Received-SPF: pass (google.com: domain of linux-wireless+bounces-3012-linux.lists.archive=gmail.com@vger.kernel.org designates 147.75.80.249 as permitted sender) client-ip=147.75.80.249;
Content-Type: text/plain; charset="utf-8"
Precedence: bulk
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit
Subject: Re: [PATCH] wifi: ath9k: delay all of ath9k_wmi_event_tasklet() until
 init is complete
From: Kalle Valo <kvalo@kernel.org>
In-Reply-To: <20240126140218.1033443-1-toke@toke.dk>
References: <20240126140218.1033443-1-toke@toke.dk>
To: =?utf-8?q?Toke_H=C3=B8iland-J=C3=B8rgensen?= <toke@toke.dk>
Cc: =?utf-8?q?Toke_H=C3=B8iland-J=C3=B8rgensen?= <toke@toke.dk>,
 Kalle Valo <quic_kvalo@quicinc.com>,
 Tetsuo Handa <penguin-kernel@i-love.sakura.ne.jp>,
 linux-wireless@vger.kernel.org, =?utf-8?q?Toke_H=C3=B8iland-J=C3=B8rgens?=
	=?utf-8?q?en?= <toke@redhat.com>,
 Ubisectech Sirius <bugreport@ubisectech.com>
User-Agent: pwcli/0.1.1-git (https://github.com/kvalo/pwcli/) Python/3.11.2
Message-ID: <170687400420.3200018.14639804341103572305.kvalo@kernel.org>
Date: Fri,  2 Feb 2024 11:40:06 +0000 (UTC)

Toke Høiland-Jørgensen <toke@toke.dk> wrote:

> The ath9k_wmi_event_tasklet() used in ath9k_htc assumes that all the data
> structures have been fully initialised by the time it runs. However, because of
> the order in which things are initialised, this is not guaranteed to be the
> case, because the device is exposed to the USB subsystem before the ath9k driver
> initialisation is completed.
> 
> We already committed a partial fix for this in commit:
> 8b3046abc99e ("ath9k_htc: fix NULL pointer dereference at ath9k_htc_tx_get_packet()")
> 
> However, that commit only aborted the WMI_TXSTATUS_EVENTID command in the event
> tasklet, pairing it with an "initialisation complete" bit in the TX struct. It
> seems syzbot managed to trigger the race for one of the other commands as well,
> so let's just move the existing synchronisation bit to cover the whole
> tasklet (setting it at the end of ath9k_htc_probe_device() instead of inside
> ath9k_tx_init()).
> 
> Link: https://lore.kernel.org/r/ed1d2c66-1193-4c81-9542-d514c29ba8b8.bugreport@ubisectech.com
> Fixes: 8b3046abc99e ("ath9k_htc: fix NULL pointer dereference at ath9k_htc_tx_get_packet()")
> Reported-by: Ubisectech Sirius <bugreport@ubisectech.com>
> Signed-off-by: Toke Høiland-Jørgensen <toke@redhat.com>
> Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>

Patch applied to ath-next branch of ath.git, thanks.

24355fcb0d4c wifi: ath9k: delay all of ath9k_wmi_event_tasklet() until init is complete

-- 
https://patchwork.kernel.org/project/linux-wireless/patch/20240126140218.1033443-1-toke@toke.dk/

https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches