xiaomi-sm8450/android_kernel_xiaomi_sm8450
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
a7a7488cb15a8ff3af6185907a44ac7c8d8c50c1
android_kernel_xiaomi_sm8450/drivers/net/wireless/ath/ath9k
History
Pavel Skripkin eccd7c3e25 ath9k: fix use-after-free in ath9k_hif_usb_rx_cb 
[ Upstream commit 0ac4827f78c7ffe8eef074bc010e7e34bc22f533 ]

Syzbot reported use-after-free Read in ath9k_hif_usb_rx_cb() [0]. The
problem was in incorrect htc_handle->drv_priv initialization.

Probable call trace which can trigger use-after-free:

ath9k_htc_probe_device()
  /* htc_handle->drv_priv = priv; */
  ath9k_htc_wait_for_target()      <--- Failed
  ieee80211_free_hw()		   <--- priv pointer is freed

<IRQ>
...
ath9k_hif_usb_rx_cb()
  ath9k_hif_usb_rx_stream()
   RX_STAT_INC()		<--- htc_handle->drv_priv access

In order to not add fancy protection for drv_priv we can move
htc_handle->drv_priv initialization at the end of the
ath9k_htc_probe_device() and add helper macro to make
all *_STAT_* macros NULL safe, since syzbot has reported related NULL
deref in that macros [1]

Link: https://syzkaller.appspot.com/bug?id=6ead44e37afb6866ac0c7dd121b4ce07cb665f60 [0]
Link: https://syzkaller.appspot.com/bug?id=b8101ffcec107c0567a0cd8acbbacec91e9ee8de [1]
Fixes: fb9987d0f7 ("ath9k_htc: Support for AR9271 chipset.")
Reported-and-tested-by: syzbot+03110230a11411024147@syzkaller.appspotmail.com
Reported-and-tested-by: syzbot+c6dde1f690b60e0b9fbe@syzkaller.appspotmail.com
Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
Acked-by: Toke Høiland-Jørgensen <toke@toke.dk>
Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
Link: https://lore.kernel.org/r/d57bbedc857950659bfacac0ab48790c1eda00c8.1655145743.git.paskripkin@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
2022-08-21 15:15:40 +02:00
..
ahb.c
remove ioremap_nocache and devm_ioremap_nocache
2020-01-06 09:45:59 +01:00
ani.c
ath9k: Replace HTTP links with HTTPS ones
2020-08-14 17:44:14 +03:00
ani.h
…
antenna.c
ath9k: fix RX_STAT_INC() etc macros
2018-10-13 20:27:35 +03:00
ar953x_initvals.h
…
ar955x_1p0_initvals.h
…
ar956x_initvals.h
…
ar5008_initvals.h
ath9k: ar5008_initvals: Move ar5416Bank{0,1,2,3,7} to where they are used
2020-08-27 13:17:40 +03:00
ar5008_phy.c
ath9k: ar5008_initvals: Move ar5416Bank{0,1,2,3,7} to where they are used
2020-08-27 13:17:40 +03:00
ar9001_initvals.h
ath9k: ar9001_initvals: Remove unused array 'ar5416Bank6_9100'
2020-08-27 13:17:35 +03:00
ar9002_calib.c
ath9k: add calibration timeout for AR9002
2020-04-28 12:07:21 +03:00
ar9002_hw.c
ath9k: replace eeprom_param EEP_MINOR_REV with get_eeprom_rev
2016-12-15 10:26:27 +02:00
ar9002_initvals.h
ath9k: ar9002_initvals: Remove unused array 'ar9280PciePhy_clkreq_off_L1_9280'
2020-08-27 13:17:32 +03:00
ar9002_mac.c
ath9k: Use fallthrough pseudo-keyword
2020-08-14 18:04:06 +03:00
ar9002_phy.c
ath9k: Use fallthrough pseudo-keyword
2020-08-14 18:04:06 +03:00
ar9002_phy.h
ath9k_hw: fix spectral scan on AR9285 and newer
2016-07-19 20:58:07 +03:00
ar9003_2p2_initvals.h
…
ar9003_aic.c
ath9k: use true,false for bool variable
2020-01-26 12:19:02 +02:00
ar9003_aic.h
…
ar9003_buffalo_initvals.h
…
ar9003_calib.c
Revert "ath9k_hw: implement temperature compensation support for AR9003+"
2016-10-13 14:11:30 +03:00
ar9003_eeprom.c
ath9k: fix ar9003_get_eepmisc
2022-06-09 10:20:59 +02:00
ar9003_eeprom.h
ath9k: Read noise floor calibration data from eeprom
2018-01-25 07:33:36 +02:00
ar9003_hw.c
net: Fix misspellings of "configure" and "configuration"
2019-10-28 13:41:01 -07:00
ar9003_mac.c
ath9k: Use fallthrough pseudo-keyword
2020-08-14 18:04:06 +03:00
ar9003_mac.h
…
ar9003_mci.c
ath9k: remove set but not used variable 'new_flags'
2018-11-05 13:18:34 +02:00
ar9003_mci.h
…
ar9003_paprd.c
treewide: kmalloc() -> kmalloc_array()
2018-06-12 16:19:22 -07:00
ar9003_phy.c
ath9k: drop redundant code in ar9003_hw_set_channel
2019-04-29 17:56:03 +03:00
ar9003_phy.h
ath9k: fix QCA9561 PA bias level
2022-06-09 10:20:51 +02:00
ar9003_rtt.c
…
ar9003_rtt.h
…
ar9003_wow.c
…
ar9330_1p1_initvals.h
…
ar9330_1p2_initvals.h
…
ar9340_initvals.h
…
ar9462_2p0_initvals.h
…
ar9462_2p1_initvals.h
…
ar9485_initvals.h
…
ar9565_1p0_initvals.h
…
ar9565_1p1_initvals.h
…
ar9580_1p0_initvals.h
ath9k: Remove set but not used variable
2020-09-29 11:29:20 +03:00
ath9k_pci_owl_loader.c
ath9k: use iowrite32 over __raw_writel
2019-11-28 10:18:51 +02:00
ath9k.h
ath9k: fix transmitting to stations in dynamic SMPS mode
2021-03-17 17:06:10 +01:00
beacon.c
Merge tag 'wireless-drivers-next-2020-09-11' of git://git.kernel.org/pub/scm/linux/kernel/git/kvalo/wireless-drivers-next
2020-09-11 13:32:31 -07:00
btcoex.c
…
btcoex.h
…
calib.c
ath9k: add calibration timeout for AR9002
2020-04-28 12:07:21 +03:00
calib.h
…
channel.c
ath9k: Use fallthrough pseudo-keyword
2020-08-14 18:04:06 +03:00
common-beacon.c
…
common-beacon.h
…
common-debug.c
ath9k: add counters for good and errorneous FFT/spectral frames
2018-10-02 07:43:32 +03:00
common-debug.h
ath9k: add counters for good and errorneous FFT/spectral frames
2018-10-02 07:43:32 +03:00
common-init.c
ath9k: spelling s/premble/preamble/
2018-03-26 18:22:44 +03:00
common-init.h
…
common-spectral.c
ath9k: do not return invalid pointers as a *dentry
2019-02-07 16:59:04 +02:00
common-spectral.h
ath9k: fix and simplify FFT max index retrieval
2018-10-02 07:43:56 +03:00
common.c
Merge ath-next from git://git.kernel.org/pub/scm/linux/kernel/git/kvalo/ath.git
2017-05-19 11:47:44 +03:00
common.h
ath9k: Fix beacon configuration for addition/removal of interfaces
2016-07-08 17:03:41 +03:00
debug_sta.c
ath9k: Switch to mac80211 TXQ scheduling and airtime APIs
2019-02-12 20:44:41 +02:00
debug.c
ath9k: fix data bus crash when setting nf_override via debugfs
2021-03-04 11:37:30 +01:00
debug.h
ath9k: Switch to mac80211 TXQ scheduling and airtime APIs
2019-02-12 20:44:41 +02:00
dfs_debug.c
wireless: Use octal not symbolic permissions
2018-03-27 11:01:13 +03:00
dfs_debug.h
…
dfs.c
ath: add support to get the detected radar specifications
2018-05-25 13:15:21 +03:00
dfs.h
…
dynack.c
ath9k: dynack: set ackto to max timeout in ath_dynack_reset
2019-09-04 09:15:31 +03:00
dynack.h
ath9k: dynack: make ewma estimation faster
2018-11-06 18:26:50 +02:00
eeprom_4k.c
ath9k: Differentiate between max combined and per chain power
2019-04-29 17:53:43 +03:00
eeprom_9287.c
ath9k: move RELAY and DEBUG_FS to ATH9K[_HTC]_DEBUGFS
2017-01-13 15:29:24 +02:00
eeprom_def.c
ath9k: Use fallthrough pseudo-keyword
2020-08-14 18:04:06 +03:00
eeprom.c
ath9k: Differentiate between max combined and per chain power
2019-04-29 17:53:43 +03:00
eeprom.h
ath9k: Add cast to u8 to FREQ2FBIN macro
2017-04-19 17:00:48 +03:00
gpio.c
ath: Convert timers to use timer_setup()
2017-10-27 16:54:19 +03:00
hif_usb.c
ath9k: Fix out-of-bound memcpy in ath9k_hif_usb_rx_stream
2022-01-27 10:54:17 +01:00
hif_usb.h
ath9k: Fix general protection fault in ath9k_hif_usb_rx_cb
2020-04-07 07:57:26 +03:00
htc_drv_beacon.c
mac80211: rename csa counters to countdown counters
2020-08-27 14:12:15 +02:00
htc_drv_debug.c
wireless: Use octal not symbolic permissions
2018-03-27 11:01:13 +03:00
htc_drv_gpio.c
…
htc_drv_init.c
ath9k: fix use-after-free in ath9k_hif_usb_rx_cb
2022-08-21 15:15:40 +02:00
htc_drv_main.c
ath: Modify ath_key_delete() to not need full key entry
2021-08-26 08:35:32 -04:00
htc_drv_txrx.c
ath9k_htc: fix NULL pointer dereference at ath9k_htc_tx_get_packet()
2022-08-11 13:06:44 +02:00
htc_hst.c
ath9k_htc: fix uninit value bugs
2022-04-08 14:40:13 +02:00
htc_hst.h
…
htc.h
ath9k: fix use-after-free in ath9k_hif_usb_rx_cb
2022-08-21 15:15:40 +02:00
hw-ops.h
…
hw.c
ath9k: fix sleeping in atomic context
2021-09-18 13:40:34 +02:00
hw.h
ath9k: Postpone key cache entry deletion for TXQ frames reference it
2021-08-26 08:35:33 -04:00
init.c
ath9k: convert tasklets to use new tasklet_setup() API
2020-08-27 13:16:18 +03:00
Kconfig
ath9k: fix build error with LEDS_CLASS=m
2021-02-17 11:02:25 +01:00
link.c
ath: Convert timers to use timer_setup()
2017-10-27 16:54:19 +03:00
mac.c
ath9k: add MSI support
2018-01-16 16:29:22 +02:00
mac.h
mac80211: separate encoding/bandwidth from flags
2017-04-28 10:41:45 +02:00
main.c
ath9k: Fix usage of driver-private space in tx_info
2022-04-20 09:23:26 +02:00
Makefile
ath9k: add loader for AR92XX (and older) pci(e)
2019-09-04 09:12:35 +03:00
mci.c
ath9k: remove cast to void pointer
2017-09-25 10:13:58 +03:00
mci.h
…
pci.c
ath9k: Check the return value of pcie_capability_read_*()
2020-07-20 20:09:36 +03:00
phy.h
…
recv.c
ath9k: Set RX filter based to allow broadcast Action frame RX
2020-05-30 17:17:20 +03:00
reg_aic.h
…
reg_mci.h
…
reg_wow.h
…
reg.h
ath9k: add MSI support
2018-01-16 16:29:22 +02:00
rng.c
ath9k: avoid potential freezing during random generator read
2017-06-28 19:54:38 +03:00
tx99.c
ath9k: add back support for using active monitor interfaces for tx99
2018-10-02 07:54:26 +03:00
wmi.c
ath9k_htc: fix NULL pointer dereference at ath9k_htc_tx_get_packet()
2022-08-11 13:06:44 +02:00
wmi.h
ath9k: convert tasklets to use new tasklet_setup() API
2020-08-27 13:16:18 +03:00
wow.c
…
xmit.c
ath9k: Fix usage of driver-private space in tx_info
2022-04-20 09:23:26 +02:00