⬢ DragonFlyBSD Kernel Audit
DF-5249 / fix.diff
← back to finding ↓ download raw 
  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
--- a/sys/bus/u4b/wlan/if_run.c	2026-10-01 18:36:08.405384357 +0000
+++ b/sys/bus/u4b/wlan/if_run.c	2026-10-01 18:36:29.945107939 +0000
@@ -1046,8 +1046,9 @@
 
 	/* call cmdq[].func locked */
 	RUN_LOCK(sc);
-	for (i = sc->cmdq_exec; sc->cmdq[i].func && pending;
-	    i = sc->cmdq_exec, pending--) {
+	for (i = sc->cmdq_exec; pending; i = sc->cmdq_exec, pending--) {
+		if (sc->cmdq[i].func == NULL)
+			break;
 		DPRINTFN(6, "cmdq_exec=%d pending=%d\n", i, pending);
 		if (sc->cmdq_run == RUN_CMDQ_GO) {
 			/*
@@ -2367,11 +2368,12 @@
 
 	i = RUN_CMDQ_GET(&sc->cmdq_store);
 	DPRINTF("cmdq_store=%d\n", i);
-	sc->cmdq[i].func = run_key_set_cb;
 	sc->cmdq[i].arg0 = NULL;
 	sc->cmdq[i].arg1 = vap;
 	sc->cmdq[i].k = k;
 	IEEE80211_ADDR_COPY(sc->cmdq[i].mac, k->wk_macaddr);
+	cpu_ccfence();			/* publish args before func */
+	sc->cmdq[i].func = run_key_set_cb;
 	ieee80211_runtask(ic, &sc->cmdq_task);
 
 	/*
@@ -2442,7 +2444,6 @@
 	 */
 	i = RUN_CMDQ_GET(&sc->cmdq_store);
 	DPRINTF("cmdq_store=%d\n", i);
-	sc->cmdq[i].func = run_key_delete_cb;
 	sc->cmdq[i].arg0 = NULL;
 	sc->cmdq[i].arg1 = sc;
 	k0 = &sc->cmdq[i].key;
@@ -2450,6 +2451,8 @@
 	k0->wk_keyix = k->wk_keyix;
 	/* matching wcid was written to wk_pad in run_key_set() */
 	k0->wk_pad = k->wk_pad;
+	cpu_ccfence();			/* publish args before func */
+	sc->cmdq[i].func = run_key_delete_cb;
 	ieee80211_runtask(ic, &sc->cmdq_task);
 	return (1);	/* return fake success */
 
@@ -2668,10 +2671,11 @@
 		 */
 		uint32_t cnt = RUN_CMDQ_GET(&sc->cmdq_store);
 		DPRINTF("cmdq_store=%d\n", cnt);
-		sc->cmdq[cnt].func = run_newassoc_cb;
 		sc->cmdq[cnt].arg0 = NULL;
 		sc->cmdq[cnt].arg1 = ni;
 		sc->cmdq[cnt].wcid = wcid;
+		cpu_ccfence();		/* publish args before func */
+		sc->cmdq[cnt].func = run_newassoc_cb;
 		ieee80211_runtask(ic, &sc->cmdq_task);
 	}
 
@@ -3156,8 +3160,9 @@
 				device_printf(sc->sc_dev, "device timeout\n");
 				uint32_t i = RUN_CMDQ_GET(&sc->cmdq_store);
 				DPRINTF("cmdq_store=%d\n", i);
-				sc->cmdq[i].func = run_usb_timeout_cb;
 				sc->cmdq[i].arg0 = vap;
+				cpu_ccfence();	/* publish args before func */
+				sc->cmdq[i].func = run_usb_timeout_cb;
 				ieee80211_runtask(ic, &sc->cmdq_task);
 			}
 
@@ -3424,8 +3429,9 @@
 			 */
 			uint32_t i = RUN_CMDQ_GET(&sc->cmdq_store);
 			DPRINTFN(6, "cmdq_store=%d\n", i);
-			sc->cmdq[i].func = run_drain_fifo;
 			sc->cmdq[i].arg0 = sc;
+			cpu_ccfence();	/* publish args before func */
+			sc->cmdq[i].func = run_drain_fifo;
 			ieee80211_runtask(ic, &sc->cmdq_task);
 		}
 	}
@@ -4893,8 +4899,9 @@
 
 	i = RUN_CMDQ_GET(&sc->cmdq_store);
 	DPRINTF("cmdq_store=%d\n", i);
-	sc->cmdq[i].func = run_update_beacon_cb;
 	sc->cmdq[i].arg0 = vap;
+	cpu_ccfence();		/* publish args before func */
+	sc->cmdq[i].func = run_update_beacon_cb;
 	ieee80211_runtask(ic, &sc->cmdq_task);
 
 	return;
@@ -4959,8 +4966,9 @@
 
 	i = RUN_CMDQ_GET(&sc->cmdq_store);
 	DPRINTF("cmdq_store=%d\n", i);
-	sc->cmdq[i].func = run_updateprot_cb;
 	sc->cmdq[i].arg0 = ic;
+	cpu_ccfence();		/* publish args before func */
+	sc->cmdq[i].func = run_updateprot_cb;
 	ieee80211_runtask(ic, &sc->cmdq_task);
 }
 
@@ -5205,8 +5213,9 @@
 
 	i = RUN_CMDQ_GET(&sc->cmdq_store);
 	DPRINTF("cmdq_store=%d\n", i);
-	sc->cmdq[i].func = run_updateslot_cb;
 	sc->cmdq[i].arg0 = ic;
+	cpu_ccfence();		/* publish args before func */
+	sc->cmdq[i].func = run_updateslot_cb;
 	ieee80211_runtask(ic, &sc->cmdq_task);
 
 	return;