diff options
| author |   Zheng Zhang <everything411@qq.com> | 2024-08-10 13:26:51 +0800 |
|---|---|---|
| committer |   David S. Miller <davem@davemloft.net> | 2024-08-12 14:12:09 +0100 |
| commit | db1b4bedb9b97c6d34b03d03815147c04fffe8b4 (patch) | |
| tree | a782dea40341eea20be3d7af880c91909e6df419 /tools/perf/scripts/python/call-graph-from-postgresql.py | |
| parent | net: mana: Fix RX buf alloc_size alignment and atomic op panic (diff) | |
| download | wireguard-linux-db1b4bedb9b97c6d34b03d03815147c04fffe8b4.tar.xz wireguard-linux-db1b4bedb9b97c6d34b03d03815147c04fffe8b4.zip | |
net: ethernet: mtk_wed: fix use-after-free panic in mtk_wed_setup_tc_block_cb()
When there are multiple ap interfaces on one band and with WED on,
turning the interface down will cause a kernel panic on MT798X.
Previously, cb_priv was freed in mtk_wed_setup_tc_block() without
marking NULL,and mtk_wed_setup_tc_block_cb() didn't check the value, too.
Assign NULL after free cb_priv in mtk_wed_setup_tc_block() and check NULL
in mtk_wed_setup_tc_block_cb().
----------
Unable to handle kernel paging request at virtual address 0072460bca32b4f5
Call trace:
mtk_wed_setup_tc_block_cb+0x4/0x38
0xffffffc0794084bc
tcf_block_playback_offloads+0x70/0x1e8
tcf_block_unbind+0x6c/0xc8
...
---------
Fixes: 799684448e3e ("net: ethernet: mtk_wed: introduce wed wo support")
Signed-off-by: Zheng Zhang <everything411@qq.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'tools/perf/scripts/python/call-graph-from-postgresql.py')
0 files changed, 0 insertions, 0 deletions