linux-kernel - Re: [PATCH] wifi: rtw88: schedule rx work after everything is set up

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <87jzjf8990.fsf@kernel.org>
Date: Mon, 27 May 2024 20:17:31 +0300
From: Kalle Valo <kvalo@...nel.org>
To: marcin.slusarz@...il.com
Cc: linux-wireless@...r.kernel.org,  Marcin Ślusarz
 <mslusarz@...au.com>,
  Ping-Ke Shih <pkshih@...ltek.com>,  Larry Finger
 <Larry.Finger@...inger.net>,  linux-kernel@...r.kernel.org
Subject: Re: [PATCH] wifi: rtw88: schedule rx work after everything is set up

marcin.slusarz@...il.com writes:

> From: Marcin Ślusarz <mslusarz@...au.com>
>
> Right now it's possible to hit NULL pointer dereference in
> rtw_rx_fill_rx_status on hw object and/or its fields because
> initialization routine can start getting USB replies before
> rtw_dev is fully setup.
>
> The stack trace looks like this:
>
> rtw_rx_fill_rx_status
> rtw8821c_query_rx_desc
> rtw_usb_rx_handler
> ...
> queue_work
> rtw_usb_read_port_complete
> ...
> usb_submit_urb
> rtw_usb_rx_resubmit
> rtw_usb_init_rx
> rtw_usb_probe
>
> So while we do the async stuff rtw_usb_probe continues and calls
> rtw_register_hw, which does all kinds of initialization (e.g.
> via ieee80211_register_hw) that rtw_rx_fill_rx_status relies on.
>
> Fix this by moving the first usb_submit_urb after everything
> is set up.
>
> For me, this bug manifested as:
> [    8.893177] rtw_8821cu 1-1:1.2: band wrong, packet dropped
> [    8.910904] rtw_8821cu 1-1:1.2: hw->conf.chandef.chan NULL in rtw_rx_fill_rx_status
> because I'm using Larry's backport of rtw88 driver with the NULL
> checks in rtw_rx_fill_rx_status.
>
> This should fix:
> https://marc.info/?l=linux-wireless&m=167907688311943&w=2

Please use permalinks from lore.kernel.org, marc links don't contain the
Message-Id and are hence unreliable.

-- 
https://patchwork.kernel.org/project/linux-wireless/list/

https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches