lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-Id: <20230227144823.947648-1-void0red@gmail.com> Date: Mon, 27 Feb 2023 22:48:23 +0800 From: void0red <void0red@...il.com> To: lorenzo.bianconi@...hat.com Cc: angelogioacchino.delregno@...labora.com, davem@...emloft.net, edumazet@...gle.com, kuba@...nel.org, kvalo@...nel.org, linux-arm-kernel@...ts.infradead.org, linux-kernel@...r.kernel.org, linux-mediatek@...ts.infradead.org, linux-wireless@...r.kernel.org, lorenzo@...nel.org, matthias.bgg@...il.com, nbd@....name, netdev@...r.kernel.org, pabeni@...hat.com, ryder.lee@...iatek.com, sean.wang@...iatek.com, shayne.chen@...iatek.com, void0red@...il.com Subject: [PATCH v3] wifi: mt76: handle failure of vzalloc in mt7615_coredump_work From: Kang Chen <void0red@...il.com> vzalloc may fails, dump might be null and will cause illegal address access later. Link: https://lore.kernel.org/all/Y%2Fy5Asxw3T3m4jCw@lore-desk Fixes: d2bf7959d9c0 ("mt76: mt7663: introduce coredump support") Signed-off-by: Kang Chen <void0red@...il.com> --- v3 -> v2: fix bugs v2 -> v1: add Fixes tag drivers/net/wireless/mediatek/mt76/mt7615/mac.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/drivers/net/wireless/mediatek/mt76/mt7615/mac.c b/drivers/net/wireless/mediatek/mt76/mt7615/mac.c index a95602473..796768011 100644 --- a/drivers/net/wireless/mediatek/mt76/mt7615/mac.c +++ b/drivers/net/wireless/mediatek/mt76/mt7615/mac.c @@ -2380,7 +2380,7 @@ void mt7615_coredump_work(struct work_struct *work) break; skb_pull(skb, sizeof(struct mt7615_mcu_rxd)); - if (data + skb->len - dump > MT76_CONNAC_COREDUMP_SZ) { + if (!dump || data + skb->len - dump > MT76_CONNAC_COREDUMP_SZ) { dev_kfree_skb(skb); continue; } @@ -2390,6 +2390,8 @@ void mt7615_coredump_work(struct work_struct *work) dev_kfree_skb(skb); } - dev_coredumpv(dev->mt76.dev, dump, MT76_CONNAC_COREDUMP_SZ, - GFP_KERNEL); + + if (dump) + dev_coredumpv(dev->mt76.dev, dump, MT76_CONNAC_COREDUMP_SZ, + GFP_KERNEL); } -- 2.34.1
Powered by blists - more mailing lists