATS message.
   In ath10k_htt_fetch_peer_stats(), arsta->tx_stats get accessed after
   the peer validation check.

Since arsta->tx_stats get freed before the peer deletion [1].
ath10k_htt_fetch_peer_stats() ended up in "use after free" situation.

Fixed this issue by moving the arsta->tx_stats free handling after the
peer deletion. so that ath10k_htt_fetch_peer_stats() will not end up in
"use after free" situation.

Kernel Panic:

Unable to handle kernel NULL pointer dereference at virtual address 00000286
pgd = d8754000
[00000286] *pgd=00000000
Internal error: Oops: 5 [#1] PREEMPT SMP ARM
...
CPU: 0 PID: 6245 Comm: hostapd Not tainted
task: dc44cac0 ti: d4a38000 task.ti: d4a38000
PC is at kmem_cache_alloc+0x7c/0x114
LR is at ath10k_sta_state+0x190/0xd58 [ath10k_core]
pc : [<c02bdc50>]    lr : [<bf916b78>]    psr: 20000013
sp : d4a39b88  ip : 00000000  fp : 00000001
r10: 00000000  r9 : 1d3bc000  r8 : 00000dc0
r7 : 000080d0  r6 : d4a38000  r5 : dd401b00  r4 : 00000286
r3 : 00000000  r2 : d4a39ba0  r1 : 000080d0  r0 : dd401b00
Flags: nzCv  IRQs on  FIQs on  Mode SVC_32  ISA ARM  Segment user
Control: 10c5787d  Table: 5a75406a  DAC: 00000015
Process hostapd (pid: 6245, stack limit = 0xd4a38238)
Stack: (0xd4a39b88 to 0xd4a3a000)
...
[<c02bdc50>] (kmem_cache_alloc) from [<bf916b78>] (ath10k_sta_state+0x190/0xd58 [ath10k_core])
[<bf916b78>] (ath10k_sta_state [ath10k_core]) from [<bf870d4c>] (sta_info_insert_rcu+0x418/0x61c [mac80211])
[<bf870d4c>] (sta_info_insert_rcu [mac80211]) from [<bf88634c>] (ieee80211_add_station+0xf0/0x134 [mac80211])
[<bf88634c>] (ieee80211_add_station [mac80211]) from [<bf83f3c4>] (nl80211_new_station+0x330/0x36c [cfg80211])
[<bf83f3c4>] (nl80211_new_station [cfg80211]) from [<bf6c4040>] (extack_doit+0x2c/0x74 [compat])
[<bf6c4040>] (extack_doit [compat]) from [<c05c285c>] (genl_rcv_msg+0x274/0x30c)
[<c05c285c>] (genl_rcv_msg) from [<c05c1d98>] (netlink_rcv_skb+0x58/0xac)
[<c05c1d98>] (netlink_rcv_skb) from [<c05c25d4>] (genl_rcv+0x20/0x34)
[<c05c25d4>] (genl_rcv) from [<c05c1750>] (netlink_unicast+0x11c/0x204)
[<c05c1750>] (netlink_unicast) from [<c05c1be0>] (netlink_sendmsg+0x30c/0x370)
[<c05c1be0>] (netlink_sendmsg) from [<c0587e90>] (sock_sendmsg+0x70/0x84)
[<c0587e90>] (sock_sendmsg) from [<c058970c>] (___sys_sendmsg.part.3+0x188/0x228)
[<c058970c>] (___sys_sendmsg.part.3) from [<c058a594>] (__sys_sendmsg+0x4c/0x70)
[<c058a594>] (__sys_sendmsg) from [<c0208c80>] (ret_fast_syscall+0x0/0x44)
Code: ebfffec1 e1a04000 ea00001b e5953014 (e7940003)
ath10k_pci 0000:01:00.0: SWBA overrun on vdev 0, skipped old beacon

Hardware tested: QCA9984
Firmware tested: 10.4-3.6.0.1-00004

Fixes: a904417fc ("ath10k: add extended per sta tx statistics support")
Signed-off-by: Karthikeyan Periyasamy <periyasa@codeaurora.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2018-12-20 18:49:48 +02:00
..
admtek
ath ath10k: fix kernel panic due to use after free 2018-12-20 18:49:48 +02:00
atmel
broadcom wireless-drivers-next patches for 4.21 2018-12-03 15:44:27 -08:00
cisco wireless: airo: potential buffer overflow in sprintf() 2018-11-06 19:02:43 +02:00
intel wireless-drivers-next patches for 4.21 2018-12-03 15:44:27 -08:00
intersil prism54: islpci_dev: mark expected switch fall-through 2018-11-06 18:59:38 +02:00
marvell mwifiex: Mark expected switch fall-through 2018-11-06 18:59:39 +02:00
mediatek mt76: fix uninitialized mutex access setting rts threshold 2018-11-16 15:15:49 +02:00
quantenna qtnfmac: fix error handling in control path 2018-11-06 18:57:37 +02:00
ralink rt2x00: rt61pci: mark expected switch fall-through 2018-11-06 18:59:59 +02:00
realtek rtlwifi: rtl8192de: Fix misleading REG_MCUFWDL information 2018-11-06 19:05:00 +02:00
rsi rsi: fix spelling mistake "Initialzing" -> "Initializing" 2018-11-06 18:52:10 +02:00
st cw1200: fix small typo 2018-11-06 19:03:56 +02:00
ti wireless-drivers-next patches for 4.21 2018-12-03 15:44:27 -08:00
zydas zd1201: mark expected switch fall-through 2018-11-06 19:00:12 +02:00
Kconfig
mac80211_hwsim.c mac80211_hwsim: drop now unused work-queue from hwsim 2018-10-08 09:49:06 +02:00
mac80211_hwsim.h
Makefile
ray_cs.c ray_cs: mark expected switch fall-throughs 2018-11-06 19:00:01 +02:00
ray_cs.h
rayctl.h
rndis_wlan.c
wl3501_cs.c
wl3501.h