From af148e844b0e23ede567b302ebcb0fd037bd923b Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Thu, 5 Jun 2014 11:12:08 -0700 Subject: [PATCH] 3.4-stable patches added patches: ath9k-protect-tid-sched-check.patch --- queue-3.4/ath9k-protect-tid-sched-check.patch | 76 +++++++++++++++++++ queue-3.4/series | 1 + 2 files changed, 77 insertions(+) create mode 100644 queue-3.4/ath9k-protect-tid-sched-check.patch diff --git a/queue-3.4/ath9k-protect-tid-sched-check.patch b/queue-3.4/ath9k-protect-tid-sched-check.patch new file mode 100644 index 00000000000..fd88aa80a84 --- /dev/null +++ b/queue-3.4/ath9k-protect-tid-sched-check.patch @@ -0,0 +1,76 @@ +From 21f8aaee0c62708654988ce092838aa7df4d25d8 Mon Sep 17 00:00:00 2001 +From: Stanislaw Gruszka +Date: Wed, 19 Feb 2014 13:15:17 +0100 +Subject: ath9k: protect tid->sched check + +From: Stanislaw Gruszka + +commit 21f8aaee0c62708654988ce092838aa7df4d25d8 upstream. + +We check tid->sched without a lock taken on ath_tx_aggr_sleep(). That +is race condition which can result of doing list_del(&tid->list) twice +(second time with poisoned list node) and cause crash like shown below: + +[424271.637220] BUG: unable to handle kernel paging request at 00100104 +[424271.637328] IP: [] ath_tx_aggr_sleep+0x62/0xe0 [ath9k] +... +[424271.639953] Call Trace: +[424271.639998] [] ? ath9k_get_survey+0x110/0x110 [ath9k] +[424271.640083] [] ath9k_sta_notify+0x42/0x50 [ath9k] +[424271.640177] [] sta_ps_start+0x8f/0x1c0 [mac80211] +[424271.640258] [] ? free_compound_page+0x2e/0x40 +[424271.640346] [] ieee80211_rx_handlers+0x9d5/0x2340 [mac80211] +[424271.640437] [] ? kmem_cache_free+0x1d8/0x1f0 +[424271.640510] [] ? kfree_skbmem+0x34/0x90 +[424271.640578] [] ? put_page+0x2c/0x40 +[424271.640640] [] ? kfree_skbmem+0x34/0x90 +[424271.640706] [] ? kfree_skbmem+0x34/0x90 +[424271.640787] [] ? ieee80211_rx_handlers_result+0x73/0x1d0 [mac80211] +[424271.640897] [] ieee80211_prepare_and_rx_handle+0x520/0xad0 [mac80211] +[424271.641009] [] ? ieee80211_rx_handlers+0x2ed/0x2340 [mac80211] +[424271.641104] [] ? ip_output+0x7e/0xd0 +[424271.641182] [] ieee80211_rx+0x307/0x7c0 [mac80211] +[424271.641266] [] ath_rx_tasklet+0x88e/0xf70 [ath9k] +[424271.641358] [] ? ieee80211_rx+0x1dc/0x7c0 [mac80211] +[424271.641445] [] ath9k_tasklet+0xcb/0x130 [ath9k] + +Bug report: +https://bugzilla.kernel.org/show_bug.cgi?id=70551 + +Reported-and-tested-by: Max Sydorenko +Signed-off-by: Stanislaw Gruszka +Signed-off-by: John W. Linville +[bwh: Backported to 3.2: + - Adjust context + - Use spin_unlock_bh() directly] +Signed-off-by: Ben Hutchings +[gkh: backported to 3.4: + - adjust context + - back out bwh's spinlock change] +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wireless/ath/ath9k/xmit.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +--- a/drivers/net/wireless/ath/ath9k/xmit.c ++++ b/drivers/net/wireless/ath/ath9k/xmit.c +@@ -1242,14 +1242,16 @@ void ath_tx_aggr_sleep(struct ieee80211_ + for (tidno = 0, tid = &an->tid[tidno]; + tidno < WME_NUM_TID; tidno++, tid++) { + +- if (!tid->sched) +- continue; +- + ac = tid->ac; + txq = ac->txq; + + ath_txq_lock(sc, txq); + ++ if (!tid->sched) { ++ ath_txq_unlock(sc, txq); ++ continue; ++ } ++ + buffered = !skb_queue_empty(&tid->buf_q); + + tid->sched = false; diff --git a/queue-3.4/series b/queue-3.4/series index c976be8e490..e29b2483357 100644 --- a/queue-3.4/series +++ b/queue-3.4/series @@ -213,3 +213,4 @@ xen-netfront-reduce-gso_max_size-to-account-for-max-tcp-header.patch pci-aspm-don-t-touch-aspm-if-forcibly-disabled.patch hid-logitech-don-t-use-stack-based-dj_report-structures.patch dj-memory-scribble-in-logi_dj.patch +ath9k-protect-tid-sched-check.patch -- 2.47.3