Commit db1b4bed authored by Zheng Zhang's avatar Zheng Zhang Committed by David S. Miller
Browse files

net: ethernet: mtk_wed: fix use-after-free panic in mtk_wed_setup_tc_block_cb() 



When there are multiple ap interfaces on one band and with WED on,
turning the interface down will cause a kernel panic on MT798X.

Previously, cb_priv was freed in mtk_wed_setup_tc_block() without
marking NULL,and mtk_wed_setup_tc_block_cb() didn't check the value, too.

Assign NULL after free cb_priv in mtk_wed_setup_tc_block() and check NULL
in mtk_wed_setup_tc_block_cb().

----------
Unable to handle kernel paging request at virtual address 0072460bca32b4f5
Call trace:
 mtk_wed_setup_tc_block_cb+0x4/0x38
 0xffffffc0794084bc
 tcf_block_playback_offloads+0x70/0x1e8
 tcf_block_unbind+0x6c/0xc8
...
---------

Fixes: 79968444 ("net: ethernet: mtk_wed: introduce wed wo support")
Signed-off-by: default avatarZheng Zhang <everything411@qq.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 32316f67

drivers/net/ethernet/mediatek/mtk_wed.c

+4 −2
Original line number Diff line number Diff line
@@ -2666,14 +2666,15 @@ mtk_wed_setup_tc_block_cb(enum tc_setup_type type, void *type_data, void *cb_pri 
{

	struct mtk_wed_flow_block_priv *priv = cb_priv;

	struct flow_cls_offload *cls = type_data;

	struct mtk_wed_hw *hw = priv->hw;

	struct mtk_wed_hw *hw = NULL;



	if (!tc_can_offload(priv->dev))

	if (!priv || !tc_can_offload(priv->dev))

		return -EOPNOTSUPP;



	if (type != TC_SETUP_CLSFLOWER)

		return -EOPNOTSUPP;



	hw = priv->hw;

	return mtk_flow_offload_cmd(hw->eth, cls, hw->index);

}
@@ -2729,6 +2730,7 @@ mtk_wed_setup_tc_block(struct mtk_wed_hw *hw, struct net_device *dev, 
			flow_block_cb_remove(block_cb, f);

			list_del(&block_cb->driver_list);

			kfree(block_cb->cb_priv);

			block_cb->cb_priv = NULL;

		}

		return 0;

	default: