From 5367804a6a8ab056b586fa34195035aa99d856cb Mon Sep 17 00:00:00 2001 From: Felix Fietkau Date: Thu, 2 Jul 2026 15:51:53 +0000 Subject: [PATCH] wifi: mt76: mt7915: guard firmware memory dump write on disabled memdump mt7915_coredump_build()/mt7996_coredump_build() wrote dump_mem->len unconditionally, but the allocation only reserves room for the memory dump header when coredump_memdump is enabled and memdump_buf_len is non-zero. In the default configuration the allocation ends right after the fixed header, so the write landed one struct past the buffer. Only populate the memory-dump section when it was actually allocated. Fixes: 4dbcb9125cc3 ("wifi: mt76: mt7915: enable coredump support") Fixes: 878161d5d4a4 ("wifi: mt76: mt7996: enable coredump support") Signed-off-by: Felix Fietkau --- mt7915/coredump.c | 7 ++++--- mt7996/coredump.c | 7 ++++--- 2 files changed, 8 insertions(+), 6 deletions(-) diff --git a/mt7915/coredump.c b/mt7915/coredump.c index 6c7273e5..db079b27 100644 --- a/mt7915/coredump.c +++ b/mt7915/coredump.c @@ -345,11 +345,12 @@ static struct mt7915_coredump *mt7915_coredump_build(struct mt7915_dev *dev) mt7915_coredump_fw_stack(dev, dump, exception); /* gather memory content */ - dump_mem = (struct mt7915_coredump_mem *)(buf + sofar); - dump_mem->len = crash_data->memdump_buf_len; - if (coredump_memdump && crash_data->memdump_buf_len) + if (coredump_memdump && crash_data->memdump_buf_len) { + dump_mem = (struct mt7915_coredump_mem *)(buf + sofar); + dump_mem->len = crash_data->memdump_buf_len; memcpy(dump_mem->data, crash_data->memdump_buf, crash_data->memdump_buf_len); + } mutex_unlock(&dev->dump_mutex); diff --git a/mt7996/coredump.c b/mt7996/coredump.c index 5c293ae9..be4c882b 100644 --- a/mt7996/coredump.c +++ b/mt7996/coredump.c @@ -202,11 +202,12 @@ static struct mt7996_coredump *mt7996_coredump_build(struct mt7996_dev *dev) mt7996_coredump_fw_stack(dev, dump, exception); /* gather memory content */ - dump_mem = (struct mt7996_coredump_mem *)(buf + sofar); - dump_mem->len = crash_data->memdump_buf_len; - if (coredump_memdump && crash_data->memdump_buf_len) + if (coredump_memdump && crash_data->memdump_buf_len) { + dump_mem = (struct mt7996_coredump_mem *)(buf + sofar); + dump_mem->len = crash_data->memdump_buf_len; memcpy(dump_mem->data, crash_data->memdump_buf, crash_data->memdump_buf_len); + } mutex_unlock(&dev->dump_mutex);