iwl3945: fix possible il->txq NULL pointer dereference in delayed works

commit 210787e82a0ac1ffb5d7be1c796f0c51050849ad upstream.

On il3945_down procedure we free tx queue data and nullify il->txq
pointer. After that we drop mutex and then cancel delayed works. There
is possibility, that after drooping mutex and before the cancel, some
delayed work will start and crash while trying to send commands to
the device. For example, here is reported crash in
il3945_bg_reg_txpower_periodic():
https://bugzilla.kernel.org/show_bug.cgi?id=42766#c10

Patch fix problem by adding il->txq check on works that send commands,
hence utilize tx queue.

Reported-by: Clemens Eisserer <linuxhippy@gmail.com>
Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

diff --git a/drivers/net/wireless/iwlegacy/iwl-3945.c b/drivers/net/wireless/iwlegacy/iwl-3945.c
index f7c0a7438476c6e62ed981d1692f7bff42aeb19c..7d1aa7c3efcff2e6cd3f320ec251e50b6fe0bb29 100644 (file)
--- a/drivers/net/wireless/iwlegacy/iwl-3945.c
+++ b/drivers/net/wireless/iwlegacy/iwl-3945.c
@@ -1870,11 +1870,12 @@ static void iwl3945_bg_reg_txpower_periodic(struct work_struct *work)
        struct iwl_priv *priv = container_of(work, struct iwl_priv,
                                             _3945.thermal_periodic.work);
 
-       if (test_bit(STATUS_EXIT_PENDING, &priv->status))
-               return;
-
        mutex_lock(&priv->mutex);
+       if (test_bit(STATUS_EXIT_PENDING, &priv->status) || priv->txq == NULL)
+               goto out;
+
        iwl3945_reg_txpower_periodic(priv);
+out:
        mutex_unlock(&priv->mutex);
 }
 

diff --git a/drivers/net/wireless/iwlegacy/iwl3945-base.c b/drivers/net/wireless/iwlegacy/iwl3945-base.c
index 05f2ad18fac684efc23cefb4b8119220b2238fe5..b3d9f3fb44a2cca7921bdfd6e74b2da64cc34fa5 100644 (file)
--- a/drivers/net/wireless/iwlegacy/iwl3945-base.c
+++ b/drivers/net/wireless/iwlegacy/iwl3945-base.c
@@ -2513,7 +2513,7 @@ static void iwl3945_bg_alive_start(struct work_struct *data)
            container_of(data, struct iwl_priv, alive_start.work);
 
        mutex_lock(&priv->mutex);
-       if (test_bit(STATUS_EXIT_PENDING, &priv->status))
+       if (test_bit(STATUS_EXIT_PENDING, &priv->status) || priv->txq == NULL)
                goto out;
 
        iwl3945_alive_start(priv);