Received: by 2002:a05:6a10:9848:0:0:0:0 with SMTP id x8csp4594298pxf; Tue, 23 Mar 2021 14:52:39 -0700 (PDT) X-Google-Smtp-Source: ABdhPJy+dC9wdHKSMeKmxIr2QpsK3radJNvRwZREuF4JGUbEWWVDRxUfkrmoCf3p8qwfK0aQhQdy X-Received: by 2002:a17:906:40c7:: with SMTP id a7mr278237ejk.109.1616536359016; Tue, 23 Mar 2021 14:52:39 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1616536359; cv=none; d=google.com; s=arc-20160816; b=RGZ50I1Jl+YO7vL1I+8q1HgophLBTIxVVCdWSiuJJs/wJgkSm4A28evsEtx4D75g99 +lzMLo3BNUr8KN3q0iNPJOaM9F2tz2rUejdyeMTHYggIJSoyhdI/CH/rdX5JLKXbpWCO AjTQHR0CTIBrQ7ozy8R78RaEkbMExDTgsDSW5RPHFROJTGo6FTatqoNAzNtemXWCaaRy PWOsabX5mI3+Y8V6Zt6I6oFFSH2UbSCmz7dk4t1o0Qyf6PIBXi5tU9RuFVLoI8dQodln wKBpbIlxJM+FLYmfZRWXh30NTuJP7/7RfNUyVaWnHtFtalADZ9dqW+Yg5FPnAj5vO2Iw ctqg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :message-id:date:subject:cc:to:from:dkim-signature; bh=4uIV6Ebag0oE7R9N2yEAdozaBQ1FZ+DoFq3RMSVopoM=; b=0SyT/0DmL4A3oJnrgdl8d22VWD7y4vRC1zoUyLMEbK532nfbximJ4SGoXpbSY6d37s +GEHXs8GWUhPJkvj922hM0IwxNVp1OiialvoVd9O3H44nlI4NwKoGudcqGtEbv7ENbQg dSFQzwsxvFeG/SI/t3ntPnZKKVB5B/s7P/+myuBTaoB0fou6N+hPd3cLb0Xg0Grm4u+Z VsBCmHnJZVcJlXqnPns9/DdFvDUj2wABmPjtaxjCuHaHOiPUeb4tN2+/vt4qEnw94mc8 +UtNfpgbf1e+f3tSwODn0qwVYj/BlLzol80qnxKUnakSIsij7ZDW6DxPlQuM3bjPvZoO qUmA== ARC-Authentication-Results: i=1; mx.google.com; dkim=fail header.i=@nbd.name header.s=20160729 header.b=sswfXl3d; spf=pass (google.com: domain of linux-wireless-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-wireless-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [23.128.96.18]) by mx.google.com with ESMTP id rl3si204486ejb.86.2021.03.23.14.51.40; Tue, 23 Mar 2021 14:52:39 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-wireless-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18; Authentication-Results: mx.google.com; dkim=fail header.i=@nbd.name header.s=20160729 header.b=sswfXl3d; spf=pass (google.com: domain of linux-wireless-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-wireless-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233622AbhCWVs1 (ORCPT + 99 others); Tue, 23 Mar 2021 17:48:27 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:59614 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233564AbhCWVrs (ORCPT ); Tue, 23 Mar 2021 17:47:48 -0400 Received: from nbd.name (nbd.name [IPv6:2a01:4f8:221:3d45::2]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id D4898C061574 for ; Tue, 23 Mar 2021 14:47:47 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=nbd.name; s=20160729; h=Content-Transfer-Encoding:MIME-Version:Message-Id:Date:Subject :Cc:To:From:Sender:Reply-To:Content-Type:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: In-Reply-To:References:List-Id:List-Help:List-Unsubscribe:List-Subscribe: List-Post:List-Owner:List-Archive; bh=4uIV6Ebag0oE7R9N2yEAdozaBQ1FZ+DoFq3RMSVopoM=; b=sswfXl3dH+25mhwykTDNB4HJLX 4GUsBFU0o3u4Hm0AsDvWZPhmxJIuDxhp9DrT+pc9aJ15nhoAeoupuXtv+uQifjhQin/ywscPCO01L jrR0+ntZX0lap58ekVO5LjCIDveEe1a91gfhw/vzP+WyUt0Vny+65lI0FR6uEtwdeztY=; Received: from p4ff13c8d.dip0.t-ipconnect.de ([79.241.60.141] helo=localhost.localdomain) by ds12 with esmtpsa (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.89) (envelope-from ) id 1lOosI-0002UO-I8; Tue, 23 Mar 2021 22:47:42 +0100 From: Felix Fietkau To: linux-wireless@vger.kernel.org Cc: kvalo@codeaurora.org, greearb@candelatech.com Subject: [PATCH 5.12] mt76: fix potential DMA mapping leak Date: Tue, 23 Mar 2021 22:47:37 +0100 Message-Id: <20210323214737.53254-1-nbd@nbd.name> X-Mailer: git-send-email 2.30.1 MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: linux-wireless@vger.kernel.org With buf uninitialized in mt76_dma_tx_queue_skb_raw, its field skip_unmap could potentially inherit a non-zero value from stack garbage. If this happens, it will cause DMA mappings for MCU command frames to not be unmapped after completion Fixes: 27d5c528a7ca ("mt76: fix double DMA unmap of the first buffer on 7615/7915") Cc: stable@vger.kernel.org Signed-off-by: Felix Fietkau --- drivers/net/wireless/mediatek/mt76/dma.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/wireless/mediatek/mt76/dma.c b/drivers/net/wireless/mediatek/mt76/dma.c index 2f27c43ad76d..7196fa9047e6 100644 --- a/drivers/net/wireless/mediatek/mt76/dma.c +++ b/drivers/net/wireless/mediatek/mt76/dma.c @@ -309,7 +309,7 @@ static int mt76_dma_tx_queue_skb_raw(struct mt76_dev *dev, struct mt76_queue *q, struct sk_buff *skb, u32 tx_info) { - struct mt76_queue_buf buf; + struct mt76_queue_buf buf = {}; dma_addr_t addr; if (q->queued + 1 >= q->ndesc - 1) -- 2.30.1