1 From: Ben Greear <greearb@candelatech.com>
2 Date: Fri, 1 Apr 2016 14:12:09 -0700
3 Subject: [PATCH] ath10k: Ensure peer_map references are cleaned up.
5 While debugging OS crashes due to firmware crashes, I enabled
6 kasan, and it noticed that peer objects were being used-after-freed.
8 Looks like there are two places we could be leaving stale references
9 in the peer-map, so clean that up.
11 Signed-off-by: Ben Greear <greearb@candelatech.com>
14 --- a/drivers/net/wireless/ath/ath10k/mac.c
15 +++ b/drivers/net/wireless/ath/ath10k/mac.c
16 @@ -802,6 +802,7 @@ static void ath10k_peer_cleanup(struct a
18 struct ath10k_peer *peer, *tmp;
22 lockdep_assert_held(&ar->conf_mutex);
24 @@ -818,6 +819,17 @@ static void ath10k_peer_cleanup(struct a
25 ar->peer_map[peer_id] = NULL;
28 + /* Double check that peer is properly un-referenced from
31 + for (i = 0; i < ARRAY_SIZE(ar->peer_map); i++) {
32 + if (ar->peer_map[i] == peer) {
33 + ath10k_warn(ar, "removing stale peer_map entry for %pM (ptr %p idx %d)\n",
34 + peer->addr, peer, i);
35 + ar->peer_map[i] = NULL;
39 list_del(&peer->list);
42 @@ -828,6 +840,7 @@ static void ath10k_peer_cleanup(struct a
43 static void ath10k_peer_cleanup_all(struct ath10k *ar)
45 struct ath10k_peer *peer, *tmp;
48 lockdep_assert_held(&ar->conf_mutex);
50 @@ -836,6 +849,10 @@ static void ath10k_peer_cleanup_all(stru
51 list_del(&peer->list);
55 + for (i = 0; i < ARRAY_SIZE(ar->peer_map); i++)
56 + ar->peer_map[i] = NULL;
58 spin_unlock_bh(&ar->data_lock);