Received-SPF: pass (google.com: domain of linux-wireless+bounces-7590-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:4601:e00::3 as permitted sender) client-ip=2604:1380:4601:e00::3;
From: Sicong Huang <congei42@163.com>
To: nbd@nbd.name,
	ryder.lee@mediatek.com,
	shayne.chen@mediatek.com,
	sean.wang@mediatek.com,
	kvalo@kernel.org,
	matthias.bgg@gmail.com,
	angelogioacchino.delregno@collabora.com
Cc: linux-wireless@vger.kernel.org,
	linux-mediatek@lists.infradead.org,
	Sicong Huang <congei42@163.com>
Subject: [PATCH v1] wifi: mt76: mt7615: fix null pointer dereference bug
Date: Mon, 13 May 2024 20:23:29 +0800
Message-Id: <20240513122329.170380-1-congei42@163.com>
Precedence: bulk
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit

Function mt7615_coredump_work will call vzalloc to allocate a large amount
of memory space, the size of which is 1300KB. There should be a null
pointer check after vzalloc. Otherwise, when the memory allocation fails
and returns NULL, the function will cause a Kernel crash.

Signed-off-by: Sicong Huang <congei42@163.com>
---
 drivers/net/wireless/mediatek/mt76/mt7615/mac.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/net/wireless/mediatek/mt76/mt7615/mac.c b/drivers/net/wireless/mediatek/mt76/mt7615/mac.c
index 7ba789834e8d..04eb52904520 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7615/mac.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7615/mac.c
@@ -2341,6 +2341,9 @@ void mt7615_coredump_work(struct work_struct *work)
 	}
 
 	dump = vzalloc(MT76_CONNAC_COREDUMP_SZ);
+	if(!dump)
+		return;
+
 	data = dump;
 
 	while (true) {
-- 
2.34.1