Commit cf8ce1ea authored by Miaoqing Pan's avatar Miaoqing Pan Committed by Kalle Valo

ath9k: fix tx99 use after free

One scenario that could lead to UAF is two threads writing
simultaneously to the "tx99" debug file. One of them would
set the "start" value to true and follow to ath9k_tx99_init().
Inside the function it would set the sc->tx99_state to true
after allocating sc->tx99skb. Then, the other thread would
execute write_file_tx99() and call ath9k_tx99_deinit().
sc->tx99_state would be freed. After that, the first thread
would continue inside ath9k_tx99_init() and call
r = ath9k_tx99_send(sc, sc->tx99_skb, &txctl);
that would make use of the freed sc->tx99_skb memory.

Cc: <stable@vger.kernel.org>
Signed-off-by: default avatarMiaoqing Pan <miaoqing@codeaurora.org>
Signed-off-by: default avatarKalle Valo <kvalo@qca.qualcomm.com>
parent 57c00f2f
...@@ -189,22 +189,27 @@ static ssize_t write_file_tx99(struct file *file, const char __user *user_buf, ...@@ -189,22 +189,27 @@ static ssize_t write_file_tx99(struct file *file, const char __user *user_buf,
if (strtobool(buf, &start)) if (strtobool(buf, &start))
return -EINVAL; return -EINVAL;
mutex_lock(&sc->mutex);
if (start == sc->tx99_state) { if (start == sc->tx99_state) {
if (!start) if (!start)
return count; goto out;
ath_dbg(common, XMIT, "Resetting TX99\n"); ath_dbg(common, XMIT, "Resetting TX99\n");
ath9k_tx99_deinit(sc); ath9k_tx99_deinit(sc);
} }
if (!start) { if (!start) {
ath9k_tx99_deinit(sc); ath9k_tx99_deinit(sc);
return count; goto out;
} }
r = ath9k_tx99_init(sc); r = ath9k_tx99_init(sc);
if (r) if (r) {
mutex_unlock(&sc->mutex);
return r; return r;
}
out:
mutex_unlock(&sc->mutex);
return count; return count;
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment