Received-SPF: pass (google.com: domain of linux-wireless-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Message-ID: <bab80d1c-5ae4-546d-af1a-12d06b6a8d2e@quicinc.com>
Date:   Thu, 18 May 2023 12:46:19 +0530
MIME-Version: 1.0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101
 Thunderbird/102.10.0
Subject: Re: [PATCH] wifi: ath12k: Avoid NULL pointer access during management
 transmit cleanup
To:     Balamurugan S <quic_bselvara@quicinc.com>,
        <ath12k@lists.infradead.org>
CC:     <linux-wireless@vger.kernel.org>
References: <20230518071046.14337-1-quic_bselvara@quicinc.com>
Content-Language: en-US
From:   Vasanthakumar Thiagarajan <quic_vthiagar@quicinc.com>
In-Reply-To: <20230518071046.14337-1-quic_bselvara@quicinc.com>
Content-Type: text/plain; charset="UTF-8"; format=flowed
Content-Transfer-Encoding: 7bit
Precedence: bulk


On 5/18/2023 12:40 PM, Balamurugan S wrote:
> Currently 'ar' reference is not added in skb_cb.
> Though this is generally not used during transmit completion
> callbacks, on interface removal the remaining idr cleanup callback
> uses the ar pointer from skb_cb from management txmgmt_idr. Hence fill them
> during transmit call for proper usage to avoid NULL pointer dereference.
> 
> Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.0.1-00029-QCAHKSWPL_SILICONZ-1
> 
> Signed-off-by: Balamurugan S <quic_bselvara@quicinc.com>
> ---
>   drivers/net/wireless/ath/ath12k/mac.c | 1 +
>   1 file changed, 1 insertion(+)
> 
> diff --git a/drivers/net/wireless/ath/ath12k/mac.c b/drivers/net/wireless/ath/ath12k/mac.c
> index d814d74bc168..a344211f5b53 100644
> --- a/drivers/net/wireless/ath/ath12k/mac.c
> +++ b/drivers/net/wireless/ath/ath12k/mac.c
> @@ -4443,6 +4443,7 @@ static int ath12k_mac_mgmt_tx_wmi(struct ath12k *ar, struct ath12k_vif *arvif,
>   	int buf_id;
>   	int ret;
>   
> +	ATH12K_SKB_CB(skb)->ar = ar;
>   	spin_lock_bh(&ar->txmgmt_idr_lock);
>   	buf_id = idr_alloc(&ar->txmgmt_idr, skb, 0,
>   			   ATH12K_TX_MGMT_NUM_PENDING_MAX, GFP_ATOMIC);
> 
> base-commit: 610b78b97bad8f3e77c27a15e9a03cbbb4109697

LGTM