* [PATCH] rtl8xxxu: Fix the error handling of the probe function
@ 2022-07-16 13:04 Zheyu Ma
2022-07-27 12:53 ` wifi: " Kalle Valo
0 siblings, 1 reply; 2+ messages in thread
From: Zheyu Ma @ 2022-07-16 13:04 UTC (permalink / raw)
To: Jes.Sorensen, kvalo, davem, edumazet, kuba, pabeni
Cc: linux-wireless, netdev, linux-kernel, Zheyu Ma
When the driver fails at ieee80211_alloc_hw() at the probe time, the
driver will free the 'hw' which is not allocated, causing a bug.
The following log can reveal it:
[ 15.981294] BUG: KASAN: user-memory-access in mutex_is_locked+0xe/0x40
[ 15.981558] Read of size 8 at addr 0000000000001ab0 by task modprobe/373
[ 15.982583] Call Trace:
[ 15.984282] ieee80211_free_hw+0x22/0x390
[ 15.984446] rtl8xxxu_probe+0x3a1/0xab30 [rtl8xxxu]
Fix the bug by changing the order of the error handling.
Signed-off-by: Zheyu Ma <zheyuma97@gmail.com>
---
.../wireless/realtek/rtl8xxxu/rtl8xxxu_core.c | 21 ++++++++++---------
1 file changed, 11 insertions(+), 10 deletions(-)
diff --git a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
index 8b2ca9e8eac6..567ada2e665a 100644
--- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
+++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
@@ -6657,7 +6657,7 @@ static int rtl8xxxu_probe(struct usb_interface *interface,
if (!hw) {
ret = -ENOMEM;
priv = NULL;
- goto exit;
+ goto err_put_dev;
}
priv = hw->priv;
@@ -6679,24 +6679,24 @@ static int rtl8xxxu_probe(struct usb_interface *interface,
ret = rtl8xxxu_parse_usb(priv, interface);
if (ret)
- goto exit;
+ goto err_set_intfdata;
ret = rtl8xxxu_identify_chip(priv);
if (ret) {
dev_err(&udev->dev, "Fatal - failed to identify chip\n");
- goto exit;
+ goto err_set_intfdata;
}
ret = rtl8xxxu_read_efuse(priv);
if (ret) {
dev_err(&udev->dev, "Fatal - failed to read EFuse\n");
- goto exit;
+ goto err_set_intfdata;
}
ret = priv->fops->parse_efuse(priv);
if (ret) {
dev_err(&udev->dev, "Fatal - failed to parse EFuse\n");
- goto exit;
+ goto err_set_intfdata;
}
rtl8xxxu_print_chipinfo(priv);
@@ -6704,12 +6704,12 @@ static int rtl8xxxu_probe(struct usb_interface *interface,
ret = priv->fops->load_firmware(priv);
if (ret) {
dev_err(&udev->dev, "Fatal - failed to load firmware\n");
- goto exit;
+ goto err_set_intfdata;
}
ret = rtl8xxxu_init_device(hw);
if (ret)
- goto exit;
+ goto err_set_intfdata;
hw->wiphy->max_scan_ssids = 1;
hw->wiphy->max_scan_ie_len = IEEE80211_MAX_DATA_LEN;
@@ -6759,12 +6759,12 @@ static int rtl8xxxu_probe(struct usb_interface *interface,
if (ret) {
dev_err(&udev->dev, "%s: Failed to register: %i\n",
__func__, ret);
- goto exit;
+ goto err_set_intfdata;
}
return 0;
-exit:
+err_set_intfdata:
usb_set_intfdata(interface, NULL);
if (priv) {
@@ -6772,9 +6772,10 @@ static int rtl8xxxu_probe(struct usb_interface *interface,
mutex_destroy(&priv->usb_buf_mutex);
mutex_destroy(&priv->h2c_mutex);
}
- usb_put_dev(udev);
ieee80211_free_hw(hw);
+err_put_dev:
+ usb_put_dev(udev);
return ret;
}
--
2.25.1
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: wifi: rtl8xxxu: Fix the error handling of the probe function
2022-07-16 13:04 [PATCH] rtl8xxxu: Fix the error handling of the probe function Zheyu Ma
@ 2022-07-27 12:53 ` Kalle Valo
0 siblings, 0 replies; 2+ messages in thread
From: Kalle Valo @ 2022-07-27 12:53 UTC (permalink / raw)
To: Zheyu Ma
Cc: Jes.Sorensen, davem, edumazet, kuba, pabeni, linux-wireless,
netdev, linux-kernel, Zheyu Ma
Zheyu Ma <zheyuma97@gmail.com> wrote:
> When the driver fails at ieee80211_alloc_hw() at the probe time, the
> driver will free the 'hw' which is not allocated, causing a bug.
>
> The following log can reveal it:
>
> [ 15.981294] BUG: KASAN: user-memory-access in mutex_is_locked+0xe/0x40
> [ 15.981558] Read of size 8 at addr 0000000000001ab0 by task modprobe/373
> [ 15.982583] Call Trace:
> [ 15.984282] ieee80211_free_hw+0x22/0x390
> [ 15.984446] rtl8xxxu_probe+0x3a1/0xab30 [rtl8xxxu]
>
> Fix the bug by changing the order of the error handling.
>
> Signed-off-by: Zheyu Ma <zheyuma97@gmail.com>
Patch applied to wireless-next.git, thanks.
13876f2a087a wifi: rtl8xxxu: Fix the error handling of the probe function
--
https://patchwork.kernel.org/project/linux-wireless/patch/20220716130444.2950690-1-zheyuma97@gmail.com/
https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2022-07-27 12:53 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-07-16 13:04 [PATCH] rtl8xxxu: Fix the error handling of the probe function Zheyu Ma
2022-07-27 12:53 ` wifi: " Kalle Valo
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.