Patch "wifi: mt76: mt7921: fix NULL pointer access in mt7921_ipv6_addr_change" has been added to the 6.6-stable tree

DISCUSSION Bert Karwatzki 2 participants 4 messages Sep 8, 2024 1 message not in the archive Stable branch

lore

Share & tools

lore

A message that is not in the archive (sent off-list or not yet received): [email protected]

Bert Karwatzki

author

2024-09-08 14:33 UTC #1 lore raw

Am Sonntag, dem 08.09.2024 um 09:37 -0400 schrieb Sasha Levin:

Quoted 38 lines

This is a note to let you know that I've just added the patch titled
wifi: mt76: mt7921: fix NULL pointer access in mt7921_ipv6_addr_change
to the 6.6-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
     wifi-mt76-mt7921-fix-null-pointer-access-in-mt7921_i.patch
and it can be found in the queue-6.6 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.
commit 857d7854c40324bfc70a6d32c9eb0792bc7c0b56
Author: Bert Karwatzki <[email protected]>
Date:   Mon Aug 12 12:45:41 2024 +0200
wifi: mt76: mt7921: fix NULL pointer access in mt7921_ipv6_addr_change
[ Upstream commit 479ffee68d59c599f8aed8fa2dcc8e13e7bd13c3 ]
When disabling wifi mt7921_ipv6_addr_change() is called as a notifier. At this point mvif->phy is already NULL so we cannot use it here.
Signed-off-by Bert Karwatzki <[email protected]>
Signed-off-by Felix Fietkau <[email protected]>
Signed-off-by Kalle Valo <[email protected]>
Link https://patch.msgid.link/[email protected] open here
Signed-off-by Sasha Levin <[email protected]>
drivers/net/wireless/mediatek/mt76/mt7921/main.c +0 -0
index 6a5c2cae087d..6dec54431312 100644

drivers/net/wireless/mediatek/mt76/mt7921/main.c static void mt7921_ipv6_addr_change(struct ieee80211_hw *hw, · line 1101

Quoted 8 lines

drivers/net/wireless/mediatek/mt76/mt7921/main.c +1 -1

@@ -1095,7 +1095,7 @@ static void mt7921_ipv6_addr_change(struct ieee80211_hw *hw,
 				    struct inet6_dev *idev)
 {
 	struct mt792x_vif *mvif = (struct mt792x_vif *)vif->drv_priv;
-	struct mt792x_dev *dev = mvif->phy->dev;
+	struct mt792x_dev *dev = mt792x_hw_dev(hw);
 	struct inet6_ifaddr *ifa;
 	struct in6_addr ns_addrs[IEEE80211_BSS_ARP_ADDR_LIST_LEN];
 	struct sk_buff *skb;

The patch is only fixes a NULL pointer if the tree also contains this commit:

commit 574e609c4e6a0843a9ed53de79e00da8fb3e7437

Author: Felix Fietkau <[email protected]>
Date:   Thu Jul 4 15:09:47 2024 +0200

wifi: mac80211: clear vif drv_priv after remove_interface when stopping

Avoid reusing stale driver data when an interface is brought down and up again. In order to avoid having to duplicate the memset in every single driver, do it here.

Signed-off-by Felix Fietkau <[email protected]>

Link https://patch.msgid.link/[email protected] open here

Signed-off-by Johannes Berg <[email protected]>

In trees which do not contain this the patch is not necessary.

Bert Karwatzki

Greg KH

2024-09-08 14:40 UTC #2 lore raw

Quoted 60 lines · Bert Karwatzki

Am Sonntag, dem 08.09.2024 um 09:37 -0400 schrieb Sasha Levin:
Quoted 38 lines
This is a note to let you know that I've just added the patch titled
wifi: mt76: mt7921: fix NULL pointer access in mt7921_ipv6_addr_change
to the 6.6-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
     wifi-mt76-mt7921-fix-null-pointer-access-in-mt7921_i.patch
and it can be found in the queue-6.6 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.
commit 857d7854c40324bfc70a6d32c9eb0792bc7c0b56
Author: Bert Karwatzki <[email protected]>
Date:   Mon Aug 12 12:45:41 2024 +0200
wifi: mt76: mt7921: fix NULL pointer access in mt7921_ipv6_addr_change
[ Upstream commit 479ffee68d59c599f8aed8fa2dcc8e13e7bd13c3 ]
When disabling wifi mt7921_ipv6_addr_change() is called as a notifier. At this point mvif->phy is already NULL so we cannot use it here.
Signed-off-by Bert Karwatzki <[email protected]>
Signed-off-by Felix Fietkau <[email protected]>
Signed-off-by Kalle Valo <[email protected]>
Link https://patch.msgid.link/[email protected] open here
Signed-off-by Sasha Levin <[email protected]>
drivers/net/wireless/mediatek/mt76/mt7921/main.c +0 -0
index 6a5c2cae087d..6dec54431312 100644
drivers/net/wireless/mediatek/mt76/mt7921/main.c static void mt7921_ipv6_addr_change(struct ieee80211_hw *hw, · line 1101
Quoted 8 lines
drivers/net/wireless/mediatek/mt76/mt7921/main.c +1 -1
@@ -1095,7 +1095,7 @@ static void mt7921_ipv6_addr_change(struct ieee80211_hw *hw,
 				    struct inet6_dev *idev)
 {
 	struct mt792x_vif *mvif = (struct mt792x_vif *)vif->drv_priv;
-	struct mt792x_dev *dev = mvif->phy->dev;
+	struct mt792x_dev *dev = mt792x_hw_dev(hw);
 	struct inet6_ifaddr *ifa;
 	struct in6_addr ns_addrs[IEEE80211_BSS_ARP_ADDR_LIST_LEN];
 	struct sk_buff *skb;
The patch is only fixes a NULL pointer if the tree also contains this commit:
commit 574e609c4e6a0843a9ed53de79e00da8fb3e7437
Author: Felix Fietkau <[email protected]>
Date:   Thu Jul 4 15:09:47 2024 +0200
wifi: mac80211: clear vif drv_priv after remove_interface when stopping
Avoid reusing stale driver data when an interface is brought down and up again. In order to avoid having to duplicate the memset in every single driver, do it here.

Quoted 6 lines

Signed-off-by Felix Fietkau <[email protected]>
Link https://patch.msgid.link/[email protected] open here
Signed-off-by Johannes Berg <[email protected]>
In trees which do not contain this the patch is not necessary.

Ah, perhaps a Fixes: tag should have been used here then?

Anyway, I'll go drop this commit from the 2 trees now, thanks.

greg k-h

Bert Karwatzki

author

2024-09-08 17:21 UTC #3 lore raw

Am Sonntag, dem 08.09.2024 um 16:40 +0200 schrieb Greg KH:

Quoted 66 lines · Bert Karwatzki

Quoted 65 lines
Am Sonntag, dem 08.09.2024 um 09:37 -0400 schrieb Sasha Levin:
Quoted 38 lines
This is a note to let you know that I've just added the patch titled
wifi: mt76: mt7921: fix NULL pointer access in mt7921_ipv6_addr_change
to the 6.6-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
     wifi-mt76-mt7921-fix-null-pointer-access-in-mt7921_i.patch
and it can be found in the queue-6.6 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.
commit 857d7854c40324bfc70a6d32c9eb0792bc7c0b56
Author: Bert Karwatzki <[email protected]>
Date:   Mon Aug 12 12:45:41 2024 +0200
wifi: mt76: mt7921: fix NULL pointer access in mt7921_ipv6_addr_change
[ Upstream commit 479ffee68d59c599f8aed8fa2dcc8e13e7bd13c3 ]
When disabling wifi mt7921_ipv6_addr_change() is called as a notifier. At this point mvif->phy is already NULL so we cannot use it here.
Signed-off-by Bert Karwatzki <[email protected]>
Signed-off-by Felix Fietkau <[email protected]>
Signed-off-by Kalle Valo <[email protected]>
Link https://patch.msgid.link/[email protected] open here
Signed-off-by Sasha Levin <[email protected]>
drivers/net/wireless/mediatek/mt76/mt7921/main.c +0 -0
index 6a5c2cae087d..6dec54431312 100644
drivers/net/wireless/mediatek/mt76/mt7921/main.c static void mt7921_ipv6_addr_change(struct ieee80211_hw *hw, · line 1101
Quoted 8 lines
drivers/net/wireless/mediatek/mt76/mt7921/main.c +1 -1
@@ -1095,7 +1095,7 @@ static void mt7921_ipv6_addr_change(struct ieee80211_hw *hw,
 				    struct inet6_dev *idev)
 {
 	struct mt792x_vif *mvif = (struct mt792x_vif *)vif->drv_priv;
-	struct mt792x_dev *dev = mvif->phy->dev;
+	struct mt792x_dev *dev = mt792x_hw_dev(hw);
 	struct inet6_ifaddr *ifa;
 	struct in6_addr ns_addrs[IEEE80211_BSS_ARP_ADDR_LIST_LEN];
 	struct sk_buff *skb;
The patch is only fixes a NULL pointer if the tree also contains this commit:
commit 574e609c4e6a0843a9ed53de79e00da8fb3e7437
Author: Felix Fietkau <[email protected]>
Date:   Thu Jul 4 15:09:47 2024 +0200
wifi: mac80211: clear vif drv_priv after remove_interface when stopping
Avoid reusing stale driver data when an interface is brought down and up again. In order to avoid having to duplicate the memset in every single driver, do it here.
Signed-off-by Felix Fietkau <[email protected]>
Link https://patch.msgid.link/[email protected] open here
Signed-off-by Johannes Berg <[email protected]>

Quoted 7 lines

Quoted 1 line
In trees which do not contain this the patch is not necessary.
Ah, perhaps a Fixes: tag should have been used here then?
Anyway, I'll go drop this commit from the 2 trees now, thanks.
greg k-h

So
"Fixes: 09c4e6a (" wifi: mac80211: clear vif drv_priv after remove_interface when stopping")"
would be the correct tag?

Bert Karwatzki

Greg KH

2024-09-08 21:18 UTC #4 lore raw

Quoted 71 lines · Bert Karwatzki

Am Sonntag, dem 08.09.2024 um 16:40 +0200 schrieb Greg KH:
Quoted 70 lines · Bert Karwatzki
Quoted 60 lines
Am Sonntag, dem 08.09.2024 um 09:37 -0400 schrieb Sasha Levin:
Quoted 38 lines
This is a note to let you know that I've just added the patch titled
wifi: mt76: mt7921: fix NULL pointer access in mt7921_ipv6_addr_change
to the 6.6-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
     wifi-mt76-mt7921-fix-null-pointer-access-in-mt7921_i.patch
and it can be found in the queue-6.6 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.
commit 857d7854c40324bfc70a6d32c9eb0792bc7c0b56
Author: Bert Karwatzki <[email protected]>
Date:   Mon Aug 12 12:45:41 2024 +0200
wifi: mt76: mt7921: fix NULL pointer access in mt7921_ipv6_addr_change
[ Upstream commit 479ffee68d59c599f8aed8fa2dcc8e13e7bd13c3 ]
When disabling wifi mt7921_ipv6_addr_change() is called as a notifier. At this point mvif->phy is already NULL so we cannot use it here.
Signed-off-by Bert Karwatzki <[email protected]>
Signed-off-by Felix Fietkau <[email protected]>
Signed-off-by Kalle Valo <[email protected]>
Link https://patch.msgid.link/[email protected] open here
Signed-off-by Sasha Levin <[email protected]>
drivers/net/wireless/mediatek/mt76/mt7921/main.c +0 -0
index 6a5c2cae087d..6dec54431312 100644
drivers/net/wireless/mediatek/mt76/mt7921/main.c static void mt7921_ipv6_addr_change(struct ieee80211_hw *hw, · line 1101
Quoted 8 lines
drivers/net/wireless/mediatek/mt76/mt7921/main.c +1 -1
@@ -1095,7 +1095,7 @@ static void mt7921_ipv6_addr_change(struct ieee80211_hw *hw,
 				    struct inet6_dev *idev)
 {
 	struct mt792x_vif *mvif = (struct mt792x_vif *)vif->drv_priv;
-	struct mt792x_dev *dev = mvif->phy->dev;
+	struct mt792x_dev *dev = mt792x_hw_dev(hw);
 	struct inet6_ifaddr *ifa;
 	struct in6_addr ns_addrs[IEEE80211_BSS_ARP_ADDR_LIST_LEN];
 	struct sk_buff *skb;
The patch is only fixes a NULL pointer if the tree also contains this commit:
commit 574e609c4e6a0843a9ed53de79e00da8fb3e7437
Author: Felix Fietkau <[email protected]>
Date:   Thu Jul 4 15:09:47 2024 +0200
wifi: mac80211: clear vif drv_priv after remove_interface when stopping
Avoid reusing stale driver data when an interface is brought down and up again. In order to avoid having to duplicate the memset in every single driver, do it here.
Quoted 6 lines
Signed-off-by Felix Fietkau <[email protected]>
Link https://patch.msgid.link/[email protected] open here
Signed-off-by Johannes Berg <[email protected]>
In trees which do not contain this the patch is not necessary.
Ah, perhaps a Fixes: tag should have been used here then?

Quoted 8 lines

Quoted 3 lines
Anyway, I'll go drop this commit from the 2 trees now, thanks.
greg k-h
So
"Fixes: 09c4e6a (" wifi: mac80211: clear vif drv_priv after remove_interface when stopping")"
would be the correct tag?

Close, it would be:

Fixes 574e609c4e6a ("wifi: mac80211: clear vif drv_priv after remove_interface when stopping")

Right?

thanks,

greg k-h