From patchwork Fri May 12 16:42:02 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Brian Norris X-Patchwork-Id: 9724625 X-Patchwork-Delegate: kvalo@adurom.com Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id E3CEF601E7 for ; Fri, 12 May 2017 16:44:53 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id D1A5B28854 for ; Fri, 12 May 2017 16:44:53 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id C64F42885E; Fri, 12 May 2017 16:44:53 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.5 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,RCVD_IN_DNSWL_HI,RCVD_IN_SORBS_SPAM autolearn=unavailable version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 7E99628854 for ; Fri, 12 May 2017 16:44:53 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1757398AbdELQoi (ORCPT ); Fri, 12 May 2017 12:44:38 -0400 Received: from mail-pf0-f179.google.com ([209.85.192.179]:34891 "EHLO mail-pf0-f179.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S933227AbdELQm3 (ORCPT ); Fri, 12 May 2017 12:42:29 -0400 Received: by mail-pf0-f179.google.com with SMTP id n23so27803637pfb.2 for ; Fri, 12 May 2017 09:42:29 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=7PAj1pwu7hKTT/zC2J1uon/7TO1mVRnj+qDyBKBZP/U=; b=UPm/+ZPEeUVBfI/mgIfL7MJX2S39+97ibbaz758x1OPPHhc0cFcjdo7qI1cm4/eJLv jcS9eo46K7SCyV6ezX2D7Znz/odyUFMo1YF0hgJ8PeX4PaJ/Hn7zSdsPXQ23FWQi4Y1x 0K9XArwWKdVMLWhALBn9cZZKJBZfsSGFUHH1Q= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=7PAj1pwu7hKTT/zC2J1uon/7TO1mVRnj+qDyBKBZP/U=; b=EckQUdrRNxqC+0jVMnJa4rlyIjg4vIwxrg/1NrTAXmU5CtKSJEV1Sl1l+IU+pSBy2/ tMy6m0SyImm09nY94sh3Qg1MZ1Wg48s4C0+WtWTk443NYzGrIa0xXJX4PZnCcfKkmWvA Cv6IYE4yNJrpvlYKzasI9+59fdyvDtTmbm7FspvoExmSigCsf4XZUcIh2UqePrjUEruj COr2y+yhmvaQRn/Gu6epk6878I+0K0TvQdbzY9nfkNLamxAMXKtbT+LvB1V3sic6IvjY o61IKG/rWOe+76Ydyk7RvfSiLo7nSyn/2eB8AieUxSeeASnrhesfYS5Opv3a3YWa4+va uAlQ== X-Gm-Message-State: AODbwcC9W5NnIR+hcVPuCkUl0ppmgHQl5Sl7+d+BgcGvdKXvNU3gYuOa Gkn/pibzqBSOV1CNNRMf4w== X-Received: by 10.99.101.130 with SMTP id z124mr5351517pgb.8.1494607349168; Fri, 12 May 2017 09:42:29 -0700 (PDT) Received: from ban.mtv.corp.google.com ([172.22.64.120]) by smtp.gmail.com with ESMTPSA id u74sm7304499pfk.58.2017.05.12.09.42.28 (version=TLS1_2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Fri, 12 May 2017 09:42:28 -0700 (PDT) From: Brian Norris To: Ganapathi Bhat , Nishant Sarmukadam Cc: , Dmitry Torokhov , Amitkumar Karwar , Kalle Valo , linux-wireless@vger.kernel.org, Doug Anderson , Brian Norris Subject: [PATCH 05/11] mwifiex: don't drop lock between list-retrieval / list-deletion Date: Fri, 12 May 2017 09:42:02 -0700 Message-Id: <20170512164208.38725-5-briannorris@chromium.org> X-Mailer: git-send-email 2.13.0.rc2.291.g57267f2277-goog In-Reply-To: <20170512164208.38725-1-briannorris@chromium.org> References: <20170512164208.38725-1-briannorris@chromium.org> Sender: linux-wireless-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-wireless@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP mwifiex_exec_next_cmd() seems to have a classic TOCTOU race, where we drop the list lock in between retrieving the next command and deleting it from the list. This potentially leaves room for someone else to also retrieve / steal this node from the list (e.g., mwifiex_cancel_all_pending_cmd()). Let's keep holding the lock while we do our 'ps_state' sanity checks. There should be no harm in continuing to hold this lock for a bit more. Noticed only by code inspection. Signed-off-by: Brian Norris --- drivers/net/wireless/marvell/mwifiex/cmdevt.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/drivers/net/wireless/marvell/mwifiex/cmdevt.c b/drivers/net/wireless/marvell/mwifiex/cmdevt.c index 5fd6c53d7b06..95221306a4e5 100644 --- a/drivers/net/wireless/marvell/mwifiex/cmdevt.c +++ b/drivers/net/wireless/marvell/mwifiex/cmdevt.c @@ -761,8 +761,6 @@ int mwifiex_exec_next_cmd(struct mwifiex_adapter *adapter) } cmd_node = list_first_entry(&adapter->cmd_pending_q, struct cmd_ctrl_node, list); - spin_unlock_irqrestore(&adapter->cmd_pending_q_lock, - cmd_pending_q_flags); host_cmd = (struct host_cmd_ds_command *) (cmd_node->cmd_skb->data); priv = cmd_node->priv; @@ -771,11 +769,12 @@ int mwifiex_exec_next_cmd(struct mwifiex_adapter *adapter) mwifiex_dbg(adapter, ERROR, "%s: cannot send cmd in sleep state,\t" "this should not happen\n", __func__); + spin_unlock_irqrestore(&adapter->cmd_pending_q_lock, + cmd_pending_q_flags); spin_unlock_irqrestore(&adapter->mwifiex_cmd_lock, cmd_flags); return ret; } - spin_lock_irqsave(&adapter->cmd_pending_q_lock, cmd_pending_q_flags); list_del(&cmd_node->list); spin_unlock_irqrestore(&adapter->cmd_pending_q_lock, cmd_pending_q_flags);