lkml.org 
[lkml]   [2020]   [Sep]   [17]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH AUTOSEL 5.4 129/330] mt76: clear skb pointers from rx aggregation reorder buffer during cleanup
    Date
    From: Felix Fietkau <nbd@nbd.name>

    [ Upstream commit 9379df2fd9234e3b67a23101c2370c99f6af6d77 ]

    During the cleanup of the aggregation session, a rx handler (or release timer)
    on another CPU might still hold a pointer to the reorder buffer and could
    attempt to release some packets.
    Clearing pointers during cleanup avoids a theoretical use-after-free bug here.

    Signed-off-by: Felix Fietkau <nbd@nbd.name>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/net/wireless/mediatek/mt76/agg-rx.c | 1 +
    1 file changed, 1 insertion(+)

    diff --git a/drivers/net/wireless/mediatek/mt76/agg-rx.c b/drivers/net/wireless/mediatek/mt76/agg-rx.c
    index cbff0dfc96311..f8441fd65400c 100644
    --- a/drivers/net/wireless/mediatek/mt76/agg-rx.c
    +++ b/drivers/net/wireless/mediatek/mt76/agg-rx.c
    @@ -268,6 +268,7 @@ static void mt76_rx_aggr_shutdown(struct mt76_dev *dev, struct mt76_rx_tid *tid)
    if (!skb)
    continue;

    + tid->reorder_buf[i] = NULL;
    tid->nframes--;
    dev_kfree_skb(skb);
    }
    --
    2.25.1
    \
     
     \ /
      Last update: 2020-09-18 05:08    [W:5.411 / U:0.056 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site