gitops/mt76
1
0
Fork 0
mirror of https://github.com/outbackdingo/mt76.git synced 2026-10-24 13:26:48 +00:00
Code Issues Packages Projects Releases Wiki Activity

wifi: mt76: mt7915: guard firmware memory dump write on disabled memdump

Browse Source 
mt7915_coredump_build()/mt7996_coredump_build() wrote dump_mem->len
unconditionally, but the allocation only reserves room for the memory
dump header when coredump_memdump is enabled and memdump_buf_len is
non-zero. In the default configuration the allocation ends right after
the fixed header, so the write landed one struct past the buffer. Only
populate the memory-dump section when it was actually allocated.

Fixes: 4dbcb9125cc3 ("wifi: mt76: mt7915: enable coredump support")
Fixes: 878161d5d4a4 ("wifi: mt76: mt7996: enable coredump support")
Signed-off-by: Felix Fietkau <[email protected]>
This commit is contained in:
Felix Fietkau
2026-08-01 17:46:21 +02:00
parent d5738b1ab8
commit 5367804a6a
2 changed files with 8 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
mt7915/coredump.c
+4 -3
View File
@@ -345,11 +345,12 @@ static struct mt7915_coredump *mt7915_coredump_build(struct mt7915_dev *dev)
mt7915_coredump_fw_stack(dev, dump, exception);
/* gather memory content */
dump_mem = (struct mt7915_coredump_mem *)(buf + sofar);
dump_mem->len = crash_data->memdump_buf_len;
if (coredump_memdump && crash_data->memdump_buf_len)
if (coredump_memdump && crash_data->memdump_buf_len) {
dump_mem = (struct mt7915_coredump_mem *)(buf + sofar);
dump_mem->len = crash_data->memdump_buf_len;
memcpy(dump_mem->data, crash_data->memdump_buf,
crash_data->memdump_buf_len);
}
mutex_unlock(&dev->dump_mutex);
mt7996/coredump.c
+4 -3
View File
@@ -202,11 +202,12 @@ static struct mt7996_coredump *mt7996_coredump_build(struct mt7996_dev *dev)
mt7996_coredump_fw_stack(dev, dump, exception);
/* gather memory content */
dump_mem = (struct mt7996_coredump_mem *)(buf + sofar);
dump_mem->len = crash_data->memdump_buf_len;
if (coredump_memdump && crash_data->memdump_buf_len)
if (coredump_memdump && crash_data->memdump_buf_len) {
dump_mem = (struct mt7996_coredump_mem *)(buf + sofar);
dump_mem->len = crash_data->memdump_buf_len;
memcpy(dump_mem->data, crash_data->memdump_buf,
crash_data->memdump_buf_len);
}
mutex_unlock(&dev->dump_mutex);