diff mbox

[1/1,SRU,Zesty] ath9k: fix an invalid pointer dereference in ath9k_rng_stop()

Message ID 20170720051845.31541-2-kai.heng.feng@canonical.com
State New
Headers show

Commit Message

Kai-Heng Feng July 20, 2017, 5:18 a.m. UTC 
From: Miaoqing Pan <miaoqing@codeaurora.org>

BugLink: https://bugs.launchpad.net/bugs/1697027

The bug was triggered when do suspend/resuming continuously
on Dell XPS L322X/0PJHXN version 9333 (2013) with kernel
4.12.0-041200rc4-generic. But can't reproduce on DELL
E5440 + AR9300 PCIE chips.

The warning is caused by accessing invalid pointer sc->rng_task.
sc->rng_task is not be cleared after kthread_stop(sc->rng_task)
be called in ath9k_rng_stop(). Because the kthread is stopped
before ath9k_rng_kthread() be scheduled.

So set sc->rng_task to null after kthread_stop(sc->rng_task) to
resolve this issue.

WARNING: CPU: 0 PID: 984 at linux/kernel/kthread.c:71 kthread_stop+0xf1/0x100
CPU: 0 PID: 984 Comm: NetworkManager Not tainted 4.12.0-041200rc4-generic #201706042031
Hardware name: Dell Inc.          Dell System XPS L322X/0PJHXN, BIOS A09 05/15/2013
task: ffff950170fdda00 task.stack: ffffa22c01538000
RIP: 0010:kthread_stop+0xf1/0x100
RSP: 0018:ffffa22c0153b5b0 EFLAGS: 00010246
RAX: ffffffffa6257800 RBX: ffff950171b79560 RCX: 0000000000000000
RDX: 0000000080000000 RSI: 000000007fffffff RDI: ffff9500ac9a9680
RBP: ffffa22c0153b5c8 R08: 0000000000000000 R09: 0000000000000000
R10: ffffa22c0153b648 R11: ffff9501768004b8 R12: ffff9500ac9a9680
R13: ffff950171b79f70 R14: ffff950171b78780 R15: ffff9501749dc018
FS:  00007f0d6bfd5540(0000) GS:ffff95017f200000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fc190161a08 CR3: 0000000232906000 CR4: 00000000001406f0
Call Trace:
  ath9k_rng_stop+0x1a/0x20 [ath9k]
  ath9k_stop+0x3b/0x1d0 [ath9k]
  drv_stop+0x33/0xf0 [mac80211]
  ieee80211_stop_device+0x43/0x50 [mac80211]
  ieee80211_do_stop+0x4f2/0x810 [mac80211]

Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=196043
Reported-by: Giulio Genovese <giulio.genovese@gmail.com>
Tested-by: Giulio Genovese <giulio.genovese@gmail.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Miaoqing Pan <miaoqing@codeaurora.org>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
(cherry picked from commit 07246c115801c27652700e3679bb58661ef7ed65)
Signed-off-by: Kai-Heng Feng <kai.heng.feng@canonical.com>
---
 drivers/net/wireless/ath/ath9k/rng.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

Comments

Stefan Bader July 21, 2017, 8:34 a.m. UTC | #1 
On 20.07.2017 07:18, Kai-Heng Feng wrote:
> From: Miaoqing Pan <miaoqing@codeaurora.org>
> 
> BugLink: https://bugs.launchpad.net/bugs/1697027
> 
> The bug was triggered when do suspend/resuming continuously
> on Dell XPS L322X/0PJHXN version 9333 (2013) with kernel
> 4.12.0-041200rc4-generic. But can't reproduce on DELL
> E5440 + AR9300 PCIE chips.
> 
> The warning is caused by accessing invalid pointer sc->rng_task.
> sc->rng_task is not be cleared after kthread_stop(sc->rng_task)
> be called in ath9k_rng_stop(). Because the kthread is stopped
> before ath9k_rng_kthread() be scheduled.
> 
> So set sc->rng_task to null after kthread_stop(sc->rng_task) to
> resolve this issue.
> 
> WARNING: CPU: 0 PID: 984 at linux/kernel/kthread.c:71 kthread_stop+0xf1/0x100
> CPU: 0 PID: 984 Comm: NetworkManager Not tainted 4.12.0-041200rc4-generic #201706042031
> Hardware name: Dell Inc.          Dell System XPS L322X/0PJHXN, BIOS A09 05/15/2013
> task: ffff950170fdda00 task.stack: ffffa22c01538000
> RIP: 0010:kthread_stop+0xf1/0x100
> RSP: 0018:ffffa22c0153b5b0 EFLAGS: 00010246
> RAX: ffffffffa6257800 RBX: ffff950171b79560 RCX: 0000000000000000
> RDX: 0000000080000000 RSI: 000000007fffffff RDI: ffff9500ac9a9680
> RBP: ffffa22c0153b5c8 R08: 0000000000000000 R09: 0000000000000000
> R10: ffffa22c0153b648 R11: ffff9501768004b8 R12: ffff9500ac9a9680
> R13: ffff950171b79f70 R14: ffff950171b78780 R15: ffff9501749dc018
> FS:  00007f0d6bfd5540(0000) GS:ffff95017f200000(0000) knlGS:0000000000000000
> CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: 00007fc190161a08 CR3: 0000000232906000 CR4: 00000000001406f0
> Call Trace:
>   ath9k_rng_stop+0x1a/0x20 [ath9k]
>   ath9k_stop+0x3b/0x1d0 [ath9k]
>   drv_stop+0x33/0xf0 [mac80211]
>   ieee80211_stop_device+0x43/0x50 [mac80211]
>   ieee80211_do_stop+0x4f2/0x810 [mac80211]
> 
> Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=196043
> Reported-by: Giulio Genovese <giulio.genovese@gmail.com>
> Tested-by: Giulio Genovese <giulio.genovese@gmail.com>
> Cc: <stable@vger.kernel.org>
> Signed-off-by: Miaoqing Pan <miaoqing@codeaurora.org>
> Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
> (cherry picked from commit 07246c115801c27652700e3679bb58661ef7ed65)
> Signed-off-by: Kai-Heng Feng <kai.heng.feng@canonical.com>
Acked-by: Stefan Bader <stefan.bader@canonical.com>

> ---
>  drivers/net/wireless/ath/ath9k/rng.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/net/wireless/ath/ath9k/rng.c b/drivers/net/wireless/ath/ath9k/rng.c
> index 568b1c6c2b2b..73f46fb3e83a 100644
> --- a/drivers/net/wireless/ath/ath9k/rng.c
> +++ b/drivers/net/wireless/ath/ath9k/rng.c
> @@ -120,6 +120,8 @@ void ath9k_rng_start(struct ath_softc *sc)
>  
>  void ath9k_rng_stop(struct ath_softc *sc)
>  {
> -	if (sc->rng_task)
> +	if (sc->rng_task) {
>  		kthread_stop(sc->rng_task);
> +		sc->rng_task = NULL;
> +	}
>  }
>
Colin Ian King July 21, 2017, 9:01 a.m. UTC | #2 
On 20/07/17 06:18, Kai-Heng Feng wrote:
> From: Miaoqing Pan <miaoqing@codeaurora.org>
> 
> BugLink: https://bugs.launchpad.net/bugs/1697027
> 
> The bug was triggered when do suspend/resuming continuously
> on Dell XPS L322X/0PJHXN version 9333 (2013) with kernel
> 4.12.0-041200rc4-generic. But can't reproduce on DELL
> E5440 + AR9300 PCIE chips.
> 
> The warning is caused by accessing invalid pointer sc->rng_task.
> sc->rng_task is not be cleared after kthread_stop(sc->rng_task)
> be called in ath9k_rng_stop(). Because the kthread is stopped
> before ath9k_rng_kthread() be scheduled.
> 
> So set sc->rng_task to null after kthread_stop(sc->rng_task) to
> resolve this issue.
> 
> WARNING: CPU: 0 PID: 984 at linux/kernel/kthread.c:71 kthread_stop+0xf1/0x100
> CPU: 0 PID: 984 Comm: NetworkManager Not tainted 4.12.0-041200rc4-generic #201706042031
> Hardware name: Dell Inc.          Dell System XPS L322X/0PJHXN, BIOS A09 05/15/2013
> task: ffff950170fdda00 task.stack: ffffa22c01538000
> RIP: 0010:kthread_stop+0xf1/0x100
> RSP: 0018:ffffa22c0153b5b0 EFLAGS: 00010246
> RAX: ffffffffa6257800 RBX: ffff950171b79560 RCX: 0000000000000000
> RDX: 0000000080000000 RSI: 000000007fffffff RDI: ffff9500ac9a9680
> RBP: ffffa22c0153b5c8 R08: 0000000000000000 R09: 0000000000000000
> R10: ffffa22c0153b648 R11: ffff9501768004b8 R12: ffff9500ac9a9680
> R13: ffff950171b79f70 R14: ffff950171b78780 R15: ffff9501749dc018
> FS:  00007f0d6bfd5540(0000) GS:ffff95017f200000(0000) knlGS:0000000000000000
> CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: 00007fc190161a08 CR3: 0000000232906000 CR4: 00000000001406f0
> Call Trace:
>   ath9k_rng_stop+0x1a/0x20 [ath9k]
>   ath9k_stop+0x3b/0x1d0 [ath9k]
>   drv_stop+0x33/0xf0 [mac80211]
>   ieee80211_stop_device+0x43/0x50 [mac80211]
>   ieee80211_do_stop+0x4f2/0x810 [mac80211]
> 
> Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=196043
> Reported-by: Giulio Genovese <giulio.genovese@gmail.com>
> Tested-by: Giulio Genovese <giulio.genovese@gmail.com>
> Cc: <stable@vger.kernel.org>
> Signed-off-by: Miaoqing Pan <miaoqing@codeaurora.org>
> Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
> (cherry picked from commit 07246c115801c27652700e3679bb58661ef7ed65)
> Signed-off-by: Kai-Heng Feng <kai.heng.feng@canonical.com>
> ---
>  drivers/net/wireless/ath/ath9k/rng.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/net/wireless/ath/ath9k/rng.c b/drivers/net/wireless/ath/ath9k/rng.c
> index 568b1c6c2b2b..73f46fb3e83a 100644
> --- a/drivers/net/wireless/ath/ath9k/rng.c
> +++ b/drivers/net/wireless/ath/ath9k/rng.c
> @@ -120,6 +120,8 @@ void ath9k_rng_start(struct ath_softc *sc)
>  
>  void ath9k_rng_stop(struct ath_softc *sc)
>  {
> -	if (sc->rng_task)
> +	if (sc->rng_task) {
>  		kthread_stop(sc->rng_task);
> +		sc->rng_task = NULL;
> +	}
>  }
> 

Clean cherry pick, addresses the problem, looks good to me.

Acked-by: Colin Ian King <colin.king@canonical.com>
Seth Forshee July 24, 2017, 2:39 p.m. UTC | #3 
On Thu, Jul 20, 2017 at 01:18:45PM +0800, Kai-Heng Feng wrote:
> From: Miaoqing Pan <miaoqing@codeaurora.org>
> 
> BugLink: https://bugs.launchpad.net/bugs/1697027
> 
> The bug was triggered when do suspend/resuming continuously
> on Dell XPS L322X/0PJHXN version 9333 (2013) with kernel
> 4.12.0-041200rc4-generic. But can't reproduce on DELL
> E5440 + AR9300 PCIE chips.
> 
> The warning is caused by accessing invalid pointer sc->rng_task.
> sc->rng_task is not be cleared after kthread_stop(sc->rng_task)
> be called in ath9k_rng_stop(). Because the kthread is stopped
> before ath9k_rng_kthread() be scheduled.
> 
> So set sc->rng_task to null after kthread_stop(sc->rng_task) to
> resolve this issue.
> 
> WARNING: CPU: 0 PID: 984 at linux/kernel/kthread.c:71 kthread_stop+0xf1/0x100
> CPU: 0 PID: 984 Comm: NetworkManager Not tainted 4.12.0-041200rc4-generic #201706042031
> Hardware name: Dell Inc.          Dell System XPS L322X/0PJHXN, BIOS A09 05/15/2013
> task: ffff950170fdda00 task.stack: ffffa22c01538000
> RIP: 0010:kthread_stop+0xf1/0x100
> RSP: 0018:ffffa22c0153b5b0 EFLAGS: 00010246
> RAX: ffffffffa6257800 RBX: ffff950171b79560 RCX: 0000000000000000
> RDX: 0000000080000000 RSI: 000000007fffffff RDI: ffff9500ac9a9680
> RBP: ffffa22c0153b5c8 R08: 0000000000000000 R09: 0000000000000000
> R10: ffffa22c0153b648 R11: ffff9501768004b8 R12: ffff9500ac9a9680
> R13: ffff950171b79f70 R14: ffff950171b78780 R15: ffff9501749dc018
> FS:  00007f0d6bfd5540(0000) GS:ffff95017f200000(0000) knlGS:0000000000000000
> CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: 00007fc190161a08 CR3: 0000000232906000 CR4: 00000000001406f0
> Call Trace:
>   ath9k_rng_stop+0x1a/0x20 [ath9k]
>   ath9k_stop+0x3b/0x1d0 [ath9k]
>   drv_stop+0x33/0xf0 [mac80211]
>   ieee80211_stop_device+0x43/0x50 [mac80211]
>   ieee80211_do_stop+0x4f2/0x810 [mac80211]
> 
> Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=196043
> Reported-by: Giulio Genovese <giulio.genovese@gmail.com>
> Tested-by: Giulio Genovese <giulio.genovese@gmail.com>
> Cc: <stable@vger.kernel.org>
> Signed-off-by: Miaoqing Pan <miaoqing@codeaurora.org>
> Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
> (cherry picked from commit 07246c115801c27652700e3679bb58661ef7ed65)
> Signed-off-by: Kai-Heng Feng <kai.heng.feng@canonical.com>

Applied to artful/master-next and unstable/master, thanks.
Kleber Sacilotto de Souza Aug. 7, 2017, 1 p.m. UTC | #4 
Applied on zesty master-next branch.

Thank you,
Kleber
diff mbox

Patch

diff --git a/drivers/net/wireless/ath/ath9k/rng.c b/drivers/net/wireless/ath/ath9k/rng.c
index 568b1c6c2b2b..73f46fb3e83a 100644
--- a/drivers/net/wireless/ath/ath9k/rng.c
+++ b/drivers/net/wireless/ath/ath9k/rng.c
@@ -120,6 +120,8 @@  void ath9k_rng_start(struct ath_softc *sc)
 
 void ath9k_rng_stop(struct ath_softc *sc)
 {
-	if (sc->rng_task)
+	if (sc->rng_task) {
 		kthread_stop(sc->rng_task);
+		sc->rng_task = NULL;
+	}
 }