linux-kernel - Re: [PATCH] wifi: rtw88: schedule rx work after everything is set up

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <96a46df7c4c49b2b033bc7cd8d5cad3306db8ca6.camel@realtek.com>
Date: Fri, 5 Jul 2024 01:45:47 +0000
From: Ping-Ke Shih <pkshih@...ltek.com>
To: "linux-wireless@...r.kernel.org" <linux-wireless@...r.kernel.org>,
        "marcin.slusarz@...il.com" <marcin.slusarz@...il.com>
CC: "tpkuester@...il.com" <tpkuester@...il.com>,
        "kvalo@...nel.org"
	<kvalo@...nel.org>,
        "Larry.Finger@...inger.net" <Larry.Finger@...inger.net>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        "mslusarz@...au.com" <mslusarz@...au.com>
Subject: Re: [PATCH] wifi: rtw88: schedule rx work after everything is set up

On Tue, 2024-05-28 at 13:02 +0200, Marcin Ślusarz wrote:
> 
> From: Marcin Ślusarz <mslusarz@...au.com>
> 
> Right now it's possible to hit NULL pointer dereference in
> rtw_rx_fill_rx_status on hw object and/or its fields because
> initialization routine can start getting USB replies before
> rtw_dev is fully setup.
> 
> The stack trace looks like this:
> 
> rtw_rx_fill_rx_status
> rtw8821c_query_rx_desc
> rtw_usb_rx_handler
> ...
> queue_work
> rtw_usb_read_port_complete
> ...
> usb_submit_urb
> rtw_usb_rx_resubmit
> rtw_usb_init_rx
> rtw_usb_probe
> 
> So while we do the async stuff rtw_usb_probe continues and calls
> rtw_register_hw, which does all kinds of initialization (e.g.
> via ieee80211_register_hw) that rtw_rx_fill_rx_status relies on.
> 
> Fix this by moving the first usb_submit_urb after everything
> is set up.
> 
> For me, this bug manifested as:
> [    8.893177] rtw_8821cu 1-1:1.2: band wrong, packet dropped
> [    8.910904] rtw_8821cu 1-1:1.2: hw->conf.chandef.chan NULL in rtw_rx_fill_rx_status
> because I'm using Larry's backport of rtw88 driver with the NULL
> checks in rtw_rx_fill_rx_status.
> 
> Reported-by: Tim K <tpkuester@...il.com>
> Closes: 
> https://lore.kernel.org/linux-wireless/CA+shoWQ7P49jhQasofDcTdQhiuarPTjYEDa--NiVVx494WcuQw@mail.gmail.com/

Change Closes to Link during committing because of no ACK from Tim.

> Signed-off-by: Marcin Ślusarz <mslusarz@...au.com>
> Cc: Ping-Ke Shih <pkshih@...ltek.com>
> Cc: Larry Finger <Larry.Finger@...inger.net>
> Cc: Kalle Valo <kvalo@...nel.org>
> Cc: linux-wireless@...r.kernel.org
> Cc: linux-kernel@...r.kernel.org
> 

1 patch(es) applied to rtw-next branch of rtw.git, thanks.

adc539784c98 wifi: rtw88: usb: schedule rx work after everything is set up

---
https://github.com/pkshih/rtw.git