Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
DMARC-Filter: OpenDMARC Filter v1.3.2 smtp.codeaurora.org 421C960591
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Subject: Re: [PATCH] cw1200: Fix concurrency use-after-free bugs in
 cw1200_hw_scan()
From:   Kalle Valo <kvalo@codeaurora.org>
In-Reply-To: <20181214035521.30388-1-baijiaju1990@gmail.com>
References: <20181214035521.30388-1-baijiaju1990@gmail.com>
To:     Jia-Ju Bai <baijiaju1990@gmail.com>
Cc:     pizza@shaftnet.org, davem@davemloft.net,
        linux-wireless@vger.kernel.org, netdev@vger.kernel.org,
        linux-kernel@vger.kernel.org, Jia-Ju Bai <baijiaju1990@gmail.com>
User-Agent: pwcli/0.0.0-git (https://github.com/kvalo/pwcli/) Python/2.7.12
Message-Id: <20181220064956.02DAB60736@smtp.codeaurora.org>
Date:   Thu, 20 Dec 2018 06:49:56 +0000 (UTC)
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

Jia-Ju Bai <baijiaju1990@gmail.com> wrote:

> The function cw1200_bss_info_changed() and cw1200_hw_scan() can be
> concurrently executed.
> The two functions both access a possible shared variable "frame.skb".
> 
> This shared variable is freed by dev_kfree_skb() in cw1200_upload_beacon(), 
> which is called by cw1200_bss_info_changed(). The free operation is 
> protected by a mutex lock "priv->conf_mutex" in cw1200_bss_info_changed().
> 
> In cw1200_hw_scan(), this shared variable is accessed without the
> protection of the mutex lock "priv->conf_mutex". 
> Thus, concurrency use-after-free bugs may occur.
> 
> To fix these bugs, the original calls to mutex_lock(&priv->conf_mutex) and 
> mutex_unlock(&priv->conf_mutex) are moved to the places, which can 
> protect the accesses to the shared variable.
> 
> Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com>

Patch applied to wireless-drivers-next.git, thanks.

4f68ef64cd7f cw1200: Fix concurrency use-after-free bugs in cw1200_hw_scan()

-- 
https://patchwork.kernel.org/patch/10730469/

https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches