The bug is here: rcu_assign_pointer(ar->tx_ampdu_iter, (struct carl9170_sta_tid *) &ar->tx_ampdu_list);
The 'ar->tx_ampdu_iter' is used as a list iterator variable which point to a structure object containing the list HEAD (&ar->tx_ampdu_list), not as the HEAD itself.
The only use case of 'ar->tx_ampdu_iter' is as a base pos for list_for_each_entry_continue_rcu in carl9170_tx_ampdu(). If the iterator variable holds the *wrong* HEAD value here (has not been modified elsewhere before), this will lead to an invalid memory access.
Using list_entry_rcu to get the right list iterator variable and reassign it, to fix this bug. Note: use 'ar->tx_ampdu_list.next' instead of '&ar->tx_ampdu_list' to avoid compiler error.
Cc: stable@vger.kernel.org Fixes: fe8ee9ad80b28 ("carl9170: mac80211 glue and command interface") Signed-off-by: Xiaomeng Tong xiam0nd.tong@gmail.com --- drivers/net/wireless/ath/carl9170/main.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/drivers/net/wireless/ath/carl9170/main.c b/drivers/net/wireless/ath/carl9170/main.c index 49f7ee1c912b..a287937bf666 100644 --- a/drivers/net/wireless/ath/carl9170/main.c +++ b/drivers/net/wireless/ath/carl9170/main.c @@ -1756,6 +1756,7 @@ static const struct ieee80211_ops carl9170_ops = {
void *carl9170_alloc(size_t priv_size) { + struct carl9170_sta_tid *tid_info; struct ieee80211_hw *hw; struct ar9170 *ar; struct sk_buff *skb; @@ -1815,8 +1816,9 @@ void *carl9170_alloc(size_t priv_size) INIT_DELAYED_WORK(&ar->stat_work, carl9170_stat_work); INIT_DELAYED_WORK(&ar->tx_janitor, carl9170_tx_janitor); INIT_LIST_HEAD(&ar->tx_ampdu_list); - rcu_assign_pointer(ar->tx_ampdu_iter, - (struct carl9170_sta_tid *) &ar->tx_ampdu_list); + tid_info = list_entry_rcu(ar->tx_ampdu_list.next, + struct carl9170_sta_tid, list); + rcu_assign_pointer(ar->tx_ampdu_iter, tid_info);
bitmap_zero(&ar->vif_bitmap, ar->fw.vif_num); INIT_LIST_HEAD(&ar->vif_list);