linux-kernel - RE: [PATCH v2 2/2] wifi: rtw89: Fix inadverent sharing of struct ieee80211_supported

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <91c53b3583864650a48de2ffa0dfccd1@realtek.com>
Date: Tue, 29 Apr 2025 06:37:26 +0000
From: Ping-Ke Shih <pkshih@...ltek.com>
To: Ondřej Jirman <megi@....cz>
CC: "linux-wireless@...r.kernel.org" <linux-wireless@...r.kernel.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Subject: RE: [PATCH v2 2/2] wifi: rtw89: Fix inadverent sharing of struct ieee80211_supported_band data

Ondřej Jirman <megi@....cz> wrote:
> Internally wiphy writes to individual channels in this structure,
> so we must not share one static definition of channel list between
> multiple device instances, because that causes hard to debug
> breakage.
> 
> For example, with two rtw89 driven devices in the system, channel
> information may get incoherent, preventing channel use.
> 
> Signed-off-by: Ondrej Jirman <megi@....cz>
> ---
>  drivers/net/wireless/realtek/rtw89/core.c | 33 +++++++++++++++++++----
>  1 file changed, 28 insertions(+), 5 deletions(-)
> 
> diff --git a/drivers/net/wireless/realtek/rtw89/core.c b/drivers/net/wireless/realtek/rtw89/core.c
> index b164bc767e82..48e21a3549ff 100644
> --- a/drivers/net/wireless/realtek/rtw89/core.c
> +++ b/drivers/net/wireless/realtek/rtw89/core.c
> @@ -4400,17 +4400,40 @@ static int rtw89_init_he_eht_cap(struct rtw89_dev *rtwdev,
>         return 0;
>  }
> 
> +static struct ieee80211_supported_band *
> +rtw89_core_sband_dup(struct rtw89_dev *rtwdev,
> +                    const struct ieee80211_supported_band *sband)
> +{
> +       struct ieee80211_supported_band *dup;
> +
> +       dup = devm_kmemdup(rtwdev->dev, sband, sizeof(*sband), GFP_KERNEL);
> +       if (!dup)
> +               return NULL;
> +
> +       dup->channels = devm_kmemdup(rtwdev->dev, sband->channels,
> +                                    sizeof(struct ieee80211_channel) * sband->n_channels,

sizeof(*sband->channels) * sband->n_channels,

> +                                    GFP_KERNEL);
> +       if (!dup->channels)
> +               return NULL;
> +
> +       dup->bitrates = devm_kmemdup(rtwdev->dev, sband->bitrates,
> +                                    sizeof(struct ieee80211_rate) * sband->n_bitrates,

sizeof(*sband->bitrates) * sband->n_bitrates,

> +                                    GFP_KERNEL);
> +       if (!dup->bitrates)
> +               return NULL;
> +
> +       return dup;
> +}
> +

[...]