mirror of
https://git.proxmox.com/git/mirror_ubuntu-kernels.git
synced 2025-12-08 16:04:49 +00:00
454994cfa9
If ath9k_wmi_cmd() has exited with a timeout, it is possible that during
next ath9k_wmi_cmd() call the wmi_rsp callback for previous wmi command
writes to new wmi->cmd_rsp_buf and makes a completion. This results in an
invalid ath9k_wmi_cmd() return value.
Move the replacement of WMI command response buffer and length under
wmi_lock. Note that last_seq_id value is updated there, too.
Thus, the buffer cannot be written to by a belated wmi_rsp callback
because that path is properly rejected by the last_seq_id check.
Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
Fixes:
|
||
|---|---|---|
| .. | ||
| ar5523 | ||
| ath5k | ||
| ath6kl | ||
| ath9k | ||
| ath10k | ||
| ath11k | ||
| ath12k | ||
| carl9170 | ||
| wcn36xx | ||
| wil6210 | ||
| ath.h | ||
| debug.c | ||
| dfs_pattern_detector.c | ||
| dfs_pattern_detector.h | ||
| dfs_pri_detector.c | ||
| dfs_pri_detector.h | ||
| hw.c | ||
| Kconfig | ||
| key.c | ||
| main.c | ||
| Makefile | ||
| reg.h | ||
| regd_common.h | ||
| regd.c | ||
| regd.h | ||
| spectral_common.h | ||
| trace.c | ||
| trace.h | ||