Patch "ath9k_htc: fix NULL pointer dereference at ath9k_htc_tx_get_packet()" has been added to the 5.15-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    ath9k_htc: fix NULL pointer dereference at ath9k_htc_tx_get_packet()

to the 5.15-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     ath9k_htc-fix-null-pointer-dereference-at-ath9k_htc_.patch
and it can be found in the queue-5.15 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 3925f0939ab24d69468d68723b197f211f0ac13f
Author: Tetsuo Handa <penguin-kernel@xxxxxxxxxxxxxxxxxxx>
Date:   Tue Sep 21 22:06:26 2021 +0900

    ath9k_htc: fix NULL pointer dereference at ath9k_htc_tx_get_packet()
    
    [ Upstream commit 8b3046abc99eefe11438090bcc4ec3a3994b55d0 ]
    
    syzbot is reporting lockdep warning at ath9k_wmi_event_tasklet() followed
    by kernel panic at get_htc_epid_queue() from ath9k_htc_tx_get_packet() from
    ath9k_htc_txstatus() [1], for ath9k_wmi_event_tasklet(WMI_TXSTATUS_EVENTID)
    depends on spin_lock_init() from ath9k_init_priv() being already completed.
    
    Since ath9k_wmi_event_tasklet() is set by ath9k_init_wmi() from
    ath9k_htc_probe_device(), it is possible that ath9k_wmi_event_tasklet() is
    called via tasklet interrupt before spin_lock_init() from ath9k_init_priv()
     from ath9k_init_device() from ath9k_htc_probe_device() is called.
    
    Let's hold ath9k_wmi_event_tasklet(WMI_TXSTATUS_EVENTID) no-op until
    ath9k_tx_init() completes.
    
    Link: https://syzkaller.appspot.com/bug?extid=31d54c60c5b254d6f75b [1]
    Reported-by: syzbot <syzbot+31d54c60c5b254d6f75b@xxxxxxxxxxxxxxxxxxxxxxxxx>
    Signed-off-by: Tetsuo Handa <penguin-kernel@xxxxxxxxxxxxxxxxxxx>
    Tested-by: syzbot <syzbot+31d54c60c5b254d6f75b@xxxxxxxxxxxxxxxxxxxxxxxxx>
    Signed-off-by: Kalle Valo <quic_kvalo@xxxxxxxxxxx>
    Link: https://lore.kernel.org/r/77b76ac8-2bee-6444-d26c-8c30858b8daa@xxxxxxxxxxxxxxxxxxx
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/net/wireless/ath/ath9k/htc.h b/drivers/net/wireless/ath/ath9k/htc.h
index 4f71e962279af..6b45e63fae4ba 100644
--- a/drivers/net/wireless/ath/ath9k/htc.h
+++ b/drivers/net/wireless/ath/ath9k/htc.h
@@ -306,6 +306,7 @@ struct ath9k_htc_tx {
 	DECLARE_BITMAP(tx_slot, MAX_TX_BUF_NUM);
 	struct timer_list cleanup_timer;
 	spinlock_t tx_lock;
+	bool initialized;
 };
 
 struct ath9k_htc_tx_ctl {
diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c b/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c
index e7a21eaf3a68d..6a850a0bfa8ad 100644
--- a/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c
+++ b/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c
@@ -813,6 +813,11 @@ int ath9k_tx_init(struct ath9k_htc_priv *priv)
 	skb_queue_head_init(&priv->tx.data_vi_queue);
 	skb_queue_head_init(&priv->tx.data_vo_queue);
 	skb_queue_head_init(&priv->tx.tx_failed);
+
+	/* Allow ath9k_wmi_event_tasklet(WMI_TXSTATUS_EVENTID) to operate. */
+	smp_wmb();
+	priv->tx.initialized = true;
+
 	return 0;
 }
 
diff --git a/drivers/net/wireless/ath/ath9k/wmi.c b/drivers/net/wireless/ath/ath9k/wmi.c
index fe29ad4b9023c..f315c54bd3ac0 100644
--- a/drivers/net/wireless/ath/ath9k/wmi.c
+++ b/drivers/net/wireless/ath/ath9k/wmi.c
@@ -169,6 +169,10 @@ void ath9k_wmi_event_tasklet(struct tasklet_struct *t)
 					     &wmi->drv_priv->fatal_work);
 			break;
 		case WMI_TXSTATUS_EVENTID:
+			/* Check if ath9k_tx_init() completed. */
+			if (!data_race(priv->tx.initialized))
+				break;
+
 			spin_lock_bh(&priv->tx.tx_lock);
 			if (priv->tx.flags & ATH9K_HTC_OP_TX_DRAIN) {
 				spin_unlock_bh(&priv->tx.tx_lock);