linux-kernel - Re: BUG: KASAN: vmalloc-out-of-bounds in mt7921_check_offload_capability+0x3fa/0x430 [mt7921

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CABXGCsMP6XUt4QKPc2P4fHo8DD_tam62NBHGrSWc0BHvch3hXw@mail.gmail.com>
Date:   Tue, 21 Mar 2023 05:04:59 +0500
From:   Mikhail Gavrilov <mikhail.v.gavrilov@...il.com>
To:     Ben Greear <greearb@...delatech.com>
Cc:     Linux List Kernel Mailing <linux-wireless@...r.kernel.org>,
        sean.wang@...iatek.com, deren.wu@...iatek.com,
        Felix Fietkau <nbd@....name>,
        Linux List Kernel Mailing <linux-kernel@...r.kernel.org>
Subject: Re: BUG: KASAN: vmalloc-out-of-bounds in mt7921_check_offload_capability+0x3fa/0x430
 [mt7921_common]

On Mon, Mar 20, 2023 at 7:00 PM Ben Greear <greearb@...delatech.com> wrote:
>
> On 3/20/23 03:32, Mikhail Gavrilov wrote:
> > Hi,
> > After enabling KASAN sanitizer the message "BUG: KASAN:
> > vmalloc-out-of-bounds in mt7921_check_offload_capability+0x3fa/0x430
> > [mt7921_common]" chase me at every boot.
>
> This is use-after-free bug, and I already posted a patch to fix it.
> "wireless: mt76: mt7921: Fix use-after-free in fw features query."

Hi,
This is the last version?
https://patchwork.kernel.org/project/linux-wireless/patch/20230308175832.2394061-1-greearb@candelatech.com/

Unfortunately it is not applicable to 6.3-rc3.

❯ git apply v2-wireless-mt76-mt7921-Fix-use-after-free-in-fw-features-query..patch
-v
Checking patch drivers/net/wireless/mediatek/mt76/mt7921/init.c...
Hunk #1 succeeded at 171 (offset 6 lines).
Hunk #2 succeeded at 203 (offset 6 lines).
error: while searching for:

release_firmware(fw);

return features ? features->data : 0;
}
EXPORT_SYMBOL_GPL(mt7921_check_offload_capability);


error: patch failed: drivers/net/wireless/mediatek/mt76/mt7921/init.c:211
error: drivers/net/wireless/mediatek/mt76/mt7921/init.c: patch does not apply

-- 
Best Regards,
Mike Gavrilov.