diff options
| author | Kang Chen <void0red@gmail.com> | 2023-02-27 22:48:23 +0800 |
|---|---|---|
| committer | Felix Fietkau <nbd@nbd.name> | 2023-04-17 15:34:34 +0200 |
| commit | 9e47dd9f64a47ae00ca0123017584c37209ee900 (patch) | |
| tree | dbc2f771e73c48a27e24e2218bb6f676ab890131 | |
| parent | e4d2b8bcac11c23536771ff38e536c7462b213f5 (diff) | |
wifi: mt76: handle failure of vzalloc in mt7615_coredump_work
vzalloc may fails, dump might be null and will cause
illegal address access later.
Link: https://lore.kernel.org/all/Y%2Fy5Asxw3T3m4jCw@lore-desk
Fixes: d2bf7959d9c0 ("mt76: mt7663: introduce coredump support")
Signed-off-by: Kang Chen <void0red@gmail.com>
Signed-off-by: Felix Fietkau <nbd@nbd.name>
| -rw-r--r-- | drivers/net/wireless/mediatek/mt76/mt7615/mac.c | 8 |
1 files changed, 5 insertions, 3 deletions
diff --git a/drivers/net/wireless/mediatek/mt76/mt7615/mac.c b/drivers/net/wireless/mediatek/mt76/mt7615/mac.c index a95602473359..6d6b46d7bd1a 100644 --- a/drivers/net/wireless/mediatek/mt76/mt7615/mac.c +++ b/drivers/net/wireless/mediatek/mt76/mt7615/mac.c @@ -2380,7 +2380,7 @@ void mt7615_coredump_work(struct work_struct *work) break; skb_pull(skb, sizeof(struct mt7615_mcu_rxd)); - if (data + skb->len - dump > MT76_CONNAC_COREDUMP_SZ) { + if (!dump || data + skb->len - dump > MT76_CONNAC_COREDUMP_SZ) { dev_kfree_skb(skb); continue; } @@ -2390,6 +2390,8 @@ void mt7615_coredump_work(struct work_struct *work) dev_kfree_skb(skb); } - dev_coredumpv(dev->mt76.dev, dump, MT76_CONNAC_COREDUMP_SZ, - GFP_KERNEL); + + if (dump) + dev_coredumpv(dev->mt76.dev, dump, MT76_CONNAC_COREDUMP_SZ, + GFP_KERNEL); } |