| Message ID | 20200106224212.189763-1-briannorris@chromium.org (mailing list archive) |
|---|---|
| State | Accepted |
| Commit | 65b1aae0d9d5962faccc06bdb8e91a2a0b09451c |
| Delegated to: | Kalle Valo |
| Headers | show |
| Series | mwifiex: fix unbalanced locking in mwifiex_process_country_ie() | expand |
On Mon, Jan 6, 2020 at 2:43 PM Brian Norris <briannorris@chromium.org> wrote: > > We called rcu_read_lock(), so we need to call rcu_read_unlock() before > we return. > > Fixes: 3d94a4a8373b ("mwifiex: fix possible heap overflow in mwifiex_process_country_ie()") > Cc: stable@vger.kernel.org > Cc: huangwen <huangwenabc@gmail.com> > Cc: Ganapathi Bhat <ganapathi.bhat@nxp.com> > Signed-off-by: Brian Norris <briannorris@chromium.org> I probably should have mentioned somewhere here: the bug is currently in 5.5-rc and is being ported to -stable already (I'll try to head that off). So this probably should have said [PATCH 5.5]. Sorry about that. Brian
Hi Brian, > We called rcu_read_lock(), so we need to call rcu_read_unlock() before we > return. Right; I should have at least checked the previous *return* statements in the same function; Thanks for the fix; Acked-by: Ganapathi Bhat <ganapathi.bhat@nxp.com> Regards, Ganapathi
Brian Norris <briannorris@chromium.org> writes: > On Mon, Jan 6, 2020 at 2:43 PM Brian Norris <briannorris@chromium.org> wrote: >> >> We called rcu_read_lock(), so we need to call rcu_read_unlock() before >> we return. >> >> Fixes: 3d94a4a8373b ("mwifiex: fix possible heap overflow in mwifiex_process_country_ie()") >> Cc: stable@vger.kernel.org >> Cc: huangwen <huangwenabc@gmail.com> >> Cc: Ganapathi Bhat <ganapathi.bhat@nxp.com> >> Signed-off-by: Brian Norris <briannorris@chromium.org> > > I probably should have mentioned somewhere here: the bug is currently > in 5.5-rc and is being ported to -stable already (I'll try to head > that off). So this probably should have said [PATCH 5.5]. Sorry about > that. Ok, I'll queue this to v5.5.
Brian Norris <briannorris@chromium.org> wrote: > We called rcu_read_lock(), so we need to call rcu_read_unlock() before > we return. > > Fixes: 3d94a4a8373b ("mwifiex: fix possible heap overflow in mwifiex_process_country_ie()") > Cc: stable@vger.kernel.org > Cc: huangwen <huangwenabc@gmail.com> > Cc: Ganapathi Bhat <ganapathi.bhat@nxp.com> > Signed-off-by: Brian Norris <briannorris@chromium.org> > Acked-by: Ganapathi Bhat <ganapathi.bhat@nxp.com> Patch applied to wireless-drivers.git, thanks. 65b1aae0d9d5 mwifiex: fix unbalanced locking in mwifiex_process_country_ie()
diff --git a/drivers/net/wireless/marvell/mwifiex/sta_ioctl.c b/drivers/net/wireless/marvell/mwifiex/sta_ioctl.c index 6dd835f1efc2..fbfa0b15d0c8 100644 --- a/drivers/net/wireless/marvell/mwifiex/sta_ioctl.c +++ b/drivers/net/wireless/marvell/mwifiex/sta_ioctl.c @@ -232,6 +232,7 @@ static int mwifiex_process_country_ie(struct mwifiex_private *priv, if (country_ie_len > (IEEE80211_COUNTRY_STRING_LEN + MWIFIEX_MAX_TRIPLET_802_11D)) { + rcu_read_unlock(); mwifiex_dbg(priv->adapter, ERROR, "11D: country_ie_len overflow!, deauth AP\n"); return -EINVAL;
We called rcu_read_lock(), so we need to call rcu_read_unlock() before we return. Fixes: 3d94a4a8373b ("mwifiex: fix possible heap overflow in mwifiex_process_country_ie()") Cc: stable@vger.kernel.org Cc: huangwen <huangwenabc@gmail.com> Cc: Ganapathi Bhat <ganapathi.bhat@nxp.com> Signed-off-by: Brian Norris <briannorris@chromium.org> --- drivers/net/wireless/marvell/mwifiex/sta_ioctl.c | 1 + 1 file changed, 1 insertion(+)