2024-05-13 12:24:28

by sicong

Subject: [PATCH v1] wifi: mt76: mt7615: fix null pointer dereference bug

Function mt7615_coredump_work will call vzalloc to allocate a large amount
of memory space, the size of which is 1300KB. There should be a null
pointer check after vzalloc. Otherwise, when the memory allocation fails
and returns NULL, the function will cause a Kernel crash.

Signed-off-by: Sicong Huang <[email protected]>
---
drivers/net/wireless/mediatek/mt76/mt7615/mac.c | 3 +++
1 file changed, 3 insertions(+)

diff --git a/drivers/net/wireless/mediatek/mt76/mt7615/mac.c b/drivers/net/wireless/mediatek/mt76/mt7615/mac.c
index 7ba789834e8d..04eb52904520 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7615/mac.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7615/mac.c
@@ -2341,6 +2341,9 @@ void mt7615_coredump_work(struct work_struct *work)
}

dump = vzalloc(MT76_CONNAC_COREDUMP_SZ);
+ if(!dump)
+ return;
+
data = dump;

while (true) {
--
2.34.1

2024-05-13 13:23:30

by AngeloGioacchino Del Regno

Subject: Re: [PATCH v1] wifi: mt76: mt7615: fix null pointer dereference bug

Il 13/05/24 14:23, Sicong Huang ha scritto:
> Function mt7615_coredump_work will call vzalloc to allocate a large amount
> of memory space, the size of which is 1300KB. There should be a null
> pointer check after vzalloc. Otherwise, when the memory allocation fails

Otherwise, if the memory allocation fails ...

> and returns NULL, the function will cause a Kernel crash.
> > Signed-off-by: Sicong Huang <[email protected]>

Please add the relevant Fixes tag and resend.

Cheers,
Angelo