MIME-Version: 1.0
References: <CABXGCsMOZ7LQgem+vpjytU5MybGrOmRH_hnkckQCx8_wCknecA@mail.gmail.com>
 <121d75eb-da8e-e120-3754-391a0c064001@candelatech.com>
In-Reply-To: <121d75eb-da8e-e120-3754-391a0c064001@candelatech.com>
From:   Mikhail Gavrilov <mikhail.v.gavrilov@gmail.com>
Date:   Tue, 21 Mar 2023 05:04:59 +0500
Message-ID: <CABXGCsMP6XUt4QKPc2P4fHo8DD_tam62NBHGrSWc0BHvch3hXw@mail.gmail.com>
Subject: Re: BUG: KASAN: vmalloc-out-of-bounds in mt7921_check_offload_capability+0x3fa/0x430
 [mt7921_common]
To:     Ben Greear <greearb@candelatech.com>
Cc:     Linux List Kernel Mailing <linux-wireless@vger.kernel.org>,
        sean.wang@mediatek.com, deren.wu@mediatek.com,
        Felix Fietkau <nbd@nbd.name>,
        Linux List Kernel Mailing <linux-kernel@vger.kernel.org>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Precedence: bulk

On Mon, Mar 20, 2023 at 7:00=E2=80=AFPM Ben Greear <greearb@candelatech.com=
> wrote:
>
> On 3/20/23 03:32, Mikhail Gavrilov wrote:
> > Hi,
> > After enabling KASAN sanitizer the message "BUG: KASAN:
> > vmalloc-out-of-bounds in mt7921_check_offload_capability+0x3fa/0x430
> > [mt7921_common]" chase me at every boot.
>
> This is use-after-free bug, and I already posted a patch to fix it.
> "wireless: mt76: mt7921: Fix use-after-free in fw features query."

Hi,
This is the last version?
https://patchwork.kernel.org/project/linux-wireless/patch/20230308175832.23=
94061-1-greearb@candelatech.com/

Unfortunately it is not applicable to 6.3-rc3.

=E2=9D=AF git apply v2-wireless-mt76-mt7921-Fix-use-after-free-in-fw-featur=
es-query..patch
-v
Checking patch drivers/net/wireless/mediatek/mt76/mt7921/init.c...
Hunk #1 succeeded at 171 (offset 6 lines).
Hunk #2 succeeded at 203 (offset 6 lines).
error: while searching for:

release_firmware(fw);

return features ? features->data : 0;
}
EXPORT_SYMBOL_GPL(mt7921_check_offload_capability);


error: patch failed: drivers/net/wireless/mediatek/mt76/mt7921/init.c:211
error: drivers/net/wireless/mediatek/mt76/mt7921/init.c: patch does not app=
ly

--=20
Best Regards,
Mike Gavrilov.