• Zheng Zhang's avatar
    net: ethernet: mtk_wed: fix use-after-free panic in mtk_wed_setup_tc_block_cb() · db1b4bed
    Zheng Zhang authored
    When there are multiple ap interfaces on one band and with WED on,
    turning the interface down will cause a kernel panic on MT798X.
    
    Previously, cb_priv was freed in mtk_wed_setup_tc_block() without
    marking NULL,and mtk_wed_setup_tc_block_cb() didn't check the value, too.
    
    Assign NULL after free cb_priv in mtk_wed_setup_tc_block() and check NULL
    in mtk_wed_setup_tc_block_cb().
    
    ----------
    Unable to handle kernel paging request at virtual address 0072460bca32b4f5
    Call trace:
     mtk_wed_setup_tc_block_cb+0x4/0x38
     0xffffffc0794084bc
     tcf_block_playback_offloads+0x70/0x1e8
     tcf_block_unbind+0x6c/0xc8
    ...
    ---------
    
    Fixes: 79968444 ("net: ethernet: mtk_wed: introduce wed wo support")
    Signed-off-by: default avatarZheng Zhang <everything411@qq.com>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    db1b4bed
mtk_wed.c 74.4 KB