[PATCH] mwifiex: fix unbalanced locking in mwifiex_process_country_ie()

[PATCH] mwifiex: fix unbalanced locking in mwifiex_process_country_ie()

[Brian Norris]

We called rcu_read_lock(), so we need to call rcu_read_unlock() before
we return.

Fixes: 3d94a4a8373b ("mwifiex: fix possible heap overflow in mwifiex_process_country_ie()")
Cc: stable@vger.kernel.org
Cc: huangwen <huangwenabc@gmail.com>
Cc: Ganapathi Bhat <ganapathi.bhat@nxp.com>
Signed-off-by: Brian Norris <briannorris@chromium.org>
---
 drivers/net/wireless/marvell/mwifiex/sta_ioctl.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/net/wireless/marvell/mwifiex/sta_ioctl.c b/drivers/net/wireless/marvell/mwifiex/sta_ioctl.c
index 6dd835f1efc2..fbfa0b15d0c8 100644
--- a/drivers/net/wireless/marvell/mwifiex/sta_ioctl.c
+++ b/drivers/net/wireless/marvell/mwifiex/sta_ioctl.c
@@ -232,6 +232,7 @@ static int mwifiex_process_country_ie(struct mwifiex_private *priv,
 
 	if (country_ie_len >
 	    (IEEE80211_COUNTRY_STRING_LEN + MWIFIEX_MAX_TRIPLET_802_11D)) {
+		rcu_read_unlock();
 		mwifiex_dbg(priv->adapter, ERROR,
 			    "11D: country_ie_len overflow!, deauth AP\n");
 		return -EINVAL;
-- 
2.24.1.735.g03f4e72817-goog

Re: [PATCH] mwifiex: fix unbalanced locking in mwifiex_process_country_ie()

[Brian Norris]

On Mon, Jan 6, 2020 at 2:43 PM Brian Norris <briannorris@chromium.org> wrote:
>
> We called rcu_read_lock(), so we need to call rcu_read_unlock() before
> we return.
>
> Fixes: 3d94a4a8373b ("mwifiex: fix possible heap overflow in mwifiex_process_country_ie()")
> Cc: stable@vger.kernel.org
> Cc: huangwen <huangwenabc@gmail.com>
> Cc: Ganapathi Bhat <ganapathi.bhat@nxp.com>
> Signed-off-by: Brian Norris <briannorris@chromium.org>

I probably should have mentioned somewhere here: the bug is currently
in 5.5-rc and is being ported to -stable already (I'll try to head
that off). So this probably should have said [PATCH 5.5]. Sorry about
that.

Brian

Re: [PATCH] mwifiex: fix unbalanced locking in mwifiex_process_country_ie()

[Kalle Valo]

Brian Norris <briannorris@chromium.org> writes:

> On Mon, Jan 6, 2020 at 2:43 PM Brian Norris <briannorris@chromium.org> wrote:
>>
>> We called rcu_read_lock(), so we need to call rcu_read_unlock() before
>> we return.
>>
>> Fixes: 3d94a4a8373b ("mwifiex: fix possible heap overflow in mwifiex_process_country_ie()")
>> Cc: stable@vger.kernel.org
>> Cc: huangwen <huangwenabc@gmail.com>
>> Cc: Ganapathi Bhat <ganapathi.bhat@nxp.com>
>> Signed-off-by: Brian Norris <briannorris@chromium.org>
>
> I probably should have mentioned somewhere here: the bug is currently
> in 5.5-rc and is being ported to -stable already (I'll try to head
> that off). So this probably should have said [PATCH 5.5]. Sorry about
> that.

Ok, I'll queue this to v5.5.

-- 
https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches

RE: [EXT] [PATCH] mwifiex: fix unbalanced locking in mwifiex_process_country_ie()

[Ganapathi Bhat]

Hi Brian,

> We called rcu_read_lock(), so we need to call rcu_read_unlock() before we
> return.

Right; I should have at least checked the previous *return* statements in the same function; 

Thanks for the fix;

Acked-by: Ganapathi Bhat <ganapathi.bhat@nxp.com>

Regards,
Ganapathi

Re: [PATCH] mwifiex: fix unbalanced locking in mwifiex_process_country_ie()

[Kalle Valo]

Brian Norris <briannorris@chromium.org> wrote:

> We called rcu_read_lock(), so we need to call rcu_read_unlock() before
> we return.
> 
> Fixes: 3d94a4a8373b ("mwifiex: fix possible heap overflow in mwifiex_process_country_ie()")
> Cc: stable@vger.kernel.org
> Cc: huangwen <huangwenabc@gmail.com>
> Cc: Ganapathi Bhat <ganapathi.bhat@nxp.com>
> Signed-off-by: Brian Norris <briannorris@chromium.org>
> Acked-by: Ganapathi Bhat <ganapathi.bhat@nxp.com>

Patch applied to wireless-drivers.git, thanks.

65b1aae0d9d5 mwifiex: fix unbalanced locking in mwifiex_process_country_ie()

-- 
https://patchwork.kernel.org/patch/11320227/

https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches