Stable Archive on lore.kernel.org
 help / color / Atom feed
* [PATCH] mwifiex: fix unbalanced locking in mwifiex_process_country_ie()
@ 2020-01-06 22:42 Brian Norris
  2020-01-06 22:51 ` Brian Norris
  2020-01-07  5:45 ` [EXT] " Ganapathi Bhat
  0 siblings, 2 replies; 4+ messages in thread
From: Brian Norris @ 2020-01-06 22:42 UTC (permalink / raw)
  To: linux-wireless
  Cc: linux-kernel, Ganapathi Bhat, Nishant Sarmukadam,
	Amitkumar Karwar, Xinming Hu, Brian Norris, stable, huangwen

We called rcu_read_lock(), so we need to call rcu_read_unlock() before
we return.

Fixes: 3d94a4a8373b ("mwifiex: fix possible heap overflow in mwifiex_process_country_ie()")
Cc: stable@vger.kernel.org
Cc: huangwen <huangwenabc@gmail.com>
Cc: Ganapathi Bhat <ganapathi.bhat@nxp.com>
Signed-off-by: Brian Norris <briannorris@chromium.org>
---
 drivers/net/wireless/marvell/mwifiex/sta_ioctl.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/net/wireless/marvell/mwifiex/sta_ioctl.c b/drivers/net/wireless/marvell/mwifiex/sta_ioctl.c
index 6dd835f1efc2..fbfa0b15d0c8 100644
--- a/drivers/net/wireless/marvell/mwifiex/sta_ioctl.c
+++ b/drivers/net/wireless/marvell/mwifiex/sta_ioctl.c
@@ -232,6 +232,7 @@ static int mwifiex_process_country_ie(struct mwifiex_private *priv,
 
 	if (country_ie_len >
 	    (IEEE80211_COUNTRY_STRING_LEN + MWIFIEX_MAX_TRIPLET_802_11D)) {
+		rcu_read_unlock();
 		mwifiex_dbg(priv->adapter, ERROR,
 			    "11D: country_ie_len overflow!, deauth AP\n");
 		return -EINVAL;
-- 
2.24.1.735.g03f4e72817-goog


^ permalink raw reply	[flat|nested] 4+ messages in thread

* Re: [PATCH] mwifiex: fix unbalanced locking in mwifiex_process_country_ie()
  2020-01-06 22:42 [PATCH] mwifiex: fix unbalanced locking in mwifiex_process_country_ie() Brian Norris
@ 2020-01-06 22:51 ` Brian Norris
  2020-01-14 14:56   ` Kalle Valo
  2020-01-07  5:45 ` [EXT] " Ganapathi Bhat
  1 sibling, 1 reply; 4+ messages in thread
From: Brian Norris @ 2020-01-06 22:51 UTC (permalink / raw)
  To: linux-wireless
  Cc: Linux Kernel, Ganapathi Bhat, Nishant Sarmukadam,
	Amitkumar Karwar, Xinming Hu, stable, huangwen

On Mon, Jan 6, 2020 at 2:43 PM Brian Norris <briannorris@chromium.org> wrote:
>
> We called rcu_read_lock(), so we need to call rcu_read_unlock() before
> we return.
>
> Fixes: 3d94a4a8373b ("mwifiex: fix possible heap overflow in mwifiex_process_country_ie()")
> Cc: stable@vger.kernel.org
> Cc: huangwen <huangwenabc@gmail.com>
> Cc: Ganapathi Bhat <ganapathi.bhat@nxp.com>
> Signed-off-by: Brian Norris <briannorris@chromium.org>

I probably should have mentioned somewhere here: the bug is currently
in 5.5-rc and is being ported to -stable already (I'll try to head
that off). So this probably should have said [PATCH 5.5]. Sorry about
that.

Brian

^ permalink raw reply	[flat|nested] 4+ messages in thread

* RE: [EXT] [PATCH] mwifiex: fix unbalanced locking in mwifiex_process_country_ie()
  2020-01-06 22:42 [PATCH] mwifiex: fix unbalanced locking in mwifiex_process_country_ie() Brian Norris
  2020-01-06 22:51 ` Brian Norris
@ 2020-01-07  5:45 ` " Ganapathi Bhat
  1 sibling, 0 replies; 4+ messages in thread
From: Ganapathi Bhat @ 2020-01-07  5:45 UTC (permalink / raw)
  To: Brian Norris, linux-wireless
  Cc: linux-kernel, Nishant Sarmukadam, Amitkumar Karwar, Xinming Hu,
	stable, huangwen

Hi Brian,

> We called rcu_read_lock(), so we need to call rcu_read_unlock() before we
> return.

Right; I should have at least checked the previous *return* statements in the same function; 

Thanks for the fix;

Acked-by: Ganapathi Bhat <ganapathi.bhat@nxp.com>

Regards,
Ganapathi

^ permalink raw reply	[flat|nested] 4+ messages in thread

* Re: [PATCH] mwifiex: fix unbalanced locking in mwifiex_process_country_ie()
  2020-01-06 22:51 ` Brian Norris
@ 2020-01-14 14:56   ` Kalle Valo
  0 siblings, 0 replies; 4+ messages in thread
From: Kalle Valo @ 2020-01-14 14:56 UTC (permalink / raw)
  To: Brian Norris
  Cc: linux-wireless, Linux Kernel, Ganapathi Bhat, Nishant Sarmukadam,
	Amitkumar Karwar, Xinming Hu, stable, huangwen

Brian Norris <briannorris@chromium.org> writes:

> On Mon, Jan 6, 2020 at 2:43 PM Brian Norris <briannorris@chromium.org> wrote:
>>
>> We called rcu_read_lock(), so we need to call rcu_read_unlock() before
>> we return.
>>
>> Fixes: 3d94a4a8373b ("mwifiex: fix possible heap overflow in mwifiex_process_country_ie()")
>> Cc: stable@vger.kernel.org
>> Cc: huangwen <huangwenabc@gmail.com>
>> Cc: Ganapathi Bhat <ganapathi.bhat@nxp.com>
>> Signed-off-by: Brian Norris <briannorris@chromium.org>
>
> I probably should have mentioned somewhere here: the bug is currently
> in 5.5-rc and is being ported to -stable already (I'll try to head
> that off). So this probably should have said [PATCH 5.5]. Sorry about
> that.

Ok, I'll queue this to v5.5.

-- 
https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches

^ permalink raw reply	[flat|nested] 4+ messages in thread

end of thread, back to index

Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-01-06 22:42 [PATCH] mwifiex: fix unbalanced locking in mwifiex_process_country_ie() Brian Norris
2020-01-06 22:51 ` Brian Norris
2020-01-14 14:56   ` Kalle Valo
2020-01-07  5:45 ` [EXT] " Ganapathi Bhat

Stable Archive on lore.kernel.org

Archives are clonable:
	git clone --mirror https://lore.kernel.org/stable/0 stable/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 stable stable/ https://lore.kernel.org/stable \
		stable@vger.kernel.org
	public-inbox-index stable

Example config snippet for mirrors

Newsgroup available over NNTP:
	nntp://nntp.lore.kernel.org/org.kernel.vger.stable


AGPL code for this site: git clone https://public-inbox.org/public-inbox.git