* [PATCH v3] wireless: mt76: mt7921: Fix use-after-free in fw features query.
@ 2023-03-22 16:37 Lorenzo Bianconi
2023-03-22 20:58 ` Felix Fietkau
2023-03-31 15:01 ` [v3] wifi: " Kalle Valo
0 siblings, 2 replies; 5+ messages in thread
From: Lorenzo Bianconi @ 2023-03-22 16:37 UTC (permalink / raw)
To: nbd; +Cc: linux-wireless, lorenzo.bianconi, Ben Greear
From: Ben Greear <greearb@candelatech.com>
Stop referencing 'features' memory after release_firmware is called.
Fixes this crash:
RIP: 0010:mt7921_check_offload_capability+0x17d
mt7921_pci_probe+0xca/0x4b0
...
Signed-off-by: Ben Greear <greearb@candelatech.com>
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
---
Changes since v2:
- get rid of the comments
---
drivers/net/wireless/mediatek/mt76/mt7921/init.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/init.c b/drivers/net/wireless/mediatek/mt76/mt7921/init.c
index 80c71acfe159..cc94531185da 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7921/init.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7921/init.c
@@ -171,12 +171,12 @@ mt7921_mac_init_band(struct mt7921_dev *dev, u8 band)
u8 mt7921_check_offload_capability(struct device *dev, const char *fw_wm)
{
- struct mt7921_fw_features *features = NULL;
const struct mt76_connac2_fw_trailer *hdr;
struct mt7921_realease_info *rel_info;
const struct firmware *fw;
int ret, i, offset = 0;
const u8 *data, *end;
+ u8 offload_caps = 0;
ret = request_firmware(&fw, fw_wm, dev);
if (ret)
@@ -208,7 +208,10 @@ u8 mt7921_check_offload_capability(struct device *dev, const char *fw_wm)
data += sizeof(*rel_info);
if (rel_info->tag == MT7921_FW_TAG_FEATURE) {
+ struct mt7921_fw_features *features;
+
features = (struct mt7921_fw_features *)data;
+ offload_caps = features->data;
break;
}
@@ -218,7 +221,7 @@ u8 mt7921_check_offload_capability(struct device *dev, const char *fw_wm)
out:
release_firmware(fw);
- return features ? features->data : 0;
+ return offload_caps;
}
EXPORT_SYMBOL_GPL(mt7921_check_offload_capability);
--
2.39.2
^ permalink raw reply related [flat|nested] 5+ messages in thread
* Re: [PATCH v3] wireless: mt76: mt7921: Fix use-after-free in fw features query.
2023-03-22 16:37 [PATCH v3] wireless: mt76: mt7921: Fix use-after-free in fw features query Lorenzo Bianconi
@ 2023-03-22 20:58 ` Felix Fietkau
2023-03-24 7:17 ` Kalle Valo
2023-03-31 15:01 ` [v3] wifi: " Kalle Valo
1 sibling, 1 reply; 5+ messages in thread
From: Felix Fietkau @ 2023-03-22 20:58 UTC (permalink / raw)
To: Lorenzo Bianconi; +Cc: linux-wireless, lorenzo.bianconi, Ben Greear, Kalle Valo
On 22.03.23 17:37, Lorenzo Bianconi wrote:
> From: Ben Greear <greearb@candelatech.com>
>
> Stop referencing 'features' memory after release_firmware is called.
>
> Fixes this crash:
>
> RIP: 0010:mt7921_check_offload_capability+0x17d
> mt7921_pci_probe+0xca/0x4b0
> ...
>
> Signed-off-by: Ben Greear <greearb@candelatech.com>
> Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Acked-by: Felix Fietkau <nbd@nbd.name>
- Felix
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH v3] wireless: mt76: mt7921: Fix use-after-free in fw features query.
2023-03-22 20:58 ` Felix Fietkau
@ 2023-03-24 7:17 ` Kalle Valo
2023-03-24 10:19 ` Felix Fietkau
0 siblings, 1 reply; 5+ messages in thread
From: Kalle Valo @ 2023-03-24 7:17 UTC (permalink / raw)
To: Felix Fietkau
Cc: Lorenzo Bianconi, linux-wireless, lorenzo.bianconi, Ben Greear
Felix Fietkau <nbd@nbd.name> writes:
> On 22.03.23 17:37, Lorenzo Bianconi wrote:
>> From: Ben Greear <greearb@candelatech.com>
>>
>> Stop referencing 'features' memory after release_firmware is called.
>>
>> Fixes this crash:
>>
>> RIP: 0010:mt7921_check_offload_capability+0x17d
>> mt7921_pci_probe+0xca/0x4b0
>> ...
>>
>> Signed-off-by: Ben Greear <greearb@candelatech.com>
>> Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
The title should have "wifi:", not "wireless:".
> Acked-by: Felix Fietkau <nbd@nbd.name>
Felix, do you mean I should take this to wireless tree?
--
https://patchwork.kernel.org/project/linux-wireless/list/
https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH v3] wireless: mt76: mt7921: Fix use-after-free in fw features query.
2023-03-24 7:17 ` Kalle Valo
@ 2023-03-24 10:19 ` Felix Fietkau
0 siblings, 0 replies; 5+ messages in thread
From: Felix Fietkau @ 2023-03-24 10:19 UTC (permalink / raw)
To: Kalle Valo; +Cc: Lorenzo Bianconi, linux-wireless, lorenzo.bianconi, Ben Greear
On 24.03.23 08:17, Kalle Valo wrote:
> Felix Fietkau <nbd@nbd.name> writes:
>
>> On 22.03.23 17:37, Lorenzo Bianconi wrote:
>>> From: Ben Greear <greearb@candelatech.com>
>>>
>>> Stop referencing 'features' memory after release_firmware is called.
>>>
>>> Fixes this crash:
>>>
>>> RIP: 0010:mt7921_check_offload_capability+0x17d
>>> mt7921_pci_probe+0xca/0x4b0
>>> ...
>>>
>>> Signed-off-by: Ben Greear <greearb@candelatech.com>
>>> Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
>
> The title should have "wifi:", not "wireless:".
>
>> Acked-by: Felix Fietkau <nbd@nbd.name>
>
> Felix, do you mean I should take this to wireless tree?
Sure
- Felix
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [v3] wifi: mt76: mt7921: Fix use-after-free in fw features query.
2023-03-22 16:37 [PATCH v3] wireless: mt76: mt7921: Fix use-after-free in fw features query Lorenzo Bianconi
2023-03-22 20:58 ` Felix Fietkau
@ 2023-03-31 15:01 ` Kalle Valo
1 sibling, 0 replies; 5+ messages in thread
From: Kalle Valo @ 2023-03-31 15:01 UTC (permalink / raw)
To: Lorenzo Bianconi; +Cc: nbd, linux-wireless, lorenzo.bianconi, Ben Greear
Lorenzo Bianconi <lorenzo@kernel.org> wrote:
> From: Ben Greear <greearb@candelatech.com>
>
> Stop referencing 'features' memory after release_firmware is called.
>
> Fixes this crash:
>
> RIP: 0010:mt7921_check_offload_capability+0x17d
> mt7921_pci_probe+0xca/0x4b0
> ...
>
> Signed-off-by: Ben Greear <greearb@candelatech.com>
> Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
> Acked-by: Felix Fietkau <nbd@nbd.name>
Patch applied to wireless.git, thanks.
2ceb76f734e3 wifi: mt76: mt7921: Fix use-after-free in fw features query.
--
https://patchwork.kernel.org/project/linux-wireless/patch/51fd8f76494348aa9ecbf0abc471ebe47a983dfd.1679502607.git.lorenzo@kernel.org/
https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2023-03-31 15:01 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2023-03-22 16:37 [PATCH v3] wireless: mt76: mt7921: Fix use-after-free in fw features query Lorenzo Bianconi
2023-03-22 20:58 ` Felix Fietkau
2023-03-24 7:17 ` Kalle Valo
2023-03-24 10:19 ` Felix Fietkau
2023-03-31 15:01 ` [v3] wifi: " Kalle Valo
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).