All of lore.kernel.org
 help / color / mirror / Atom feed
From: Lorenzo Bianconi <lorenzo@kernel.org>
To: sean.wang@mediatek.com
Cc: lorenzo.bianconi@redhat.com, nbd@nbd.name,
	Soul.Huang@mediatek.com, YN.Chen@mediatek.com,
	Leon.Yen@mediatek.com, Deren.Wu@mediatek.com,
	km.lin@mediatek.com, robin.chiu@mediatek.com,
	ch.yeh@mediatek.com, posh.sun@mediatek.com,
	Eric.Liang@mediatek.com, Stella.Chang@mediatek.com,
	jemele@google.com, yenlinlai@google.com,
	linux-wireless@vger.kernel.org,
	linux-mediatek@lists.infradead.org
Subject: Re: [PATCH] mt76: mt7921: add .set_sar_specs support
Date: Tue, 22 Jun 2021 08:40:44 +0200	[thread overview]
Message-ID: <YNGF7Bl2uP0SAnv9@lore-desk> (raw)
In-Reply-To: <1624315331-16608-1-git-send-email-sean.wang@mediatek.com>


[-- Attachment #1.1: Type: text/plain, Size: 964 bytes --]

[...]
> >
> >I guess there is an use-after-free here since sar is freed at the end of nl80211_set_sar_specs, right?
> >
> 
> Nope, there is no use-after-free case happens here because frp->range just points to an entry of const struct cfg80211_sar_specs table, not the one created from nl80211_set_sar_specs.

ack, right. I misread the code.

Regards,
Lorenzo

> 
> >Regards,
> >Lorenzo
> >
> >> +		frp->power = power;
> >> +	}
> >> +
> >> +	err = mt76_connac_mcu_set_rate_txpower(mphy);
> >> +
> >> +out:
> >> +	mt7921_mutex_release(dev);
> >> +
> >> +	return err;
> >> +}
> >> +
> >>  const struct ieee80211_ops mt7921_ops = {
> >>	.tx = mt7921_tx,
> >>	.start = mt7921_start,
> >> @@ -1209,4 +1253,5 @@ const struct ieee80211_ops mt7921_ops = {
> >>	.set_rekey_data = mt7921_set_rekey_data,  #endif /* CONFIG_PM */
> >>	.flush = mt7921_flush,
> >> +	.set_sar_specs = mt7921_set_sar_specs,
> >>  };
> >> --
> >> 2.25.1
> >>

[-- Attachment #1.2: signature.asc --]
[-- Type: application/pgp-signature, Size: 228 bytes --]

[-- Attachment #2: Type: text/plain, Size: 170 bytes --]

_______________________________________________
Linux-mediatek mailing list
Linux-mediatek@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-mediatek

WARNING: multiple messages have this Message-ID (diff)
From: Lorenzo Bianconi <lorenzo@kernel.org>
To: sean.wang@mediatek.com
Cc: lorenzo.bianconi@redhat.com, nbd@nbd.name,
	Soul.Huang@mediatek.com, YN.Chen@mediatek.com,
	Leon.Yen@mediatek.com, Deren.Wu@mediatek.com,
	km.lin@mediatek.com, robin.chiu@mediatek.com,
	ch.yeh@mediatek.com, posh.sun@mediatek.com,
	Eric.Liang@mediatek.com, Stella.Chang@mediatek.com,
	jemele@google.com, yenlinlai@google.com,
	linux-wireless@vger.kernel.org,
	linux-mediatek@lists.infradead.org
Subject: Re: [PATCH] mt76: mt7921: add .set_sar_specs support
Date: Tue, 22 Jun 2021 08:40:44 +0200	[thread overview]
Message-ID: <YNGF7Bl2uP0SAnv9@lore-desk> (raw)
In-Reply-To: <1624315331-16608-1-git-send-email-sean.wang@mediatek.com>

[-- Attachment #1: Type: text/plain, Size: 964 bytes --]

[...]
> >
> >I guess there is an use-after-free here since sar is freed at the end of nl80211_set_sar_specs, right?
> >
> 
> Nope, there is no use-after-free case happens here because frp->range just points to an entry of const struct cfg80211_sar_specs table, not the one created from nl80211_set_sar_specs.

ack, right. I misread the code.

Regards,
Lorenzo

> 
> >Regards,
> >Lorenzo
> >
> >> +		frp->power = power;
> >> +	}
> >> +
> >> +	err = mt76_connac_mcu_set_rate_txpower(mphy);
> >> +
> >> +out:
> >> +	mt7921_mutex_release(dev);
> >> +
> >> +	return err;
> >> +}
> >> +
> >>  const struct ieee80211_ops mt7921_ops = {
> >>	.tx = mt7921_tx,
> >>	.start = mt7921_start,
> >> @@ -1209,4 +1253,5 @@ const struct ieee80211_ops mt7921_ops = {
> >>	.set_rekey_data = mt7921_set_rekey_data,  #endif /* CONFIG_PM */
> >>	.flush = mt7921_flush,
> >> +	.set_sar_specs = mt7921_set_sar_specs,
> >>  };
> >> --
> >> 2.25.1
> >>

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 228 bytes --]

  reply	other threads:[~2021-06-22  6:41 UTC|newest]

Thread overview: 8+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
     [not found] <YM8NBUZp+/97kiIH@lore-desk--annotate>
2021-06-21 22:42 ` [PATCH] mt76: mt7921: add .set_sar_specs support sean.wang
2021-06-21 22:42   ` sean.wang
2021-06-22  6:40   ` Lorenzo Bianconi [this message]
2021-06-22  6:40     ` Lorenzo Bianconi
2021-06-20  5:39 sean.wang
2021-06-20  5:39 ` sean.wang
2021-06-20  9:40 ` Lorenzo Bianconi
2021-06-20  9:40   ` Lorenzo Bianconi

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=YNGF7Bl2uP0SAnv9@lore-desk \
    --to=lorenzo@kernel.org \
    --cc=Deren.Wu@mediatek.com \
    --cc=Eric.Liang@mediatek.com \
    --cc=Leon.Yen@mediatek.com \
    --cc=Soul.Huang@mediatek.com \
    --cc=Stella.Chang@mediatek.com \
    --cc=YN.Chen@mediatek.com \
    --cc=ch.yeh@mediatek.com \
    --cc=jemele@google.com \
    --cc=km.lin@mediatek.com \
    --cc=linux-mediatek@lists.infradead.org \
    --cc=linux-wireless@vger.kernel.org \
    --cc=lorenzo.bianconi@redhat.com \
    --cc=nbd@nbd.name \
    --cc=posh.sun@mediatek.com \
    --cc=robin.chiu@mediatek.com \
    --cc=sean.wang@mediatek.com \
    --cc=yenlinlai@google.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.