| Message ID | 510ef14986079c731ea2879b3095831b60e4f648.1626240767.git.ryder.lee@mediatek.com (mailing list archive) |
|---|---|
| State | Superseded |
| Delegated to: | Felix Fietkau |
| Headers | show |
| Series | [1/3] mt76 mt7915: take RCU read lock when calling ieee80211_bss_get_elem() | expand |
On Wed, 2021-07-14 at 13:36 +0800, Ryder Lee wrote: > > if (!elem || elem->datalen < 10 || > !(elem->data[10] & > WLAN_EXT_CAPA10_OBSS_NARROW_BW_RU_TOLERANCE_SUPPORT)) > data->tolerated = false; Unrelated to this patch, but that looks like an off-by-one? If datalen == 10, then you can only access data[0] through data[9], not data[10]? johannes
diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c index 863aa18b3024..4d2e5b5e6389 100644 --- a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c +++ b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c @@ -923,12 +923,15 @@ static void mt7915_check_he_obss_narrow_bw_ru_iter(struct wiphy *wiphy, struct mt7915_he_obss_narrow_bw_ru_data *data = _data; const struct element *elem; + rcu_read_lock(); elem = ieee80211_bss_get_elem(bss, WLAN_EID_EXT_CAPABILITY); if (!elem || elem->datalen < 10 || !(elem->data[10] & WLAN_EXT_CAPA10_OBSS_NARROW_BW_RU_TOLERANCE_SUPPORT)) data->tolerated = false; + + rcu_read_unlock(); } static bool mt7915_check_he_obss_narrow_bw_ru(struct ieee80211_hw *hw,
As ieee80211_bss_get_elem() derefences an RCU to return ssid_ie, both the call to this function and any operation on this variable need protection by the RCU read lock. Signed-off-by: Ryder Lee <ryder.lee@mediatek.com> --- drivers/net/wireless/mediatek/mt76/mt7915/mcu.c | 3 +++ 1 file changed, 3 insertions(+)