This is a note to let you know that I've just added the patch titled carl9170: tx: fix an incorrect use of list iterator to the 5.17-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: carl9170-tx-fix-an-incorrect-use-of-list-iterator.patch and it can be found in the queue-5.17 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable@xxxxxxxxxxxxxxx> know about it. >From 54a6f29522da3c914da30e50721dedf51046449a Mon Sep 17 00:00:00 2001 From: Xiaomeng Tong <xiam0nd.tong@xxxxxxxxx> Date: Mon, 28 Mar 2022 20:28:20 +0800 Subject: carl9170: tx: fix an incorrect use of list iterator From: Xiaomeng Tong <xiam0nd.tong@xxxxxxxxx> commit 54a6f29522da3c914da30e50721dedf51046449a upstream. If the previous list_for_each_entry_continue_rcu() don't exit early (no goto hit inside the loop), the iterator 'cvif' after the loop will be a bogus pointer to an invalid structure object containing the HEAD (&ar->vif_list). As a result, the use of 'cvif' after that will lead to a invalid memory access (i.e., 'cvif->id': the invalid pointer dereference when return back to/after the callsite in the carl9170_update_beacon()). The original intention should have been to return the valid 'cvif' when found in list, NULL otherwise. So just return NULL when no entry found, to fix this bug. Cc: stable@xxxxxxxxxxxxxxx Fixes: 1f1d9654e183c ("carl9170: refactor carl9170_update_beacon") Signed-off-by: Xiaomeng Tong <xiam0nd.tong@xxxxxxxxx> Acked-by: Christian Lamparter <chunkeey@xxxxxxxxx> Signed-off-by: Kalle Valo <quic_kvalo@xxxxxxxxxxx> Link: https://lore.kernel.org/r/20220328122820.1004-1-xiam0nd.tong@xxxxxxxxx Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> --- drivers/net/wireless/ath/carl9170/tx.c | 3 +++ 1 file changed, 3 insertions(+) --- a/drivers/net/wireless/ath/carl9170/tx.c +++ b/drivers/net/wireless/ath/carl9170/tx.c @@ -1558,6 +1558,9 @@ static struct carl9170_vif_info *carl917 goto out; } } while (ar->beacon_enabled && i--); + + /* no entry found in list */ + return NULL; } out: Patches currently in stable-queue which might be from xiam0nd.tong@xxxxxxxxx are queue-5.17/md-fix-an-incorrect-null-check-in-does_sb_need_changing.patch queue-5.17/stm-ltdc-fix-two-incorrect-null-checks-on-list-iterator.patch queue-5.17/scsi-dc395x-fix-a-missing-check-on-list-iterator.patch queue-5.17/iommu-msm-fix-an-incorrect-null-check-on-list-iterator.patch queue-5.17/carl9170-tx-fix-an-incorrect-use-of-list-iterator.patch queue-5.17/tilcdc-tilcdc_external-fix-an-incorrect-null-check-on-list-iterator.patch queue-5.17/gma500-fix-an-incorrect-null-check-on-list-iterator.patch queue-5.17/drm-nouveau-clk-fix-an-incorrect-null-check-on-list-iterator.patch queue-5.17/media-uvcvideo-fix-missing-check-to-determine-if-ele.patch queue-5.17/md-fix-an-incorrect-null-check-in-md_reload_sb.patch queue-5.17/drm-nouveau-kms-nv50-atom-fix-an-incorrect-null-check-on-list-iterator.patch