]> www.infradead.org Git - users/willy/xarray.git/commit
net: ethernet: mtk_wed: fix use-after-free panic in mtk_wed_setup_tc_block_cb()
authorZheng Zhang <everything411@qq.com>
Sat, 10 Aug 2024 05:26:51 +0000 (13:26 +0800)
committerDavid S. Miller <davem@davemloft.net>
Mon, 12 Aug 2024 13:12:09 +0000 (14:12 +0100)
commitdb1b4bedb9b97c6d34b03d03815147c04fffe8b4
treea782dea40341eea20be3d7af880c91909e6df419
parent32316f676b4ee87c0404d333d248ccf777f739bc
net: ethernet: mtk_wed: fix use-after-free panic in mtk_wed_setup_tc_block_cb()

When there are multiple ap interfaces on one band and with WED on,
turning the interface down will cause a kernel panic on MT798X.

Previously, cb_priv was freed in mtk_wed_setup_tc_block() without
marking NULL,and mtk_wed_setup_tc_block_cb() didn't check the value, too.

Assign NULL after free cb_priv in mtk_wed_setup_tc_block() and check NULL
in mtk_wed_setup_tc_block_cb().

----------
Unable to handle kernel paging request at virtual address 0072460bca32b4f5
Call trace:
 mtk_wed_setup_tc_block_cb+0x4/0x38
 0xffffffc0794084bc
 tcf_block_playback_offloads+0x70/0x1e8
 tcf_block_unbind+0x6c/0xc8
...
---------

Fixes: 799684448e3e ("net: ethernet: mtk_wed: introduce wed wo support")
Signed-off-by: Zheng Zhang <everything411@qq.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
drivers/net/ethernet/mediatek/mtk_wed.c