Daniil DulovandGreg Kroah-Hartman
14ca695269
wifi: rtl818x: Kill URBs before clearing tx status queue
[ Upstream commit 16d8fd74db ]
In rtl8187_stop() move the call of usb_kill_anchored_urbs() before clearing
b_tx_status.queue. This change prevents callbacks from using already freed
skb due to anchor was not killed before freeing such skb.
BUG: kernel NULL pointer dereference, address: 0000000000000080
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 0 P4D 0
Oops: Oops: 0000 [#1] SMP NOPTI
CPU: 7 UID: 0 PID: 0 Comm: swapper/7 Not tainted 6.15.0 #8 PREEMPT(voluntary)
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 0.0.0 02/06/2015
RIP: 0010:ieee80211_tx_status_irqsafe+0x21/0xc0 [mac80211]
Call Trace:
<IRQ>
rtl8187_tx_cb+0x116/0x150 [rtl8187]
__usb_hcd_giveback_urb+0x9d/0x120
usb_giveback_urb_bh+0xbb/0x140
process_one_work+0x19b/0x3c0
bh_worker+0x1a7/0x210
tasklet_action+0x10/0x30
handle_softirqs+0xf0/0x340
__irq_exit_rcu+0xcd/0xf0
common_interrupt+0x85/0xa0
</IRQ>
Tested on RTL8187BvE device.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Fixes: c1db52b9d2 ("rtl8187: Use usb anchor facilities to manage urbs")
Signed-off-by: Daniil Dulov <d.dulov@aladdin.ru>
Reviewed-by: Ping-Ke Shih <pkshih@realtek.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://patch.msgid.link/20250617135634.21760-1-d.dulov@aladdin.ru
Signed-off-by: Sasha Levin <sashal@kernel.org>
2025-08-15 12:08:45 +02:00
..
2025-06-04 14:42:15 +02:00
2025-07-17 18:35:14 +02:00
2025-07-10 16:03:15 +02:00
2025-07-17 18:35:20 +02:00
2025-06-04 14:42:01 +02:00
2025-08-01 09:47:28 +01:00
2025-08-15 12:08:40 +02:00
2025-07-24 08:53:18 +02:00
2025-08-01 09:47:30 +01:00
2025-07-17 18:35:12 +02:00
2025-06-27 11:08:55 +01:00
2025-06-04 14:42:06 +02:00
2025-08-01 09:47:31 +01:00
2025-06-19 15:28:31 +02:00
2025-08-15 12:08:43 +02:00
2025-06-04 14:42:05 +02:00
2025-08-01 09:47:32 +01:00
2025-07-06 11:00:06 +02:00
2025-08-15 12:08:43 +02:00
2025-07-24 08:53:13 +02:00
2025-07-10 16:03:19 +02:00
2025-07-06 11:00:13 +02:00
2025-07-06 11:00:17 +02:00
2025-06-19 15:28:31 +02:00
2025-06-27 11:09:04 +01:00
2025-08-15 12:08:45 +02:00
2025-07-24 08:53:12 +02:00
2025-07-06 11:00:09 +02:00
2025-07-24 08:53:18 +02:00
2025-07-06 11:00:07 +02:00
2025-08-01 09:47:30 +01:00
2025-06-04 14:42:21 +02:00
2025-08-01 09:47:32 +01:00
2025-08-01 09:47:28 +01:00
2025-08-01 09:47:28 +01:00
2025-08-15 12:08:44 +02:00
2025-07-10 16:03:20 +02:00
2025-05-09 09:43:51 +02:00
2025-07-06 11:00:06 +02:00
2025-07-06 11:00:05 +02:00
2025-05-02 07:50:47 +02:00
2025-07-24 08:53:11 +02:00
2025-07-06 11:00:16 +02:00
2025-07-24 08:53:13 +02:00
2025-07-06 11:00:05 +02:00
2025-08-15 12:08:42 +02:00
2025-07-24 08:53:14 +02:00
2025-08-01 09:47:32 +01:00
2025-08-15 12:08:45 +02:00
2025-05-02 07:50:56 +02:00
2025-06-04 14:41:56 +02:00
2025-07-24 08:53:17 +02:00
2025-07-24 08:53:22 +02:00
2025-05-02 07:50:41 +02:00
2025-07-06 11:00:10 +02:00
2025-06-19 15:28:08 +02:00
2025-07-24 08:53:10 +02:00
2025-07-17 18:35:13 +02:00
2025-08-01 09:47:29 +01:00
2025-06-04 14:42:07 +02:00
2025-06-27 11:08:52 +01:00
2025-08-15 12:08:42 +02:00
2025-08-15 12:08:42 +02:00
2025-06-27 11:09:02 +01:00
2025-07-17 18:35:15 +02:00
2025-06-27 11:08:58 +01:00
2025-08-01 09:47:28 +01:00
2025-06-27 11:08:50 +01:00
2025-06-19 15:28:27 +02:00
2025-07-10 16:03:03 +02:00
2025-08-01 09:47:29 +01:00
2025-07-10 16:03:06 +02:00
2025-08-15 12:08:44 +02:00
2025-07-24 08:53:16 +02:00
2025-08-15 12:08:42 +02:00
2025-08-15 12:08:44 +02:00
2025-07-10 16:03:16 +02:00
2025-06-27 11:08:57 +01:00
2025-06-04 14:42:20 +02:00
2025-07-24 08:53:11 +02:00
2025-07-24 08:53:11 +02:00
2025-07-10 16:03:14 +02:00
2025-07-06 11:00:09 +02:00
2025-08-15 12:08:42 +02:00
2025-06-04 14:42:05 +02:00
2025-06-19 15:28:17 +02:00
2025-06-04 14:42:05 +02:00
2025-07-06 11:00:10 +02:00
2025-08-01 09:47:28 +01:00
2025-06-27 11:08:57 +01:00
2025-06-19 15:28:09 +02:00