Patchwork [3.5.y.z,extended,stable] Patch "ath9k: fix stale pointers potentially causing access to" has been added to staging queue

mail settings
Submitter Herton Ronaldo Krzesinski
Date Dec. 5, 2012, 10:30 p.m.
Message ID <>
Download mbox | patch
Permalink /patch/203998/
State New
Headers show


Herton Ronaldo Krzesinski - Dec. 5, 2012, 10:30 p.m.
This is a note to let you know that I have just added a patch titled

    ath9k: fix stale pointers potentially causing access to

to the linux-3.5.y-queue branch of the 3.5.y.z extended stable tree 
which can be found at:;a=shortlog;h=refs/heads/linux-3.5.y-queue

If you, or anyone else, feels it should not be added to this tree, please 
reply to this email.

For more information about the 3.5.y.z tree, see



From 04738e968780613ff06e2659410a883ca1060673 Mon Sep 17 00:00:00 2001
From: Felix Fietkau <>
Date: Fri, 26 Oct 2012 00:31:11 +0200
Subject: [PATCH] ath9k: fix stale pointers potentially causing access to
 free'd skbs
X-Extended-Stable: 3.5

commit 8c6e30936a7893a85f6222084f0f26aceb81137a upstream.

bf->bf_next is only while buffers are chained as part of an A-MPDU
in the tx queue. When a tid queue is flushed (e.g. on tearing down
an aggregation session), frames can be enqueued again as normal
transmission, without bf_next being cleared. This can lead to the
old pointer being dereferenced again later.

This patch might fix crashes and "Failed to stop TX DMA!" messages.

Signed-off-by: Felix Fietkau <>
Signed-off-by: John W. Linville <>
Signed-off-by: Herton Ronaldo Krzesinski <>
 drivers/net/wireless/ath/ath9k/xmit.c |    2 ++
 1 file changed, 2 insertions(+)



diff --git a/drivers/net/wireless/ath/ath9k/xmit.c b/drivers/net/wireless/ath/ath9k/xmit.c
index b78773b..11f252f 100644
--- a/drivers/net/wireless/ath/ath9k/xmit.c
+++ b/drivers/net/wireless/ath/ath9k/xmit.c
@@ -337,6 +337,7 @@  static struct ath_buf *ath_tx_get_buffer(struct ath_softc *sc)

 	bf = list_first_entry(&sc->tx.txbuf, struct ath_buf, list);
+	bf->bf_next = NULL;

@@ -1760,6 +1761,7 @@  static void ath_tx_send_normal(struct ath_softc *sc, struct ath_txq *txq,
 	list_add_tail(&bf->list, &bf_head);
 	bf->bf_state.bf_type = 0;

+	bf->bf_next = NULL;
 	bf->bf_lastbf = bf;
 	ath_tx_fill_desc(sc, bf, txq, fi->framelen);
 	ath_tx_txqaddbuf(sc, txq, &bf_head, false);