forked from Minki/linux
ath9k: Null out references to stale pointers.
This doesn't fix any problem that I'm aware of, but should make it harder to add use-after-free type bugs in the future. Signed-off-by: Ben Greear <greearb@candelatech.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
This commit is contained in:
parent
c1739eb3e6
commit
6cf9e995f9
@ -139,6 +139,7 @@ static struct ath_buf *ath_beacon_generate(struct ieee80211_hw *hw,
|
|||||||
dma_unmap_single(sc->dev, bf->bf_buf_addr,
|
dma_unmap_single(sc->dev, bf->bf_buf_addr,
|
||||||
skb->len, DMA_TO_DEVICE);
|
skb->len, DMA_TO_DEVICE);
|
||||||
dev_kfree_skb_any(skb);
|
dev_kfree_skb_any(skb);
|
||||||
|
bf->bf_buf_addr = 0;
|
||||||
}
|
}
|
||||||
|
|
||||||
/* Get a new beacon from mac80211 */
|
/* Get a new beacon from mac80211 */
|
||||||
@ -167,6 +168,7 @@ static struct ath_buf *ath_beacon_generate(struct ieee80211_hw *hw,
|
|||||||
if (unlikely(dma_mapping_error(sc->dev, bf->bf_buf_addr))) {
|
if (unlikely(dma_mapping_error(sc->dev, bf->bf_buf_addr))) {
|
||||||
dev_kfree_skb_any(skb);
|
dev_kfree_skb_any(skb);
|
||||||
bf->bf_mpdu = NULL;
|
bf->bf_mpdu = NULL;
|
||||||
|
bf->bf_buf_addr = 0;
|
||||||
ath_print(common, ATH_DBG_FATAL,
|
ath_print(common, ATH_DBG_FATAL,
|
||||||
"dma_mapping_error on beaconing\n");
|
"dma_mapping_error on beaconing\n");
|
||||||
return NULL;
|
return NULL;
|
||||||
@ -255,6 +257,7 @@ int ath_beacon_alloc(struct ath_wiphy *aphy, struct ieee80211_vif *vif)
|
|||||||
skb->len, DMA_TO_DEVICE);
|
skb->len, DMA_TO_DEVICE);
|
||||||
dev_kfree_skb_any(skb);
|
dev_kfree_skb_any(skb);
|
||||||
bf->bf_mpdu = NULL;
|
bf->bf_mpdu = NULL;
|
||||||
|
bf->bf_buf_addr = 0;
|
||||||
}
|
}
|
||||||
|
|
||||||
/* NB: the beacon data buffer must be 32-bit aligned. */
|
/* NB: the beacon data buffer must be 32-bit aligned. */
|
||||||
@ -300,6 +303,7 @@ int ath_beacon_alloc(struct ath_wiphy *aphy, struct ieee80211_vif *vif)
|
|||||||
if (unlikely(dma_mapping_error(sc->dev, bf->bf_buf_addr))) {
|
if (unlikely(dma_mapping_error(sc->dev, bf->bf_buf_addr))) {
|
||||||
dev_kfree_skb_any(skb);
|
dev_kfree_skb_any(skb);
|
||||||
bf->bf_mpdu = NULL;
|
bf->bf_mpdu = NULL;
|
||||||
|
bf->bf_buf_addr = 0;
|
||||||
ath_print(common, ATH_DBG_FATAL,
|
ath_print(common, ATH_DBG_FATAL,
|
||||||
"dma_mapping_error on beacon alloc\n");
|
"dma_mapping_error on beacon alloc\n");
|
||||||
return -ENOMEM;
|
return -ENOMEM;
|
||||||
@ -326,6 +330,7 @@ void ath_beacon_return(struct ath_softc *sc, struct ath_vif *avp)
|
|||||||
skb->len, DMA_TO_DEVICE);
|
skb->len, DMA_TO_DEVICE);
|
||||||
dev_kfree_skb_any(skb);
|
dev_kfree_skb_any(skb);
|
||||||
bf->bf_mpdu = NULL;
|
bf->bf_mpdu = NULL;
|
||||||
|
bf->bf_buf_addr = 0;
|
||||||
}
|
}
|
||||||
list_add_tail(&bf->list, &sc->beacon.bbuf);
|
list_add_tail(&bf->list, &sc->beacon.bbuf);
|
||||||
|
|
||||||
|
@ -268,6 +268,7 @@ static int ath_rx_edma_init(struct ath_softc *sc, int nbufs)
|
|||||||
bf->bf_buf_addr))) {
|
bf->bf_buf_addr))) {
|
||||||
dev_kfree_skb_any(skb);
|
dev_kfree_skb_any(skb);
|
||||||
bf->bf_mpdu = NULL;
|
bf->bf_mpdu = NULL;
|
||||||
|
bf->bf_buf_addr = 0;
|
||||||
ath_print(common, ATH_DBG_FATAL,
|
ath_print(common, ATH_DBG_FATAL,
|
||||||
"dma_mapping_error() on RX init\n");
|
"dma_mapping_error() on RX init\n");
|
||||||
error = -ENOMEM;
|
error = -ENOMEM;
|
||||||
@ -358,6 +359,7 @@ int ath_rx_init(struct ath_softc *sc, int nbufs)
|
|||||||
bf->bf_buf_addr))) {
|
bf->bf_buf_addr))) {
|
||||||
dev_kfree_skb_any(skb);
|
dev_kfree_skb_any(skb);
|
||||||
bf->bf_mpdu = NULL;
|
bf->bf_mpdu = NULL;
|
||||||
|
bf->bf_buf_addr = 0;
|
||||||
ath_print(common, ATH_DBG_FATAL,
|
ath_print(common, ATH_DBG_FATAL,
|
||||||
"dma_mapping_error() on RX init\n");
|
"dma_mapping_error() on RX init\n");
|
||||||
error = -ENOMEM;
|
error = -ENOMEM;
|
||||||
@ -392,6 +394,8 @@ void ath_rx_cleanup(struct ath_softc *sc)
|
|||||||
common->rx_bufsize,
|
common->rx_bufsize,
|
||||||
DMA_FROM_DEVICE);
|
DMA_FROM_DEVICE);
|
||||||
dev_kfree_skb(skb);
|
dev_kfree_skb(skb);
|
||||||
|
bf->bf_buf_addr = 0;
|
||||||
|
bf->bf_mpdu = NULL;
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
@ -1733,6 +1737,7 @@ int ath_rx_tasklet(struct ath_softc *sc, int flush, bool hp)
|
|||||||
bf->bf_buf_addr))) {
|
bf->bf_buf_addr))) {
|
||||||
dev_kfree_skb_any(requeue_skb);
|
dev_kfree_skb_any(requeue_skb);
|
||||||
bf->bf_mpdu = NULL;
|
bf->bf_mpdu = NULL;
|
||||||
|
bf->bf_buf_addr = 0;
|
||||||
ath_print(common, ATH_DBG_FATAL,
|
ath_print(common, ATH_DBG_FATAL,
|
||||||
"dma_mapping_error() on RX\n");
|
"dma_mapping_error() on RX\n");
|
||||||
ath_rx_send_to_mac80211(hw, sc, skb, rxs);
|
ath_rx_send_to_mac80211(hw, sc, skb, rxs);
|
||||||
|
@ -1643,6 +1643,7 @@ static int ath_tx_setup_buffer(struct ieee80211_hw *hw, struct ath_buf *bf,
|
|||||||
skb->len, DMA_TO_DEVICE);
|
skb->len, DMA_TO_DEVICE);
|
||||||
if (unlikely(dma_mapping_error(sc->dev, bf->bf_buf_addr))) {
|
if (unlikely(dma_mapping_error(sc->dev, bf->bf_buf_addr))) {
|
||||||
bf->bf_mpdu = NULL;
|
bf->bf_mpdu = NULL;
|
||||||
|
bf->bf_buf_addr = 0;
|
||||||
ath_print(ath9k_hw_common(sc->sc_ah), ATH_DBG_FATAL,
|
ath_print(ath9k_hw_common(sc->sc_ah), ATH_DBG_FATAL,
|
||||||
"dma_mapping_error() on TX\n");
|
"dma_mapping_error() on TX\n");
|
||||||
return -ENOMEM;
|
return -ENOMEM;
|
||||||
@ -1912,6 +1913,7 @@ static void ath_tx_complete_buf(struct ath_softc *sc, struct ath_buf *bf,
|
|||||||
}
|
}
|
||||||
|
|
||||||
dma_unmap_single(sc->dev, bf->bf_buf_addr, skb->len, DMA_TO_DEVICE);
|
dma_unmap_single(sc->dev, bf->bf_buf_addr, skb->len, DMA_TO_DEVICE);
|
||||||
|
bf->bf_buf_addr = 0;
|
||||||
|
|
||||||
if (bf->bf_state.bfs_paprd) {
|
if (bf->bf_state.bfs_paprd) {
|
||||||
if (time_after(jiffies,
|
if (time_after(jiffies,
|
||||||
@ -1924,6 +1926,10 @@ static void ath_tx_complete_buf(struct ath_softc *sc, struct ath_buf *bf,
|
|||||||
ath_debug_stat_tx(sc, txq, bf, ts);
|
ath_debug_stat_tx(sc, txq, bf, ts);
|
||||||
ath_tx_complete(sc, skb, bf->aphy, tx_flags);
|
ath_tx_complete(sc, skb, bf->aphy, tx_flags);
|
||||||
}
|
}
|
||||||
|
/* At this point, skb (bf->bf_mpdu) is consumed...make sure we don't
|
||||||
|
* accidentally reference it later.
|
||||||
|
*/
|
||||||
|
bf->bf_mpdu = NULL;
|
||||||
|
|
||||||
/*
|
/*
|
||||||
* Return the list of ath_buf of this mpdu to free queue
|
* Return the list of ath_buf of this mpdu to free queue
|
||||||
|
Loading…
Reference in New Issue
Block a user