From patchwork Thu Jun 22 01:24:27 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Miaoqing Pan X-Patchwork-Id: 9803211 X-Patchwork-Delegate: kvalo@adurom.com Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id B7A0860234 for ; Thu, 22 Jun 2017 01:25:00 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id A240C283A5 for ; Thu, 22 Jun 2017 01:25:00 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 96A2428554; Thu, 22 Jun 2017 01:25:00 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=2.0 tests=BAYES_00,DKIM_SIGNED, RCVD_IN_DNSWL_HI,T_DKIM_INVALID autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 15020283A5 for ; Thu, 22 Jun 2017 01:25:00 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752017AbdFVBY6 (ORCPT ); Wed, 21 Jun 2017 21:24:58 -0400 Received: from smtp.codeaurora.org ([198.145.29.96]:43892 "EHLO smtp.codeaurora.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751988AbdFVBY5 (ORCPT ); Wed, 21 Jun 2017 21:24:57 -0400 Received: by smtp.codeaurora.org (Postfix, from userid 1000) id C34746032D; Thu, 22 Jun 2017 01:24:56 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=codeaurora.org; s=default; t=1498094696; bh=ekdyHUCdrsvLlE7ox/G3KBe6RU/L6QpsGCMNZ7BOyVA=; h=From:To:Cc:Subject:Date:From; b=Ty42FdMnOGJB7uCg9rOv/CREDZZme54YHuGavlBve3HeyNexurNZxmi0Z1VJr2A+v UXjEEp/fdH6Fg7sbsGWXuptPSQ+c8COosQ8x85riI27KfxM5Fp6/jHbEkKQul98imC 3wFxwqVN0mD0s1l//BYKjDAvGfEBNzvxhDVeZFPA= Received: from smtp.codeaurora.org (unknown [180.166.53.21]) (using TLSv1 with cipher AES128-SHA (128/128 bits)) (No client certificate requested) (Authenticated sender: miaoqing@smtp.codeaurora.org) by smtp.codeaurora.org (Postfix) with ESMTPSA id CD454600EC; Thu, 22 Jun 2017 01:24:53 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=codeaurora.org; s=default; t=1498094696; bh=ekdyHUCdrsvLlE7ox/G3KBe6RU/L6QpsGCMNZ7BOyVA=; h=From:To:Cc:Subject:Date:From; b=Ty42FdMnOGJB7uCg9rOv/CREDZZme54YHuGavlBve3HeyNexurNZxmi0Z1VJr2A+v UXjEEp/fdH6Fg7sbsGWXuptPSQ+c8COosQ8x85riI27KfxM5Fp6/jHbEkKQul98imC 3wFxwqVN0mD0s1l//BYKjDAvGfEBNzvxhDVeZFPA= DMARC-Filter: OpenDMARC Filter v1.3.2 smtp.codeaurora.org CD454600EC Authentication-Results: pdx-caf-mail.web.codeaurora.org; dmarc=none (p=none dis=none) header.from=codeaurora.org Authentication-Results: pdx-caf-mail.web.codeaurora.org; spf=none smtp.mailfrom=miaoqing@codeaurora.org Received: by smtp.codeaurora.org (sSMTP sendmail emulation); Thu, 22 Jun 2017 09:24:32 +0800 From: miaoqing@codeaurora.org To: kvalo@qca.qualcomm.com Cc: linux-wireless@vger.kernel.org, ath9k-devel@qca.qualcomm.com, sssa@qti.qualcomm.com, giulio.genovese@gmail.com, Miaoqing Pan Subject: [PATCH 1/3] ath9k: fixed an invalid pointer dereference Date: Thu, 22 Jun 2017 09:24:27 +0800 Message-Id: <1498094669-6510-1-git-send-email-miaoqing@codeaurora.org> X-Mailer: git-send-email 1.9.1 Sender: linux-wireless-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-wireless@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP From: Miaoqing Pan The bug was triggered when do suspend/resuming continuously on Dell XPS L322X/0PJHXN version 9333 (2013) with kernel 4.12.0-041200rc4-generic. But can't reproduce on DELL E5440 + AR9300 PCIE chips. The warning is caused by accessing invalid pointer sc->rng_task. sc->rng_task is not be cleared after kthread_stop(sc->rng_task) be called in ath9k_rng_stop(). Because the kthread is stopped before ath9k_rng_kthread() be scheduled. So set sc->rng_task to null after kthread_stop(sc->rng_task) to resolve this issue. WARNING: CPU: 0 PID: 984 at linux/kernel/kthread.c:71 kthread_stop+0xf1/0x100 CPU: 0 PID: 984 Comm: NetworkManager Not tainted 4.12.0-041200rc4-generic #201706042031 Hardware name: Dell Inc. Dell System XPS L322X/0PJHXN, BIOS A09 05/15/2013 task: ffff950170fdda00 task.stack: ffffa22c01538000 RIP: 0010:kthread_stop+0xf1/0x100 RSP: 0018:ffffa22c0153b5b0 EFLAGS: 00010246 RAX: ffffffffa6257800 RBX: ffff950171b79560 RCX: 0000000000000000 RDX: 0000000080000000 RSI: 000000007fffffff RDI: ffff9500ac9a9680 RBP: ffffa22c0153b5c8 R08: 0000000000000000 R09: 0000000000000000 R10: ffffa22c0153b648 R11: ffff9501768004b8 R12: ffff9500ac9a9680 R13: ffff950171b79f70 R14: ffff950171b78780 R15: ffff9501749dc018 FS: 00007f0d6bfd5540(0000) GS:ffff95017f200000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fc190161a08 CR3: 0000000232906000 CR4: 00000000001406f0 Call Trace: ath9k_rng_stop+0x1a/0x20 [ath9k] ath9k_stop+0x3b/0x1d0 [ath9k] drv_stop+0x33/0xf0 [mac80211] ieee80211_stop_device+0x43/0x50 [mac80211] ieee80211_do_stop+0x4f2/0x810 [mac80211] Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=196043 Reported-by: Giulio Genovese Tested-by: Giulio Genovese Signed-off-by: Miaoqing Pan --- drivers/net/wireless/ath/ath9k/rng.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/net/wireless/ath/ath9k/rng.c b/drivers/net/wireless/ath/ath9k/rng.c index 568b1c6..73f46fb 100644 --- a/drivers/net/wireless/ath/ath9k/rng.c +++ b/drivers/net/wireless/ath/ath9k/rng.c @@ -120,6 +120,8 @@ void ath9k_rng_start(struct ath_softc *sc) void ath9k_rng_stop(struct ath_softc *sc) { - if (sc->rng_task) + if (sc->rng_task) { kthread_stop(sc->rng_task); + sc->rng_task = NULL; + } }