Skip to content

Commit

Permalink
wifi: ath11k: fix dfs radar event locking
Browse files Browse the repository at this point in the history
The ath11k active pdevs are protected by RCU but the DFS radar event
handling code calling ath11k_mac_get_ar_by_pdev_id() was not marked as a
read-side critical section.

Mark the code in question as an RCU read-side critical section to avoid
any potential use-after-free issues.

Compile tested only.

Fixes: d5c6515 ("ath11k: driver for Qualcomm IEEE 802.11ax devices")
Cc: stable@vger.kernel.org      # 5.6
Acked-by: Jeff Johnson <quic_jjohnson@quicinc.com>
Signed-off-by: Johan Hovold <johan+linaro@kernel.org>
Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
Link: https://lore.kernel.org/r/20231019153115.26401-3-johan+linaro@kernel.org
  • Loading branch information
Johan Hovold authored and Kalle Valo committed Oct 25, 2023
1 parent 1a5352a commit 3b6c148
Showing 1 changed file with 4 additions and 0 deletions.
4 changes: 4 additions & 0 deletions drivers/net/wireless/ath/ath11k/wmi.c
Original file line number Diff line number Diff line change
Expand Up @@ -8336,6 +8336,8 @@ ath11k_wmi_pdev_dfs_radar_detected_event(struct ath11k_base *ab, struct sk_buff
ev->detector_id, ev->segment_id, ev->timestamp, ev->is_chirp,
ev->freq_offset, ev->sidx);

rcu_read_lock();

ar = ath11k_mac_get_ar_by_pdev_id(ab, ev->pdev_id);

if (!ar) {
Expand All @@ -8353,6 +8355,8 @@ ath11k_wmi_pdev_dfs_radar_detected_event(struct ath11k_base *ab, struct sk_buff
ieee80211_radar_detected(ar->hw);

exit:
rcu_read_unlock();

kfree(tb);
}

Expand Down

0 comments on commit 3b6c148

Please sign in to comment.