1. 29 6月, 2017 4 次提交
    • M
      ath9k: fix an invalid pointer dereference in ath9k_rng_stop() · 07246c11
      Miaoqing Pan 提交于
      The bug was triggered when do suspend/resuming continuously
      on Dell XPS L322X/0PJHXN version 9333 (2013) with kernel
      4.12.0-041200rc4-generic. But can't reproduce on DELL
      E5440 + AR9300 PCIE chips.
      
      The warning is caused by accessing invalid pointer sc->rng_task.
      sc->rng_task is not be cleared after kthread_stop(sc->rng_task)
      be called in ath9k_rng_stop(). Because the kthread is stopped
      before ath9k_rng_kthread() be scheduled.
      
      So set sc->rng_task to null after kthread_stop(sc->rng_task) to
      resolve this issue.
      
      WARNING: CPU: 0 PID: 984 at linux/kernel/kthread.c:71 kthread_stop+0xf1/0x100
      CPU: 0 PID: 984 Comm: NetworkManager Not tainted 4.12.0-041200rc4-generic #201706042031
      Hardware name: Dell Inc.          Dell System XPS L322X/0PJHXN, BIOS A09 05/15/2013
      task: ffff950170fdda00 task.stack: ffffa22c01538000
      RIP: 0010:kthread_stop+0xf1/0x100
      RSP: 0018:ffffa22c0153b5b0 EFLAGS: 00010246
      RAX: ffffffffa6257800 RBX: ffff950171b79560 RCX: 0000000000000000
      RDX: 0000000080000000 RSI: 000000007fffffff RDI: ffff9500ac9a9680
      RBP: ffffa22c0153b5c8 R08: 0000000000000000 R09: 0000000000000000
      R10: ffffa22c0153b648 R11: ffff9501768004b8 R12: ffff9500ac9a9680
      R13: ffff950171b79f70 R14: ffff950171b78780 R15: ffff9501749dc018
      FS:  00007f0d6bfd5540(0000) GS:ffff95017f200000(0000) knlGS:0000000000000000
      CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
      CR2: 00007fc190161a08 CR3: 0000000232906000 CR4: 00000000001406f0
      Call Trace:
        ath9k_rng_stop+0x1a/0x20 [ath9k]
        ath9k_stop+0x3b/0x1d0 [ath9k]
        drv_stop+0x33/0xf0 [mac80211]
        ieee80211_stop_device+0x43/0x50 [mac80211]
        ieee80211_do_stop+0x4f2/0x810 [mac80211]
      
      Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=196043Reported-by: NGiulio Genovese <giulio.genovese@gmail.com>
      Tested-by: NGiulio Genovese <giulio.genovese@gmail.com>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: NMiaoqing Pan <miaoqing@codeaurora.org>
      Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>
      07246c11
    • B
      ath10k: add const to thermal_cooling_device_ops structure · 1cdb6c9f
      Bhumika Goyal 提交于
      Declare thermal_cooling_device_ops structure as const as it is only passed
      as an argument to the function thermal_cooling_device_register and this
      argument is of type const. So, declare the structure as const.
      Signed-off-by: NBhumika Goyal <bhumirks@gmail.com>
      Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>
      1cdb6c9f
    • M
      ath9k: fix tx99 bus error · bde717ab
      Miaoqing Pan 提交于
      The hard coded register 0x9864 and 0x9924 are invalid
      for ar9300 chips.
      
      Cc: <stable@vger.kernel.org>
      Signed-off-by: NMiaoqing Pan <miaoqing@codeaurora.org>
      Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>
      bde717ab
    • M
      ath9k: fix tx99 use after free · cf8ce1ea
      Miaoqing Pan 提交于
      One scenario that could lead to UAF is two threads writing
      simultaneously to the "tx99" debug file. One of them would
      set the "start" value to true and follow to ath9k_tx99_init().
      Inside the function it would set the sc->tx99_state to true
      after allocating sc->tx99skb. Then, the other thread would
      execute write_file_tx99() and call ath9k_tx99_deinit().
      sc->tx99_state would be freed. After that, the first thread
      would continue inside ath9k_tx99_init() and call
      r = ath9k_tx99_send(sc, sc->tx99_skb, &txctl);
      that would make use of the freed sc->tx99_skb memory.
      
      Cc: <stable@vger.kernel.org>
      Signed-off-by: NMiaoqing Pan <miaoqing@codeaurora.org>
      Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>
      cf8ce1ea
  2. 27 6月, 2017 9 次提交
  3. 26 6月, 2017 7 次提交
  4. 25 6月, 2017 20 次提交