From 42dace9ce247afcd462e54b7e8d910f63d60fb7e Mon Sep 17 00:00:00 2001 From: Ben Greear Date: Wed, 22 Mar 2023 17:37:17 +0100 Subject: [PATCH] wifi: mt76: mt7921: Fix use-after-free in fw features query. Stop referencing 'features' memory after release_firmware is called. Fixes this crash: RIP: 0010:mt7921_check_offload_capability+0x17d mt7921_pci_probe+0xca/0x4b0 ... Signed-off-by: Ben Greear Signed-off-by: Lorenzo Bianconi Acked-by: Felix Fietkau Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/51fd8f76494348aa9ecbf0abc471ebe47a983dfd.1679502607.git.lorenzo@kernel.org --- mt7921/init.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/mt7921/init.c b/mt7921/init.c index e929f6eb..bf1da9fd 100644 --- a/mt7921/init.c +++ b/mt7921/init.c @@ -176,12 +176,12 @@ mt7921_mac_init_band(struct mt7921_dev *dev, u8 band) static u8 mt7921_get_offload_capability(struct device *dev, const char *fw_wm) { - struct mt7921_fw_features *features = NULL; const struct mt76_connac2_fw_trailer *hdr; struct mt7921_realease_info *rel_info; const struct firmware *fw; int ret, i, offset = 0; const u8 *data, *end; + u8 offload_caps = 0; ret = request_firmware(&fw, fw_wm, dev); if (ret) @@ -213,7 +213,10 @@ mt7921_get_offload_capability(struct device *dev, const char *fw_wm) data += sizeof(*rel_info); if (rel_info->tag == MT7921_FW_TAG_FEATURE) { + struct mt7921_fw_features *features; + features = (struct mt7921_fw_features *)data; + offload_caps = features->data; break; } @@ -223,7 +226,7 @@ mt7921_get_offload_capability(struct device *dev, const char *fw_wm) out: release_firmware(fw); - return features ? features->data : 0; + return offload_caps; } struct ieee80211_ops *