* mwifiex: exit on error - without calling rcu_read_unlock() @ 2020-01-26 13:18 Antti Antinoja 2020-01-26 14:15 ` Kalle Valo 0 siblings, 1 reply; 3+ messages in thread From: Antti Antinoja @ 2020-01-26 13:18 UTC (permalink / raw) To: linux-wireless; +Cc: amitkarwar, nishants, gbhat, huxinming820 [-- Attachment #1: Type: text/plain, Size: 554 bytes --] Please refer to: * https://grsecurity.net/the_life_of_a_bad_security_fix * https://github.com/torvalds/linux/commit/3d94a4a8373bf5f45cf5f939e88b8354dbf2311b#diff-c5e2f17b92b8e8f30306c5dd148d874f At quick glance it looks to me like the issue really is there: Not calling rcu_read_unlock() before return on line 237. Happy Lunar New Year to everyone! =) Cheers, Antti -- Antti Antinoja 諾亞安提 Fennosys Oy PL 14 10211 Inkoo Finland 25141 新北市淡水區蕃薯裡 水碓25巷22號1樓 芬諾實有限公司 [-- Attachment #2: OpenPGP digital signature --] [-- Type: application/pgp-signature, Size: 833 bytes --] ^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: mwifiex: exit on error - without calling rcu_read_unlock() 2020-01-26 13:18 mwifiex: exit on error - without calling rcu_read_unlock() Antti Antinoja @ 2020-01-26 14:15 ` Kalle Valo 2020-01-26 15:04 ` Kalle Valo 0 siblings, 1 reply; 3+ messages in thread From: Kalle Valo @ 2020-01-26 14:15 UTC (permalink / raw) To: Antti Antinoja; +Cc: linux-wireless, amitkarwar, nishants, gbhat, huxinming820 Antti Antinoja <antti@fennosys.fi> writes: > Please refer to: > > * https://grsecurity.net/the_life_of_a_bad_security_fix > * > https://github.com/torvalds/linux/commit/3d94a4a8373bf5f45cf5f939e88b8354dbf2311b#diff-c5e2f17b92b8e8f30306c5dd148d874f > > At quick glance it looks to me like the issue really is there: Not > calling rcu_read_unlock() before return on line 237. Ganapahti, can you send a fix this for this? Remember to add to the commit log: Fixes: 3d94a4a8373b ("mwifiex: fix possible heap overflow in mwifiex_process_country_ie()") -- https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches ^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: mwifiex: exit on error - without calling rcu_read_unlock() 2020-01-26 14:15 ` Kalle Valo @ 2020-01-26 15:04 ` Kalle Valo 0 siblings, 0 replies; 3+ messages in thread From: Kalle Valo @ 2020-01-26 15:04 UTC (permalink / raw) To: Kalle Valo Cc: Antti Antinoja, linux-wireless, amitkarwar, nishants, gbhat, huxinming820 Kalle Valo <kvalo@codeaurora.org> writes: > Antti Antinoja <antti@fennosys.fi> writes: > >> Please refer to: >> >> * https://grsecurity.net/the_life_of_a_bad_security_fix >> * >> https://github.com/torvalds/linux/commit/3d94a4a8373bf5f45cf5f939e88b8354dbf2311b#diff-c5e2f17b92b8e8f30306c5dd148d874f >> >> At quick glance it looks to me like the issue really is there: Not >> calling rcu_read_unlock() before return on line 237. > > Ganapahti, can you send a fix this for this? > > Remember to add to the commit log: > > Fixes: 3d94a4a8373b ("mwifiex: fix possible heap overflow in mwifiex_process_country_ie()") Oh, there was already a fix available: https://patchwork.kernel.org/patch/11320227/ It just got piled up with all the patches. -- https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches ^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2020-01-26 15:04 UTC | newest] Thread overview: 3+ messages (download: mbox.gz follow: Atom feed -- links below jump to the message on this page -- 2020-01-26 13:18 mwifiex: exit on error - without calling rcu_read_unlock() Antti Antinoja 2020-01-26 14:15 ` Kalle Valo 2020-01-26 15:04 ` Kalle Valo
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox