ath9k_htc: fix NULL pointer dereference at ath9k_htc_tx_get_packet()

syzbot is reporting lockdep warning at ath9k_wmi_event_tasklet() followed
by kernel panic at get_htc_epid_queue() from ath9k_htc_tx_get_packet() from
ath9k_htc_txstatus() [1], for ath9k_wmi_event_tasklet(WMI_TXSTATUS_EVENTID)
depends on spin_lock_init() from ath9k_init_priv() being already completed.

Since ath9k_wmi_event_tasklet() is set by ath9k_init_wmi() from
ath9k_htc_probe_device(), it is possible that ath9k_wmi_event_tasklet() is
called via tasklet interrupt before spin_lock_init() from ath9k_init_priv()
 from ath9k_init_device() from ath9k_htc_probe_device() is called.

Let's hold ath9k_wmi_event_tasklet(WMI_TXSTATUS_EVENTID) no-op until
ath9k_tx_init() completes.

Link: https://syzkaller.appspot.com/bug?extid=31d54c60c5b254d6f75b
Reported-by: syzbot <syzbot+31d54c60c5b254d6f75b@syzkaller.appspotmail.com>
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Tested-by: syzbot <syzbot+31d54c60c5b254d6f75b@syzkaller.appspotmail.com>
Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
Link: https://lore.kernel.org/r/77b76ac8-2bee-6444-d26c-8c30858b8daa@i-love.sakura.ne.jp

diff --git a/drivers/net/wireless/ath/ath9k/htc.h b/drivers/net/wireless/ath/ath9k/htc.h
index 4f71e962279af841d854ce8164d093d7db0bddc1..6b45e63fae4ba04dc7a116d2d45d427532a48bdb 100644 (file)
--- a/drivers/net/wireless/ath/ath9k/htc.h
+++ b/drivers/net/wireless/ath/ath9k/htc.h
@@ -306,6 +306,7 @@ struct ath9k_htc_tx {
        DECLARE_BITMAP(tx_slot, MAX_TX_BUF_NUM);
        struct timer_list cleanup_timer;
        spinlock_t tx_lock;
+       bool initialized;
 };
 
 struct ath9k_htc_tx_ctl {

diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c b/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c
index e7a21eaf3a68d586a184d488e1ef211811df78e5..6a850a0bfa8ad85976b8a3b8294990f06efc1528 100644 (file)
--- a/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c
+++ b/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c
@@ -813,6 +813,11 @@ int ath9k_tx_init(struct ath9k_htc_priv *priv)
        skb_queue_head_init(&priv->tx.data_vi_queue);
        skb_queue_head_init(&priv->tx.data_vo_queue);
        skb_queue_head_init(&priv->tx.tx_failed);
+
+       /* Allow ath9k_wmi_event_tasklet(WMI_TXSTATUS_EVENTID) to operate. */
+       smp_wmb();
+       priv->tx.initialized = true;
+
        return 0;
 }
 

diff --git a/drivers/net/wireless/ath/ath9k/wmi.c b/drivers/net/wireless/ath/ath9k/wmi.c
index fe29ad4b9023cd68f8fcda77aa5a3311b2180d06..f315c54bd3ac0001b733ac1494f91ad63c696fe3 100644 (file)
--- a/drivers/net/wireless/ath/ath9k/wmi.c
+++ b/drivers/net/wireless/ath/ath9k/wmi.c
@@ -169,6 +169,10 @@ void ath9k_wmi_event_tasklet(struct tasklet_struct *t)
                                             &wmi->drv_priv->fatal_work);
                        break;
                case WMI_TXSTATUS_EVENTID:
+                       /* Check if ath9k_tx_init() completed. */
+                       if (!data_race(priv->tx.initialized))
+                               break;
+
                        spin_lock_bh(&priv->tx.tx_lock);
                        if (priv->tx.flags & ATH9K_HTC_OP_TX_DRAIN) {
                                spin_unlock_bh(&priv->tx.tx_lock);