lkml.org 
[lkml]   [2021]   [Nov]   [15]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.14 468/849] mt76: mt7915: fix hwmon temp sensor mem use-after-free
    Date
    From: Ben Greear <greearb@candelatech.com>

    [ Upstream commit 0ae3ff5684514d72357240f1033a7494c51f93ed ]

    Without this change, garbage is seen in the hwmon name and sensors output
    for mt7915 is garbled. It appears that the hwmon logic does not make a
    copy of the incoming string, but instead just copies a char* and expects
    it to never go away.

    Fixes: 33fe9c639c13 ("mt76: mt7915: add thermal sensor device support")
    Signed-off-by: Ben Greear <greearb@candelatech.com>
    Signed-off-by: Ryder Lee <ryder.lee@mediatek.com>
    Signed-off-by: Felix Fietkau <nbd@nbd.name>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/net/wireless/mediatek/mt76/mt7915/init.c | 10 ++++++----
    1 file changed, 6 insertions(+), 4 deletions(-)

    diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/init.c b/drivers/net/wireless/mediatek/mt76/mt7915/init.c
    index 4798d6344305d..b171027e0cfa8 100644
    --- a/drivers/net/wireless/mediatek/mt76/mt7915/init.c
    +++ b/drivers/net/wireless/mediatek/mt76/mt7915/init.c
    @@ -130,9 +130,12 @@ static int mt7915_thermal_init(struct mt7915_phy *phy)
    struct wiphy *wiphy = phy->mt76->hw->wiphy;
    struct thermal_cooling_device *cdev;
    struct device *hwmon;
    + const char *name;

    - cdev = thermal_cooling_device_register(wiphy_name(wiphy), phy,
    - &mt7915_thermal_ops);
    + name = devm_kasprintf(&wiphy->dev, GFP_KERNEL, "mt7915_%s",
    + wiphy_name(wiphy));
    +
    + cdev = thermal_cooling_device_register(name, phy, &mt7915_thermal_ops);
    if (!IS_ERR(cdev)) {
    if (sysfs_create_link(&wiphy->dev.kobj, &cdev->device.kobj,
    "cooling_device") < 0)
    @@ -144,8 +147,7 @@ static int mt7915_thermal_init(struct mt7915_phy *phy)
    if (!IS_REACHABLE(CONFIG_HWMON))
    return 0;

    - hwmon = devm_hwmon_device_register_with_groups(&wiphy->dev,
    - wiphy_name(wiphy), phy,
    + hwmon = devm_hwmon_device_register_with_groups(&wiphy->dev, name, phy,
    mt7915_hwmon_groups);
    if (IS_ERR(hwmon))
    return PTR_ERR(hwmon);
    --
    2.33.0


    \
     
     \ /
      Last update: 2021-11-16 00:04    [W:2.687 / U:0.180 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site