mwifiex: don't drop lock between list-retrieval / list-deletion
authorBrian Norris <briannorris@chromium.org>
Fri, 12 May 2017 16:42:02 +0000 (09:42 -0700)
committerKalle Valo <kvalo@codeaurora.org>
Fri, 19 May 2017 06:01:56 +0000 (09:01 +0300)
commit0f13acf0c61234b22e2c1478a932a7610b7ad7ca
treef10f861d0e41d50c8b7946e007347423cb46b55c
parent09bdb65005515c97b29e0792bc6e5598d9e4035f
mwifiex: don't drop lock between list-retrieval / list-deletion

mwifiex_exec_next_cmd() seems to have a classic TOCTOU race, where we
drop the list lock in between retrieving the next command and deleting
it from the list. This potentially leaves room for someone else to also
retrieve / steal this node from the list (e.g.,
mwifiex_cancel_all_pending_cmd()).

Let's keep holding the lock while we do our 'ps_state' sanity checks.
There should be no harm in continuing to hold this lock for a bit more.

Noticed only by code inspection.

Signed-off-by: Brian Norris <briannorris@chromium.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
drivers/net/wireless/marvell/mwifiex/cmdevt.c