| Message ID | 51fd8f76494348aa9ecbf0abc471ebe47a983dfd.1679502607.git.lorenzo@kernel.org |
|---|---|
| State | New |
| Headers | show |
| Series | [v3] wireless: mt76: mt7921: Fix use-after-free in fw features query. | expand |
Felix Fietkau <nbd@nbd.name> writes: > On 22.03.23 17:37, Lorenzo Bianconi wrote: >> From: Ben Greear <greearb@candelatech.com> >> >> Stop referencing 'features' memory after release_firmware is called. >> >> Fixes this crash: >> >> RIP: 0010:mt7921_check_offload_capability+0x17d >> mt7921_pci_probe+0xca/0x4b0 >> ... >> >> Signed-off-by: Ben Greear <greearb@candelatech.com> >> Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> The title should have "wifi:", not "wireless:". > Acked-by: Felix Fietkau <nbd@nbd.name> Felix, do you mean I should take this to wireless tree?
On 24.03.23 08:17, Kalle Valo wrote: > Felix Fietkau <nbd@nbd.name> writes: > >> On 22.03.23 17:37, Lorenzo Bianconi wrote: >>> From: Ben Greear <greearb@candelatech.com> >>> >>> Stop referencing 'features' memory after release_firmware is called. >>> >>> Fixes this crash: >>> >>> RIP: 0010:mt7921_check_offload_capability+0x17d >>> mt7921_pci_probe+0xca/0x4b0 >>> ... >>> >>> Signed-off-by: Ben Greear <greearb@candelatech.com> >>> Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> > > The title should have "wifi:", not "wireless:". > >> Acked-by: Felix Fietkau <nbd@nbd.name> > > Felix, do you mean I should take this to wireless tree? Sure - Felix
Lorenzo Bianconi <lorenzo@kernel.org> wrote: > From: Ben Greear <greearb@candelatech.com> > > Stop referencing 'features' memory after release_firmware is called. > > Fixes this crash: > > RIP: 0010:mt7921_check_offload_capability+0x17d > mt7921_pci_probe+0xca/0x4b0 > ... > > Signed-off-by: Ben Greear <greearb@candelatech.com> > Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> > Acked-by: Felix Fietkau <nbd@nbd.name> Patch applied to wireless.git, thanks. 2ceb76f734e3 wifi: mt76: mt7921: Fix use-after-free in fw features query.
diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/init.c b/drivers/net/wireless/mediatek/mt76/mt7921/init.c index 80c71acfe159..cc94531185da 100644 --- a/drivers/net/wireless/mediatek/mt76/mt7921/init.c +++ b/drivers/net/wireless/mediatek/mt76/mt7921/init.c @@ -171,12 +171,12 @@ mt7921_mac_init_band(struct mt7921_dev *dev, u8 band) u8 mt7921_check_offload_capability(struct device *dev, const char *fw_wm) { - struct mt7921_fw_features *features = NULL; const struct mt76_connac2_fw_trailer *hdr; struct mt7921_realease_info *rel_info; const struct firmware *fw; int ret, i, offset = 0; const u8 *data, *end; + u8 offload_caps = 0; ret = request_firmware(&fw, fw_wm, dev); if (ret) @@ -208,7 +208,10 @@ u8 mt7921_check_offload_capability(struct device *dev, const char *fw_wm) data += sizeof(*rel_info); if (rel_info->tag == MT7921_FW_TAG_FEATURE) { + struct mt7921_fw_features *features; + features = (struct mt7921_fw_features *)data; + offload_caps = features->data; break; } @@ -218,7 +221,7 @@ u8 mt7921_check_offload_capability(struct device *dev, const char *fw_wm) out: release_firmware(fw); - return features ? features->data : 0; + return offload_caps; } EXPORT_SYMBOL_GPL(mt7921_check_offload_capability);