[lvc-project] [PATCH rtw v2 1/4] wifi: rtw89: fix use-after-free in rtw89_core_tx_kick_off_and_wait()

[pchelkin at ispras.ru]

Thanks! I agree with all aforementioned comments but wonder about this one:

On Thu, 28. Aug 08:07, Zong-Zhe Yang wrote:
> Fedor Pchelkin <pchelkin at ispras.ru> wrote:
> > --- a/drivers/net/wireless/realtek/rtw89/pci.c
> > +++ b/drivers/net/wireless/realtek/rtw89/pci.c
> > @@ -464,10 +464,7 @@ static void rtw89_pci_tx_status(struct rtw89_dev *rtwdev,
> >  	struct rtw89_tx_skb_data *skb_data = RTW89_TX_SKB_CB(skb);
> >  	struct ieee80211_tx_info *info;
> > 
> > -	rtw89_core_tx_wait_complete(rtwdev, skb_data, tx_status == RTW89_TX_DONE);
> > -
> >  	info = IEEE80211_SKB_CB(skb);
> > -	ieee80211_tx_info_clear_status(info);
> > 
> >  	if (info->flags & IEEE80211_TX_CTL_NO_ACK)
> >  		info->flags |= IEEE80211_TX_STAT_NOACK_TRANSMITTED;
> > @@ -494,6 +491,10 @@ static void rtw89_pci_tx_status(struct rtw89_dev *rtwdev,
> >  		}
> >  	}
> > 
> > +	if (rtw89_core_tx_wait_complete(rtwdev, skb_data, tx_status == RTW89_TX_DONE))
> > +		return;
> > +
> > +	ieee80211_tx_info_clear_status(info);
> 
> Don't change order of these calls.
> (it's wrong for normal pkt because their tx_info are cleared after filled)
> 

ieee80211_tx_info_clear_status() clears only TX status part of the
ieee80211_tx_info. It doesn't touch 'flags' field - the only one filled
here by rtw89_pci_tx_status(). It shouldn't be wrong for normal packets.

The reason for changing the order of those calls is to have a chance to
update tx_ring statistics before fast return from rtw89_pci_tx_status()
in case of tx_wait packets.

But, ergh, I can't find those stats reported anywhere in the driver so
it looks like just not a real issue currently and I'd rather not change
the order, okay.

> >  	ieee80211_tx_status_ni(rtwdev->hw, skb);  }
> >