From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Thu, 5 Jun 2014 04:13:03 +0000 (-0700)
Subject: 3.10-stable patches
X-Git-Tag: v3.14.6~9
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=589cd713a2c7da35fa05c3944b6fd5a6cbd193bd;p=thirdparty%2Fkernel%2Fstable-queue.git

3.10-stable patches

added patches:
	ath9k-protect-tid-sched-check.patch
---

diff --git a/queue-3.10/ath9k-protect-tid-sched-check.patch b/queue-3.10/ath9k-protect-tid-sched-check.patch
new file mode 100644
index 00000000000..f5e4d4d88cf
--- /dev/null
+++ b/queue-3.10/ath9k-protect-tid-sched-check.patch
@@ -0,0 +1,71 @@
+From 21f8aaee0c62708654988ce092838aa7df4d25d8 Mon Sep 17 00:00:00 2001
+From: Stanislaw Gruszka <sgruszka@redhat.com>
+Date: Wed, 19 Feb 2014 13:15:17 +0100
+Subject: ath9k: protect tid->sched check
+
+From: Stanislaw Gruszka <sgruszka@redhat.com>
+
+[ Upstream commit 21f8aaee0c62708654988ce092838aa7df4d25d8 ]
+
+We check tid->sched without a lock taken on ath_tx_aggr_sleep(). That
+is race condition which can result of doing list_del(&tid->list) twice
+(second time with poisoned list node) and cause crash like shown below:
+
+[424271.637220] BUG: unable to handle kernel paging request at 00100104
+[424271.637328] IP: [<f90fc072>] ath_tx_aggr_sleep+0x62/0xe0 [ath9k]
+...
+[424271.639953] Call Trace:
+[424271.639998]  [<f90f6900>] ? ath9k_get_survey+0x110/0x110 [ath9k]
+[424271.640083]  [<f90f6942>] ath9k_sta_notify+0x42/0x50 [ath9k]
+[424271.640177]  [<f809cfef>] sta_ps_start+0x8f/0x1c0 [mac80211]
+[424271.640258]  [<c10f730e>] ? free_compound_page+0x2e/0x40
+[424271.640346]  [<f809e915>] ieee80211_rx_handlers+0x9d5/0x2340 [mac80211]
+[424271.640437]  [<c112f048>] ? kmem_cache_free+0x1d8/0x1f0
+[424271.640510]  [<c1345a84>] ? kfree_skbmem+0x34/0x90
+[424271.640578]  [<c10fc23c>] ? put_page+0x2c/0x40
+[424271.640640]  [<c1345a84>] ? kfree_skbmem+0x34/0x90
+[424271.640706]  [<c1345a84>] ? kfree_skbmem+0x34/0x90
+[424271.640787]  [<f809dde3>] ? ieee80211_rx_handlers_result+0x73/0x1d0 [mac80211]
+[424271.640897]  [<f80a07a0>] ieee80211_prepare_and_rx_handle+0x520/0xad0 [mac80211]
+[424271.641009]  [<f809e22d>] ? ieee80211_rx_handlers+0x2ed/0x2340 [mac80211]
+[424271.641104]  [<c13846ce>] ? ip_output+0x7e/0xd0
+[424271.641182]  [<f80a1057>] ieee80211_rx+0x307/0x7c0 [mac80211]
+[424271.641266]  [<f90fa6ee>] ath_rx_tasklet+0x88e/0xf70 [ath9k]
+[424271.641358]  [<f80a0f2c>] ? ieee80211_rx+0x1dc/0x7c0 [mac80211]
+[424271.641445]  [<f90f82db>] ath9k_tasklet+0xcb/0x130 [ath9k]
+
+Bug report:
+https://bugzilla.kernel.org/show_bug.cgi?id=70551
+
+Reported-and-tested-by: Max Sydorenko <maxim.stargazer@gmail.com>
+Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+[ xl: backported to 3.10: adjusted context ]
+Signed-off-by: Xiangyu Lu <luxiangyu@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/wireless/ath/ath9k/xmit.c |    8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath9k/xmit.c
++++ b/drivers/net/wireless/ath/ath9k/xmit.c
+@@ -1255,14 +1255,16 @@ void ath_tx_aggr_sleep(struct ieee80211_
+ 	for (tidno = 0, tid = &an->tid[tidno];
+ 	     tidno < IEEE80211_NUM_TIDS; tidno++, tid++) {
+ 
+-		if (!tid->sched)
+-			continue;
+-
+ 		ac = tid->ac;
+ 		txq = ac->txq;
+ 
+ 		ath_txq_lock(sc, txq);
+ 
++		if (!tid->sched) {
++			ath_txq_unlock(sc, txq);
++			continue;
++		}
++
+ 		buffered = !skb_queue_empty(&tid->buf_q);
+ 
+ 		tid->sched = false;
diff --git a/queue-3.10/series b/queue-3.10/series
index 6552d70145f..15aebb904af 100644
--- a/queue-3.10/series
+++ b/queue-3.10/series
@@ -101,3 +101,4 @@ iommu-amd-fix-interrupt-remapping-for-aliased-devices.patch
 media-fc2580-fix-tuning-failure-on-32-bit-arch.patch
 media-v4l2-ov7670-fix-a-wrong-index-potentially-oopsing-the-kernel-from-user-space.patch
 media-v4l2-fix-vidioc_create_bufs-in-64-32-bit-compatibility-mode.patch
+ath9k-protect-tid-sched-check.patch