[PATCHv3 ath-next] wifi: ath9k: fix stale list pointers on A-MPDU subframe retry

[Rosen Penev]

In ath_tx_complete_aggr(), subframes that need retransmission are moved
to the local bf_head list via list_move_tail() For retry frames
(txpending), the skb is requeued to bf_pending, but bf_head goes out of
scope at the end of the loop iteration, leaving bf->list pointing to freed
stack memory.  On retry, the buffer is recovered via fi->bf in
ath_tx_get_tid_subframe(), and list_add_tail() in ath_tx_form_aggr()
overwrites the stale pointers harmlessly, so there is no leak, but the
stale pointer is technically a use-after-scope bug.

Fix by calling list_del_init() to cleanly remove the buffer from the
dead bf_head and reinitialize its list pointers before the iteration
ends.  Do not unmap DMA, do not clear fi->bf, and do not return the
buffer to the pool - the buffer is needed on retry with the original
sequence number to keep the Block Ack window consistent.

Assisted-by: opencode:big-pickle
Signed-off-by: Rosen Penev <rosenp@xxxxxxxxx>
---
 v3: simplify to just delete. No need for handling others.
 v2: set fi-bf to NULL.
 drivers/net/wireless/ath/ath9k/xmit.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/net/wireless/ath/ath9k/xmit.c b/drivers/net/wireless/ath/ath9k/xmit.c
index 7e134dd8b8c8..adb3af1b43d4 100644
--- a/drivers/net/wireless/ath/ath9k/xmit.c
+++ b/drivers/net/wireless/ath/ath9k/xmit.c
@@ -667,6 +667,9 @@ static void ath_tx_complete_aggr(struct ath_softc *sc, struct ath_txq *txq,
 			 * queue to retain ordering
 			 */
 			__skb_queue_tail(&bf_pending, skb);
+
+			if (!list_empty(&bf_head))
+				list_del_init(&bf->list);
 		}
 
 		bf = bf_next;
-- 
2.54.0