Revert "ath9k: fix ath_tx_process_buffer() potential null ptr dereference"
authorShuah Khan <skhan@linuxfoundation.org>
Wed, 17 Feb 2021 21:18:01 +0000 (14:18 -0700)
committerKalle Valo <kvalo@codeaurora.org>
Mon, 22 Feb 2021 07:32:28 +0000 (09:32 +0200)
commit14ebaeeff8d0f2d5d59b6df6b59f54345839f9d9
treee7087981eb3811f5df2ffb7521b67fafef555346
parent6b7abacb9cbe45894a385ea1766fd4febbd6e0df
Revert "ath9k: fix ath_tx_process_buffer() potential null ptr dereference"

This reverts commit a56c14bb21b296fb6d395164ab62ef2e419e5069.

ath_tx_process_buffer() doesn't dereference or check sta and passes it
to ath_tx_complete_aggr() and ath_tx_complete_buf().

ath_tx_complete_aggr() checks the pointer before use. No problem here.

ath_tx_complete_buf() doesn't check or dereference sta and passes it on
to ath_tx_complete(). ath_tx_complete() doesn't check or dereference sta,
but assigns it to tx_info->status.status_driver_data[0]

ath_tx_complete_buf() is called from ath_tx_complete_aggr() passing
null ieee80211_sta pointer.

There is a potential for dereference later on, if and when the
tx_info->status.status_driver_data[0]is referenced. In addition, the
rcu read lock might be released before referencing the contents.

ath_tx_complete_buf() should be fixed to check sta perhaps? Worth
looking into.

Reverting this patch because it doesn't solve the problem and introduces
memory leak by skipping buffer completion if the pointer (sta) is NULL.

Fixes: a56c14bb21b2 ("ath9k: fix ath_tx_process_buffer() potential null ptr dereference")
Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20210217211801.22540-1-skhan@linuxfoundation.org
drivers/net/wireless/ath/ath9k/xmit.c