From patchwork Wed Jul 17 04:13:26 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Vasanthakumar Thiagarajan X-Patchwork-Id: 11047147 X-Patchwork-Delegate: kvalo@adurom.com Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 713B3746 for ; Wed, 17 Jul 2019 04:13:56 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 53AA928699 for ; Wed, 17 Jul 2019 04:13:56 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 42A4128716; Wed, 17 Jul 2019 04:13:56 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-5.2 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,MAILING_LIST_MULTI,RCVD_IN_DNSWL_MED autolearn=ham version=3.3.1 Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id BBB3E28699 for ; Wed, 17 Jul 2019 04:13:55 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20170209; h=Sender: Content-Transfer-Encoding:Content-Type:MIME-Version:List-Subscribe:List-Help: List-Post:List-Archive:List-Unsubscribe:List-Id:Message-Id:Date:Subject:To: From:Reply-To:Cc:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References: List-Owner; bh=drzsQg9D2cKVTiien0t9uawmql8ewXHPEjb+0YYvwZk=; b=mv7Dbd7g1Gfuan i7EHzB0WwwXKC5bLTyLEhEWT512xNnYAvLBpG/SXVGsM0izqUtZR7t3VCDV8zocwaJZgCgKx1fm2X IweDDO2j03DUfGS8339xvELaGVwc7N33DEcuOxpfWJJ/6UNomyqy/Hh3mfFAAEt7m9LR6PZ4oRISH KtI0m4MYDf3GeFIGhJn020/vsZtSn7tPh7RCy+E7odvi/8jW8zz6lXFtUqkMYF2QM9zdwc4QxzEgo Oj05hQtKduF8qj9GqT6DAXtdmT2QH/ruLp3wbT5+syM7RRqmxGZWcpgffC7qd0aIhowHCZIn7uKwe Y8McUWYgo+RuS1w48V4g==; Received: from localhost ([127.0.0.1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.92 #3 (Red Hat Linux)) id 1hnbKE-0003B0-7Y; Wed, 17 Jul 2019 04:13:54 +0000 Received: from smtp.codeaurora.org ([198.145.29.96]) by bombadil.infradead.org with esmtps (Exim 4.92 #3 (Red Hat Linux)) id 1hnbK9-0003AO-DB for ath11k@lists.infradead.org; Wed, 17 Jul 2019 04:13:50 +0000 Received: by smtp.codeaurora.org (Postfix, from userid 1000) id 5298E611DC; Wed, 17 Jul 2019 04:13:48 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=codeaurora.org; s=default; t=1563336828; bh=u7mUjmNhM1dOY5ZuRnHEcia7Bo8kg553a6ZwMATrUaw=; h=From:To:Subject:Date:From; b=ANciEebz6DuG+g7knWMvFvoab3eJGhfHcxYp9Z7myGos+X0+y1wOSjZs3F6GSs44C yStS95dQtlCjXeMU7djnswXxw1Pyu+2oPF2TUYMsr4cTFt1U8iybwYrna6FPQvRX4O MCYnRpqiLvO+qhqsJ4RoxcOWFc6BrXXSO+C/FXls= Received: from vasanth-lnx.qca.qualcomm.com (blr-c-bdr-fw-01_globalnat_allzones-outside.qualcomm.com [103.229.19.19]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-SHA256 (128/128 bits)) (No client certificate requested) (Authenticated sender: vthiagar@smtp.codeaurora.org) by smtp.codeaurora.org (Postfix) with ESMTPSA id 54261611CF for ; Wed, 17 Jul 2019 04:13:47 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=codeaurora.org; s=default; t=1563336828; bh=u7mUjmNhM1dOY5ZuRnHEcia7Bo8kg553a6ZwMATrUaw=; h=From:To:Subject:Date:From; b=ANciEebz6DuG+g7knWMvFvoab3eJGhfHcxYp9Z7myGos+X0+y1wOSjZs3F6GSs44C yStS95dQtlCjXeMU7djnswXxw1Pyu+2oPF2TUYMsr4cTFt1U8iybwYrna6FPQvRX4O MCYnRpqiLvO+qhqsJ4RoxcOWFc6BrXXSO+C/FXls= DMARC-Filter: OpenDMARC Filter v1.3.2 smtp.codeaurora.org 54261611CF Authentication-Results: pdx-caf-mail.web.codeaurora.org; dmarc=none (p=none dis=none) header.from=codeaurora.org Authentication-Results: pdx-caf-mail.web.codeaurora.org; spf=none smtp.mailfrom=vthiagar@codeaurora.org From: Vasanthakumar Thiagarajan To: ath11k@lists.infradead.org Subject: [PATCH] ath11k/dp: Fix possible invalid skb memory access Date: Wed, 17 Jul 2019 09:43:26 +0530 Message-Id: <1563336807-23646-1-git-send-email-vthiagar@codeaurora.org> X-Mailer: git-send-email 1.9.1 X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20190716_211349_469178_290E9A6D X-CRM114-Status: UNSURE ( 9.82 ) X-CRM114-Notice: Please train this message. X-BeenThere: ath11k@lists.infradead.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Sender: "ath11k" Errors-To: ath11k-bounces+patchwork-ath11k=patchwork.kernel.org@lists.infradead.org X-Virus-Scanned: ClamAV using ClamSMTP In ath11k_dp_rx_null_q_desc_sg_drop(), Use skb_queue_walk_safe() instead of skb_queue_walk() while processing skb from the queue since this involves removing skb from the list. Using just skb_queue_walk() could result in using invalid (or already freed) skb memory. Signed-off-by: Vasanthakumar Thiagarajan --- drivers/net/wireless/ath/ath11k/dp_rx.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/net/wireless/ath/ath11k/dp_rx.c b/drivers/net/wireless/ath/ath11k/dp_rx.c index d074d90..fbe7f34 100644 --- a/drivers/net/wireless/ath/ath11k/dp_rx.c +++ b/drivers/net/wireless/ath/ath11k/dp_rx.c @@ -2907,14 +2907,14 @@ static void ath11k_dp_rx_null_q_desc_sg_drop(struct ath11k *ar, int msdu_len, struct sk_buff_head *msdu_list) { - struct sk_buff *skb; + struct sk_buff *skb, *tmp; struct ath11k_skb_rxcb *rxcb; int n_buffs; n_buffs = DIV_ROUND_UP(msdu_len, (DP_RX_BUFFER_SIZE - HAL_RX_DESC_SIZE)); - skb_queue_walk(msdu_list, skb) { + skb_queue_walk_safe(msdu_list, skb, tmp) { rxcb = ATH11K_SKB_RXCB(skb); if (rxcb->err_rel_src == HAL_WBM_REL_SRC_MODULE_REO && rxcb->err_code == HAL_REO_DEST_RING_ERROR_CODE_DESC_ADDR_ZERO) {