From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Daniel Gabay <daniel.gabay@intel.com>,
Gregory Greenman <gregory.greenman@intel.com>,
Johannes Berg <johannes.berg@intel.com>,
Sasha Levin <sashal@kernel.org>,
kvalo@kernel.org, davem@davemloft.net, edumazet@google.com,
kuba@kernel.org, pabeni@redhat.com, mukesh.sisodiya@intel.com,
yaara.baruch@intel.com, golan.ben.ami@intel.com,
linux-wireless@vger.kernel.org, netdev@vger.kernel.org
Subject: [PATCH AUTOSEL 6.2 31/53] wifi: iwlwifi: pcie: fix possible NULL pointer dereference
Date: Thu, 4 May 2023 15:43:51 -0400 [thread overview]
Message-ID: <20230504194413.3806354-31-sashal@kernel.org> (raw)
In-Reply-To: <20230504194413.3806354-1-sashal@kernel.org>
From: Daniel Gabay <daniel.gabay@intel.com>
[ Upstream commit b655b9a9f8467684cfa8906713d33b71ea8c8f54 ]
It is possible that iwl_pci_probe() will fail and free the trans,
then afterwards iwl_pci_remove() will be called and crash by trying
to access trans which is already freed, fix it.
iwlwifi 0000:01:00.0: Detected crf-id 0xa5a5a5a2, cnv-id 0xa5a5a5a2
wfpm id 0xa5a5a5a2
iwlwifi 0000:01:00.0: Can't find a correct rfid for crf id 0x5a2
...
BUG: kernel NULL pointer dereference, address: 0000000000000028
...
RIP: 0010:iwl_pci_remove+0x12/0x30 [iwlwifi]
pci_device_remove+0x3e/0xb0
device_release_driver_internal+0x103/0x1f0
driver_detach+0x4c/0x90
bus_remove_driver+0x5c/0xd0
driver_unregister+0x31/0x50
pci_unregister_driver+0x40/0x90
iwl_pci_unregister_driver+0x15/0x20 [iwlwifi]
__exit_compat+0x9/0x98 [iwlwifi]
__x64_sys_delete_module+0x147/0x260
Signed-off-by: Daniel Gabay <daniel.gabay@intel.com>
Signed-off-by: Gregory Greenman <gregory.greenman@intel.com>
Link: https://lore.kernel.org/r/20230413213309.082f6e21341b.I0db21d7fa9a828d571ca886713bd0b5d0b6e1e5c@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/intel/iwlwifi/pcie/drv.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/drv.c b/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
index 99768d6a60322..49e8a27ecce54 100644
--- a/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
+++ b/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
@@ -1699,6 +1699,9 @@ static void iwl_pci_remove(struct pci_dev *pdev)
{
struct iwl_trans *trans = pci_get_drvdata(pdev);
+ if (!trans)
+ return;
+
iwl_drv_stop(trans->drv);
iwl_trans_pcie_free(trans);
--
2.39.2
next prev parent reply other threads:[~2023-05-04 19:49 UTC|newest]
Thread overview: 53+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-05-04 19:43 [PATCH AUTOSEL 6.2 01/53] wifi: ath: Silence memcpy run-time false positive warning Sasha Levin
2023-05-04 19:43 ` [PATCH AUTOSEL 6.2 02/53] bpf: Annotate data races in bpf_local_storage Sasha Levin
2023-05-04 19:43 ` [PATCH AUTOSEL 6.2 03/53] wifi: brcmfmac: pcie: Provide a buffer of random bytes to the device Sasha Levin
2023-05-04 19:43 ` [PATCH AUTOSEL 6.2 04/53] wifi: brcmfmac: cfg80211: Pass the PMK in binary instead of hex Sasha Levin
2023-05-04 19:43 ` [PATCH AUTOSEL 6.2 05/53] wifi: brcmfmac: pcie: Add IDs/properties for BCM4387 Sasha Levin
2023-05-04 19:43 ` [PATCH AUTOSEL 6.2 06/53] bpf, mips: Implement DADDI workarounds for JIT Sasha Levin
2023-05-04 19:43 ` [PATCH AUTOSEL 6.2 07/53] ext2: Check block size validity during mount Sasha Levin
2023-05-04 19:43 ` [PATCH AUTOSEL 6.2 08/53] scsi: lpfc: Prevent lpfc_debugfs_lockstat_write() buffer overflow Sasha Levin
2023-05-04 19:43 ` [PATCH AUTOSEL 6.2 09/53] scsi: lpfc: Correct used_rpi count when devloss tmo fires with no recovery Sasha Levin
2023-05-04 19:43 ` [PATCH AUTOSEL 6.2 10/53] wifi: rtw88: fix memory leak in rtw_usb_probe() Sasha Levin
2023-05-04 19:43 ` [PATCH AUTOSEL 6.2 11/53] wifi: brcmfmac: slab-out-of-bounds read in brcmf_get_assoc_ies() Sasha Levin
2023-05-04 19:43 ` [PATCH AUTOSEL 6.2 12/53] bnxt: avoid overflow in bnxt_get_nvram_directory() Sasha Levin
2023-05-04 19:43 ` [PATCH AUTOSEL 6.2 13/53] net: pasemi: Fix return type of pasemi_mac_start_tx() Sasha Levin
2023-05-04 19:43 ` [PATCH AUTOSEL 6.2 14/53] net: Catch invalid index in XPS mapping Sasha Levin
2023-05-04 19:43 ` [PATCH AUTOSEL 6.2 15/53] netdev: Enforce index cap in netdev_get_tx_queue Sasha Levin
2023-05-04 19:43 ` [PATCH AUTOSEL 6.2 16/53] scsi: target: iscsit: Free cmds before session free Sasha Levin
2023-05-04 19:43 ` [PATCH AUTOSEL 6.2 17/53] lib: cpu_rmap: Avoid use after free on rmap->obj array entries Sasha Levin
2023-05-04 19:43 ` [PATCH AUTOSEL 6.2 18/53] scsi: message: mptlan: Fix use after free bug in mptlan_remove() due to race condition Sasha Levin
2023-05-04 19:43 ` [PATCH AUTOSEL 6.2 19/53] gfs2: Fix inode height consistency check Sasha Levin
2023-05-04 19:43 ` [PATCH AUTOSEL 6.2 20/53] scsi: ufs: ufs-pci: Add support for Intel Lunar Lake Sasha Levin
2023-05-04 19:43 ` [PATCH AUTOSEL 6.2 21/53] scsi: hisi_sas: Grab sas_dev lock when traversing the members of sas_dev.list Sasha Levin
2023-05-04 19:43 ` [PATCH AUTOSEL 6.2 22/53] ext4: set goal start correctly in ext4_mb_normalize_request Sasha Levin
2023-05-04 19:43 ` [PATCH AUTOSEL 6.2 23/53] ext4: Fix best extent lstart adjustment logic in ext4_mb_new_inode_pa() Sasha Levin
2023-05-04 19:43 ` [PATCH AUTOSEL 6.2 24/53] crypto: jitter - permanent and intermittent health errors Sasha Levin
2023-05-04 19:43 ` [PATCH AUTOSEL 6.2 25/53] f2fs: Fix system crash due to lack of free space in LFS Sasha Levin
2023-05-04 19:43 ` [PATCH AUTOSEL 6.2 26/53] f2fs: fix to drop all dirty pages during umount() if cp_error is set Sasha Levin
2023-05-04 19:43 ` [PATCH AUTOSEL 6.2 27/53] f2fs: fix to check readonly condition correctly Sasha Levin
2023-05-04 19:43 ` [PATCH AUTOSEL 6.2 28/53] samples/bpf: Fix fout leak in hbm's run_bpf_prog Sasha Levin
2023-05-04 19:43 ` [PATCH AUTOSEL 6.2 29/53] bpf: Add preempt_count_{sub,add} into btf id deny list Sasha Levin
2023-05-04 19:43 ` [PATCH AUTOSEL 6.2 30/53] md: fix soft lockup in status_resync Sasha Levin
2023-05-04 19:43 ` Sasha Levin [this message]
2023-05-04 19:43 ` [PATCH AUTOSEL 6.2 32/53] wifi: iwlwifi: add a new PCI device ID for BZ device Sasha Levin
2023-05-04 19:43 ` [PATCH AUTOSEL 6.2 33/53] wifi: iwlwifi: pcie: Fix integer overflow in iwl_write_to_user_buf Sasha Levin
2023-05-04 19:43 ` [PATCH AUTOSEL 6.2 34/53] wifi: iwlwifi: mvm: fix ptk_pn memory leak Sasha Levin
2023-05-04 19:43 ` [PATCH AUTOSEL 6.2 35/53] block, bfq: Fix division by zero error on zero wsum Sasha Levin
2023-05-04 19:43 ` [PATCH AUTOSEL 6.2 36/53] wifi: ath11k: Ignore frags from uninitialized peer in dp Sasha Levin
2023-05-04 19:43 ` [PATCH AUTOSEL 6.2 37/53] wifi: iwlwifi: fix iwl_mvm_max_amsdu_size() for MLO Sasha Levin
2023-05-04 19:43 ` [PATCH AUTOSEL 6.2 38/53] null_blk: Always check queue mode setting from configfs Sasha Levin
2023-05-04 19:43 ` [PATCH AUTOSEL 6.2 39/53] wifi: iwlwifi: dvm: Fix memcpy: detected field-spanning write backtrace Sasha Levin
2023-05-04 19:44 ` [PATCH AUTOSEL 6.2 40/53] wifi: ath11k: Fix SKB corruption in REO destination ring Sasha Levin
2023-05-04 19:44 ` [PATCH AUTOSEL 6.2 41/53] wifi: rtw88: Fix memory leak in rtw88_usb Sasha Levin
2023-05-04 19:44 ` [PATCH AUTOSEL 6.2 42/53] nbd: fix incomplete validation of ioctl arg Sasha Levin
2023-05-04 19:44 ` [PATCH AUTOSEL 6.2 43/53] ipvs: Update width of source for ip_vs_sync_conn_options Sasha Levin
2023-05-04 19:44 ` [PATCH AUTOSEL 6.2 44/53] Bluetooth: btusb: Add new PID/VID 04ca:3801 for MT7663 Sasha Levin
2023-05-04 19:44 ` [PATCH AUTOSEL 6.2 45/53] Bluetooth: Add new quirk for broken local ext features page 2 Sasha Levin
2023-05-04 19:44 ` [PATCH AUTOSEL 6.2 46/53] Bluetooth: btrtl: add support for the RTL8723CS Sasha Levin
2023-05-04 19:44 ` [PATCH AUTOSEL 6.2 47/53] Bluetooth: Improve support for Actions Semi ATS2851 based devices Sasha Levin
2023-05-04 19:44 ` [PATCH AUTOSEL 6.2 48/53] Bluetooth: btrtl: check for NULL in btrtl_set_quirks() Sasha Levin
2023-05-04 19:44 ` [PATCH AUTOSEL 6.2 49/53] Bluetooth: btintel: Add LE States quirk support Sasha Levin
2023-05-04 19:44 ` [PATCH AUTOSEL 6.2 50/53] Bluetooth: hci_bcm: Fall back to getting bdaddr from EFI if not set Sasha Levin
2023-05-04 19:44 ` [PATCH AUTOSEL 6.2 51/53] Bluetooth: Add new quirk for broken set random RPA timeout for ATS2851 Sasha Levin
2023-05-04 19:44 ` [PATCH AUTOSEL 6.2 52/53] Bluetooth: L2CAP: fix "bad unlock balance" in l2cap_disconnect_rsp Sasha Levin
2023-05-04 19:44 ` [PATCH AUTOSEL 6.2 53/53] Bluetooth: btrtl: Add the support for RTL8851B Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20230504194413.3806354-31-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=daniel.gabay@intel.com \
--cc=davem@davemloft.net \
--cc=edumazet@google.com \
--cc=golan.ben.ami@intel.com \
--cc=gregory.greenman@intel.com \
--cc=johannes.berg@intel.com \
--cc=kuba@kernel.org \
--cc=kvalo@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-wireless@vger.kernel.org \
--cc=mukesh.sisodiya@intel.com \
--cc=netdev@vger.kernel.org \
--cc=pabeni@redhat.com \
--cc=stable@vger.kernel.org \
--cc=yaara.baruch@intel.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®