Patch "net: ethernet: mtk_wed: fix use-after-free panic in mtk_wed_setup_tc_block_cb()" has been added to the 6.6-stable tree

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



This is a note to let you know that I've just added the patch titled

    net: ethernet: mtk_wed: fix use-after-free panic in mtk_wed_setup_tc_block_cb()

to the 6.6-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     net-ethernet-mtk_wed-fix-use-after-free-panic-in-mtk.patch
and it can be found in the queue-6.6 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 27604f03e6afa3369a7e71176b36887bad0b03fa
Author: Zheng Zhang <everything411@xxxxxx>
Date:   Sat Aug 10 13:26:51 2024 +0800

    net: ethernet: mtk_wed: fix use-after-free panic in mtk_wed_setup_tc_block_cb()
    
    [ Upstream commit db1b4bedb9b97c6d34b03d03815147c04fffe8b4 ]
    
    When there are multiple ap interfaces on one band and with WED on,
    turning the interface down will cause a kernel panic on MT798X.
    
    Previously, cb_priv was freed in mtk_wed_setup_tc_block() without
    marking NULL,and mtk_wed_setup_tc_block_cb() didn't check the value, too.
    
    Assign NULL after free cb_priv in mtk_wed_setup_tc_block() and check NULL
    in mtk_wed_setup_tc_block_cb().
    
    ----------
    Unable to handle kernel paging request at virtual address 0072460bca32b4f5
    Call trace:
     mtk_wed_setup_tc_block_cb+0x4/0x38
     0xffffffc0794084bc
     tcf_block_playback_offloads+0x70/0x1e8
     tcf_block_unbind+0x6c/0xc8
    ...
    ---------
    
    Fixes: 799684448e3e ("net: ethernet: mtk_wed: introduce wed wo support")
    Signed-off-by: Zheng Zhang <everything411@xxxxxx>
    Signed-off-by: David S. Miller <davem@xxxxxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/net/ethernet/mediatek/mtk_wed.c b/drivers/net/ethernet/mediatek/mtk_wed.c
index c7196055c8c98..85a9ad2b86bff 100644
--- a/drivers/net/ethernet/mediatek/mtk_wed.c
+++ b/drivers/net/ethernet/mediatek/mtk_wed.c
@@ -1762,14 +1762,15 @@ mtk_wed_setup_tc_block_cb(enum tc_setup_type type, void *type_data, void *cb_pri
 {
 	struct mtk_wed_flow_block_priv *priv = cb_priv;
 	struct flow_cls_offload *cls = type_data;
-	struct mtk_wed_hw *hw = priv->hw;
+	struct mtk_wed_hw *hw = NULL;
 
-	if (!tc_can_offload(priv->dev))
+	if (!priv || !tc_can_offload(priv->dev))
 		return -EOPNOTSUPP;
 
 	if (type != TC_SETUP_CLSFLOWER)
 		return -EOPNOTSUPP;
 
+	hw = priv->hw;
 	return mtk_flow_offload_cmd(hw->eth, cls, hw->index);
 }
 
@@ -1825,6 +1826,7 @@ mtk_wed_setup_tc_block(struct mtk_wed_hw *hw, struct net_device *dev,
 			flow_block_cb_remove(block_cb, f);
 			list_del(&block_cb->driver_list);
 			kfree(block_cb->cb_priv);
+			block_cb->cb_priv = NULL;
 		}
 		return 0;
 	default:




[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Index of Archives]     [Linux USB Devel]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]

  Powered by Linux