Received-SPF: pass (google.com: domain of linux-wireless-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Date:   Fri, 22 Jul 2022 09:37:07 +0300
From:   Dan Carpenter <dan.carpenter@oracle.com>
To:     Felix Fietkau <nbd@nbd.name>
Cc:     Lorenzo Bianconi <lorenzo@kernel.org>,
        Ryder Lee <ryder.lee@mediatek.com>,
        Shayne Chen <shayne.chen@mediatek.com>,
        Sean Wang <sean.wang@mediatek.com>,
        Kalle Valo <kvalo@kernel.org>,
        Matthias Brugger <matthias.bgg@gmail.com>,
        Ming Yen Hsieh <mingyen.hsieh@mediatek.com>,
        Quan Zhou <quan.zhou@mediatek.com>,
        Deren Wu <deren.wu@mediatek.com>,
        linux-wireless@vger.kernel.org, linux-mediatek@lists.infradead.org,
        kernel-janitors@vger.kernel.org
Subject: [PATCH] mt76: mt7921: fix use after free in mt7921_acpi_read()
Message-ID: <YtpFk+w5Q4VA8gyK@kili>
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?oQNs3Jsn8je8DxPtvsRwLbzX30j8aWy62M8YhD8555kXq/lixNvpgh9P7U7k?=
 =?us-ascii?Q?SK5mthUV1Fl2dceWese0rCk6tQ4hS2jH4gcXOFZ6mqwv2ogm7AhEwrJK/+Ej?=
 =?us-ascii?Q?5UltUgYVE0vv4nHZ8mccwfHgFukgSmYwmXrOg2Ga9HpPfyQz3iJ7yRnXbaEP?=
 =?us-ascii?Q?Byz7LPD9F7YtVGT5KQJa6u5nvpMk1450HbjWp1JqJh52wkZQYVYT0bLbFv+M?=
 =?us-ascii?Q?pVah4vfGQX0I1RzSDSUenN5Im08AzhHm4YHewZCURMqBeBNapWOC5Rs6eTTa?=
 =?us-ascii?Q?b7faDwzzH8VS4zgMx6xTI/6BZWqiT1K5RgKYJQ9uHiZCcO0lTa2q38jePoZm?=
 =?us-ascii?Q?dCnAB9NLLpsoZBo9xvgJaMYwXG2ognFvCy6OEFglR6QFaG1qkFdVGk+Axruo?=
 =?us-ascii?Q?I6oDe7VMxlk9fHTNYLH1xh5FctjACbZCZySAcxyCDdjnW/oHkaZXB+IVfhqW?=
 =?us-ascii?Q?DLKO+HHcL5EPBroP8qn1QMAyfK9tr1Xe5LOpE3ife4doO+g34+FiQt8WNWWT?=
 =?us-ascii?Q?SlIEfjnX16XC/wcpJE9qxT3mFE8wc4hSQOnjjMWJeBhpdDdMoWTvBCAZxYZn?=
 =?us-ascii?Q?Ou7ZuxfzztjpDHLIUNhTm/Lmbw1ENkq215UFIkGmTEZjl95ehXFvMgZa5y59?=
 =?us-ascii?Q?YoWhx6pBELPIIolq9gsoXVh65cvteq4aIhV7s/ipd8c6YhGn/jRaS7ddlvpG?=
 =?us-ascii?Q?rOHEMiUFQd2t1LoxR8K1NTr4ff0FQ0FcSQVF4ZL70hYfzPIBqK/+NwUbq+ZM?=
 =?us-ascii?Q?/PcgZctFyE/zvRsq5agI/rnai6XQoa6PdeRzRx5HQESluv9Yo3Thvwr6PcqE?=
 =?us-ascii?Q?l1wCDcRk8Cb3I5NB5s4qcgxDHV5oDqZTjaNEjjVsKCxzrqYqO41fuXAu+NIZ?=
 =?us-ascii?Q?MX6UDF5/XwkOPwQxZ1veE7SCw3zSSGRDJulwZLEgfYtMuj/pSGPPGKIdiUkB?=
 =?us-ascii?Q?dWz7CPa5VHMKGdLtUGRWEsyZk7k+lCTqooBQlwiSPQmRlXQX5mJUo/6OWqcF?=
 =?us-ascii?Q?e8a2s2OKIWpp9PXjmtRcs6bNS5FgU/99m32NQ3UoYO077CzlvOpEMozaaT3b?=
 =?us-ascii?Q?zP7eQUHPOrjh/i/+O0ooQMQQ6nwGD1oikU/SQPXfezFv7esUR+bO9YSysqou?=
 =?us-ascii?Q?WPpX5ataRM2iqyMzLFZT647+Ixi5Wp4kLXKla8C950QRsn5gmEkh9pWWQnYe?=
 =?us-ascii?Q?nuTcbDl/B8R8y2+T+l8275pC2BZFp8+EWKEkJN2/Fi0XkiJ3FYgdpF2wtwa+?=
 =?us-ascii?Q?WA84qaDOsTSsAVTgLAtjKJLxoymxuLXrMDZMSoEivSxdvdGIWEXHind3y+4R?=
 =?us-ascii?Q?vHC7vpz45QEZpk3xMW8uqwjYP48oL3CshQEublcYUtfVJ4s/XF275KNESdlX?=
 =?us-ascii?Q?Q0xfUfBK6aCRJbaVu/aSEEJQitkcDapv5cGvKh31e07pCOYvVPl6PWRrHUHX?=
 =?us-ascii?Q?ZIFgZ9uRdwlL50ERCvb9yTN7D3BGc9uMFkO9XEQdgTarTxw4PKxD1vghnsNN?=
 =?us-ascii?Q?Jt18hgdsjNZHLAgp8L9Pu61YDWm17agyXhNky6PYdKlrz/8vSVc1BaSqGu5k?=
 =?us-ascii?Q?WREBfYoxMqPVEbXanTYyy2AlVx7WB4+cyuFyl2UVwn+GDATDLuGpbHCiNsvz?=
 =?us-ascii?Q?iQ=3D=3D?=
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-Network-Message-Id: fb520553-55c6-4b0f-0d16-08da6baca098
X-MS-Exchange-CrossTenant-AuthSource: MWHPR1001MB2365.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 22 Jul 2022 06:37:20.2181
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: 5e4cW0Op7QzIXI/hzGxRDG6hdrd560TgtxWaDSHWSZ4edVT+UQOT3zgFniH5piPTfBmrPu15qDUyr7qsyG7WovO7cr9uRm92I/s/QajA5Zo=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: IA1PR10MB6196
X-Proofpoint-Virus-Version: vendor=baseguard
 engine=ICAP:2.0.205,Aquarius:18.0.883,Hydra:6.0.517,FMLib:17.11.122.1
 definitions=2022-07-21_28,2022-07-21_02,2022-06-22_01
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 bulkscore=0 suspectscore=0
 mlxlogscore=999 malwarescore=0 adultscore=0 mlxscore=0 spamscore=0
 phishscore=0 classifier=spam adjust=0 reason=mlx scancount=1
 engine=8.12.0-2206140000 definitions=main-2207220026
X-Proofpoint-ORIG-GUID: 8Yt3Z5ey_LYxKOInzosAGYbOJ1LrnV5J
X-Proofpoint-GUID: 8Yt3Z5ey_LYxKOInzosAGYbOJ1LrnV5J
X-Spam-Status: No, score=-2.8 required=5.0 tests=BAYES_00,DKIM_SIGNED,
        DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_LOW,
        RCVD_IN_MSPIKE_H2,SPF_HELO_NONE,SPF_NONE autolearn=ham
        autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-wireless.vger.kernel.org>
X-Mailing-List: linux-wireless@vger.kernel.org

Don't dereference "sar_root" after it has been freed.

Fixes: f965333e491e ("mt76: mt7921: introduce ACPI SAR support")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
---
 drivers/net/wireless/mediatek/mt76/mt7921/acpi_sar.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/acpi_sar.c b/drivers/net/wireless/mediatek/mt76/mt7921/acpi_sar.c
index be4f07ad3af9..47e034a9b003 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7921/acpi_sar.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7921/acpi_sar.c
@@ -13,6 +13,7 @@ mt7921_acpi_read(struct mt7921_dev *dev, u8 *method, u8 **tbl, u32 *len)
 	acpi_handle root, handle;
 	acpi_status status;
 	u32 i = 0;
+	int ret;
 
 	root = ACPI_HANDLE(mdev->dev);
 	if (!root)
@@ -52,9 +53,11 @@ mt7921_acpi_read(struct mt7921_dev *dev, u8 *method, u8 **tbl, u32 *len)
 		*(*tbl + i) = (u8)sar_unit->integer.value;
 	}
 free:
+	ret = (i == sar_root->package.count) ? 0 : -EINVAL;
+
 	kfree(sar_root);
 
-	return (i == sar_root->package.count) ? 0 : -EINVAL;
+	return ret;
 }
 
 /* MTCL : Country List Table for 6G band */
-- 
2.35.1