Patch "ath9k: fix tx99 use after free" has been added to the 4.12-stable tree

This is a note to let you know that I've just added the patch titled

ath9k: fix tx99 use after free

to the 4.12-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:

     ath9k-fix-tx99-use-after-free.patch

and it can be found in the queue-4.12 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

From: Miaoqing Pan <[email protected]>
Date: Tue, 27 Jun 2017 17:31:49 +0300
Subject: ath9k: fix tx99 use after free

From: Miaoqing Pan <[email protected]>

commit cf8ce1ea61b75712a154c93e40f2a5af2e4dd997 upstream.

One scenario that could lead to UAF is two threads writing simultaneously to the "tx99" debug file. One of them would set the "start" value to true and follow to ath9k_tx99_init(). Inside the function it would set the sc->tx99_state to true after allocating sc->tx99skb. Then, the other thread would execute write_file_tx99() and call ath9k_tx99_deinit(). sc->tx99_state would be freed. After that, the first thread would continue inside ath9k_tx99_init() and call
r = ath9k_tx99_send(sc, sc->tx99_skb, &txctl);
that would make use of the freed sc->tx99_skb memory.

---
 drivers/net/wireless/ath/ath9k/tx99.c |   13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

@@ -189,22 +189,27 @@ static ssize_t write_file_tx99(struct fi
 	if (strtobool(buf, &start))
 		return -EINVAL;
 
+	mutex_lock(&sc->mutex);
+
 	if (start == sc->tx99_state) {
 		if (!start)
-			return count;
+			goto out;
 		ath_dbg(common, XMIT, "Resetting TX99\n");
 		ath9k_tx99_deinit(sc);
 	}
 
 	if (!start) {
 		ath9k_tx99_deinit(sc);
-		return count;
+		goto out;
 	}
 
 	r = ath9k_tx99_init(sc);
-	if (r)
+	if (r) {
+		mutex_unlock(&sc->mutex);
 		return r;
-
+	}
+out:
+	mutex_unlock(&sc->mutex);
 	return count;
 }
 

Patches currently in stable-queue which might be from [email protected] are

queue-4.12/ath9k-fix-an-invalid-pointer-dereference-in-ath9k_rng_stop.patch queue-4.12/ath9k-fix-tx99-use-after-free.patch queue-4.12/ath9k-fix-tx99-bus-error.patch