Received-SPF: pass (google.com: domain of linux-wireless+bounces-7602-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:4601:e00::3 as permitted sender) client-ip=2604:1380:4601:e00::3;
Date: Mon, 13 May 2024 18:13:08 +0200
From: Lorenzo Bianconi <lorenzo@kernel.org>
To: sicong <congei42@163.com>
Cc: nbd@nbd.name, ryder.lee@mediatek.com, shayne.chen@mediatek.com,
	sean.wang@mediatek.com, kvalo@kernel.org, matthias.bgg@gmail.com,
	angelogioacchino.delregno@collabora.com,
	linux-wireless@vger.kernel.org, linux-mediatek@lists.infradead.org
Subject: Re: [PATCH v1] wifi: mt76: mt7615: fix null pointer dereference bug
Message-ID: <ZkI8FPNxOQAUFeyU@lore-desk>
References: <6206228d.bdee.18f72609cf4.Coremail.congei42@163.com>
Precedence: bulk
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha512;
	protocol="application/pgp-signature"; boundary="Rp72CSPL56MRPJkI"
Content-Disposition: inline
In-Reply-To: <6206228d.bdee.18f72609cf4.Coremail.congei42@163.com>


--Rp72CSPL56MRPJkI
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

> Function mt7615_coredump_work will call vzalloc to allocate a large amount
> of memory space, the size of which is 1300KB. There should be a null
> pointer check after vzalloc. Otherwise, when the memory allocation fails
> and returns NULL, the function will cause kernel crash.
>=20
> Fixes: de791098459d ("wifi: mt76: mt7615: fix null pointer dereference bu=
g")
> Signed-off-by: Sicong Huang <congei42@163.com>
> ---
>  drivers/net/wireless/mediatek/mt76/mt7615/mac.c | 3 +++
>  1 file changed, 3 insertions(+)
>=20
> diff --git a/drivers/net/wireless/mediatek/mt76/mt7615/mac.c b/drivers/ne=
t/wireless/mediatek/mt76/mt7615/mac.c
> index 7ba789834e8d..04eb52904520 100644
> --- a/drivers/net/wireless/mediatek/mt76/mt7615/mac.c
> +++ b/drivers/net/wireless/mediatek/mt76/mt7615/mac.c
> @@ -2341,6 +2341,9 @@ void mt7615_coredump_work(struct work_struct *work)
>  	}
> =20
>  	dump =3D vzalloc(MT76_CONNAC_COREDUMP_SZ);
> +	if(!dump)
> +		return;
> +
>  	data =3D dump;
> =20
>  	while (true) {
> --=20
> 2.34.1

I guess the kernel will not crash here since we check the dump pointer in t=
he
while loop, we will just flush the msg_list queue.

Regards,
Lorenzo

--Rp72CSPL56MRPJkI
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iHUEABYKAB0WIQTquNwa3Txd3rGGn7Y6cBh0uS2trAUCZkI8FAAKCRA6cBh0uS2t
rH1PAQC/NKiI0N81cddugxpBRaXspuRUoF19NUeJfif9gvHdsgD/VuFcYRSNEGoW
GUwuGu32v2UJhfMKmHJtcJPVj6QV9g0=
=8TYy
-----END PGP SIGNATURE-----

--Rp72CSPL56MRPJkI--