2023-10-19 10:43:18

by Johan Hovold

Subject: [PATCH 0/2] wifi: ath11k: fix event locking

RCU lockdep reported suspicious RCU usage when accessing the temperature
sensor. Inspection revealed that the DFS radar event code was also
missing the required RCU read-side critical section marking.

Johan


Johan Hovold (2):
wifi: ath11k: fix temperature event locking
wifi: ath11k: fix dfs radar event locking

drivers/net/wireless/ath/ath11k/wmi.c | 8 ++++++++
1 file changed, 8 insertions(+)

--
2.41.0

2023-10-19 10:43:20

by Johan Hovold

Subject: [PATCH 2/2] wifi: ath11k: fix dfs radar event locking

The ath11k active pdevs are protected by RCU but the DFS radar event
handling code calling ath11k_mac_get_ar_by_pdev_id() was not marked as a
read-side critical section.

Mark the code in question as an RCU read-side critical section to avoid
any potential use-after-free issues.

Fixes: d5c65159f289 ("ath11k: driver for Qualcomm IEEE 802.11ax devices")
Cc: [email protected] # 5.6
Signed-off-by: Johan Hovold <[email protected]>
---
drivers/net/wireless/ath/ath11k/wmi.c | 4 ++++
1 file changed, 4 insertions(+)

diff --git a/drivers/net/wireless/ath/ath11k/wmi.c b/drivers/net/wireless/ath/ath11k/wmi.c
index 980ff588325d..fe6b70a503d0 100644
--- a/drivers/net/wireless/ath/ath11k/wmi.c
+++ b/drivers/net/wireless/ath/ath11k/wmi.c
@@ -8337,6 +8337,8 @@ ath11k_wmi_pdev_dfs_radar_detected_event(struct ath11k_base *ab, struct sk_buff
ev->detector_id, ev->segment_id, ev->timestamp, ev->is_chirp,
ev->freq_offset, ev->sidx);

+ rcu_read_lock();
+
ar = ath11k_mac_get_ar_by_pdev_id(ab, ev->pdev_id);

if (!ar) {
@@ -8354,6 +8356,8 @@ ath11k_wmi_pdev_dfs_radar_detected_event(struct ath11k_base *ab, struct sk_buff
ieee80211_radar_detected(ar->hw);

exit:
+ rcu_read_unlock();
+
kfree(tb);
}

--
2.41.0