[wireless-drivers,0/3] fix multiple issues in mt76u error path

Message

Lorenzo Bianconi Feb. 10, 2019, 9:49 p.m. UTC

Fix following issues in mt76u initialization error path:
- NULL pointer dereference in mt76u_mcu_deinit
- possible memory leak in mt76u_buf_free
- use-after-free warning since mt76u_queues_deinit is run twice

This series has been tested running mt76x0u driver on rpi3+
(dwc_otg controller does not support SG I/O)

Lorenzo Bianconi (3):
  mt76: usb: fix possible NULL pointer dereference in mt76u_mcu_deinit
  mt76: usb: fix possible memory leak in mt76u_buf_free
  mt76: usb: do not run mt76u_queues_deinit twice

 drivers/net/wireless/mediatek/mt76/usb.c     | 25 ++++++++++----------
 drivers/net/wireless/mediatek/mt76/usb_mcu.c |  8 ++++---
 2 files changed, 17 insertions(+), 16 deletions(-)

Comments

Kalle Valo Feb. 12, 2019, 6:59 p.m. UTC | #1

Lorenzo Bianconi <[e-mail]> writes:

> Fix following issues in mt76u initialization error path:
> - NULL pointer dereference in mt76u_mcu_deinit
> - possible memory leak in mt76u_buf_free
> - use-after-free warning since mt76u_queues_deinit is run twice
>
> This series has been tested running mt76x0u driver on rpi3+
> (dwc_otg controller does not support SG I/O)
>
> Lorenzo Bianconi (3):
>   mt76: usb: fix possible NULL pointer dereference in mt76u_mcu_deinit
>   mt76: usb: fix possible memory leak in mt76u_buf_free
>   mt76: usb: do not run mt76u_queues_deinit twice

As we are in -rc6 now, better to push these via -next. So I assume Felix
will take these.

Felix Fietkau Feb. 18, 2019, 6:56 p.m. UTC | #2

On 2019-02-10 22:49, Lorenzo Bianconi wrote:
> Fix following issues in mt76u initialization error path:
> - NULL pointer dereference in mt76u_mcu_deinit
> - possible memory leak in mt76u_buf_free
> - use-after-free warning since mt76u_queues_deinit is run twice
> 
> This series has been tested running mt76x0u driver on rpi3+
> (dwc_otg controller does not support SG I/O)
Applied, thanks.

- Felix