From patchwork Fri Apr 19 17:42:58 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Bethany Jamison X-Patchwork-Id: 1925652 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=lists.ubuntu.com (client-ip=185.125.189.65; helo=lists.ubuntu.com; envelope-from=kernel-team-bounces@lists.ubuntu.com; receiver=patchwork.ozlabs.org) Received: from lists.ubuntu.com (lists.ubuntu.com [185.125.189.65]) (using TLSv1.2 with cipher ECDHE-ECDSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by legolas.ozlabs.org (Postfix) with ESMTPS id 4VLhnY5c9Fz1yPJ for ; Sat, 20 Apr 2024 03:43:13 +1000 (AEST) Received: from localhost ([127.0.0.1] helo=lists.ubuntu.com) by lists.ubuntu.com with esmtp (Exim 4.86_2) (envelope-from ) id 1rxsGR-0003EQ-5T; Fri, 19 Apr 2024 17:43:07 +0000 Received: from smtp-relay-internal-0.internal ([10.131.114.225] helo=smtp-relay-internal-0.canonical.com) by lists.ubuntu.com with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.86_2) (envelope-from ) id 1rxsGL-0003DX-Ta for kernel-team@lists.ubuntu.com; Fri, 19 Apr 2024 17:43:01 +0000 Received: from mail-io1-f72.google.com (mail-io1-f72.google.com [209.85.166.72]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by smtp-relay-internal-0.canonical.com (Postfix) with ESMTPS id 959B03F16A for ; Fri, 19 Apr 2024 17:43:01 +0000 (UTC) Received: by mail-io1-f72.google.com with SMTP id ca18e2360f4ac-7da6a63173bso48862539f.1 for ; Fri, 19 Apr 2024 10:43:01 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1713548580; x=1714153380; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=EHspw68PL7HMGq3vAmx4pJQoez0kY2YXEH6Gr3QTiHc=; b=Vyw1kZCU9UskTKX6kfdHpf0fNQ+b9m3XL23jVZZq5CyOKj7vKTAnoSKc7nRfU/6Iyf NerAvtA3w0XmsD6KuxzwtN2SZE2jOn2Ba10RRaWNJ9jkdIxOqzxvS3fhq/xZ7qAy+xlt j8ieQditVak4g5upvOJTPr6ufP9OdvKieQbkDSvkIo28MZyreqv8iY9cFKaCFOkmMIeA /8Qa7uVKagxgLvi03yte8ifNwaaef0uIu7JKgxOY5ZaXbrbMke8KQ6/pISAkaJtHrcbu imezC3Vby+ig3XjLfoq2GoRcgqVa1Z//mDKilodlutmTxprPQ5jme9Cj9Nr2aHi4YSOT g0ew== X-Gm-Message-State: AOJu0Ywf05oKtRj5q1U2y9rgUmZtep/KABDw8zhaEDbYN5Z84TeLA+G1 bh8NPbOp5G6PwFTA/v0BGKG7riXWxJYvDrT5UUeA7dNzjoLCi1RgPAAMvDiSH3IV20uC8XnKLQQ 1iYErLqnnoSn6fYZdcvPa5YeOe/6to1om5j9bkQxW23IOr5ErtCJ9V/uhsTbCA7Y0RxyKhyvQWU 5vsSaMZJznpUZr X-Received: by 2002:a05:6e02:12e5:b0:36a:1725:e123 with SMTP id l5-20020a056e0212e500b0036a1725e123mr3482979iln.14.1713548580331; Fri, 19 Apr 2024 10:43:00 -0700 (PDT) X-Google-Smtp-Source: AGHT+IEXOYgKQ0L6ylfGyyW8VeV0RLlv8mJ2I8la89/eL136CXLIqvgfTFBxgwxOBXWzhi8bYHfOvw== X-Received: by 2002:a05:6e02:12e5:b0:36a:1725:e123 with SMTP id l5-20020a056e0212e500b0036a1725e123mr3482968iln.14.1713548580035; Fri, 19 Apr 2024 10:43:00 -0700 (PDT) Received: from smtp.gmail.com (104-218-69-129.dynamic.lnk.ne.allofiber.net. [104.218.69.129]) by smtp.gmail.com with ESMTPSA id p11-20020a92d68b000000b0036a19d1e733sm890209iln.35.2024.04.19.10.42.59 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 19 Apr 2024 10:42:59 -0700 (PDT) From: Bethany Jamison To: kernel-team@lists.ubuntu.com Subject: [SRU][M][PATCH 1/1] wifi: iwlwifi: fix double-free bug Date: Fri, 19 Apr 2024 12:42:58 -0500 Message-Id: <20240419174258.30309-2-bethany.jamison@canonical.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20240419174258.30309-1-bethany.jamison@canonical.com> References: <20240419174258.30309-1-bethany.jamison@canonical.com> MIME-Version: 1.0 X-BeenThere: kernel-team@lists.ubuntu.com X-Mailman-Version: 2.1.20 Precedence: list List-Id: Kernel team discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: kernel-team-bounces@lists.ubuntu.com Sender: "kernel-team" From: Johannes Berg commit 353d321f63f7dbfc9ef58498cc732c9fe886a596 upstream. The storage for the TLV PC register data wasn't done like all the other storage in the drv->fw area, which is cleared at the end of deallocation. Therefore, the freeing must also be done differently, explicitly NULL'ing it out after the free, since otherwise there's a nasty double-free bug here if a file fails to load after this has been parsed, and we get another free later (e.g. because no other file exists.) Fix that by adding the missing NULL assignment. Cc: stable@vger.kernel.org Fixes: 5e31b3df86ec ("wifi: iwlwifi: dbg: print pc register data once fw dump occurred") Reported-by: Guy Kaplan Signed-off-by: Johannes Berg Reviewed-by: Gregory Greenman Signed-off-by: Miri Korenblit Link: https://msgid.link/20240123200528.675f3c24ec0d.I6ab4015cd78d82dd95471f840629972ef0331de3@changeid Signed-off-by: Johannes Berg Signed-off-by: Greg Kroah-Hartman (cherry picked from commit d24eb9a27bea8fe5237fa71be274391d9d51eff2 linux-6.7.y) CVE-2024-26694 Signed-off-by: Bethany Jamison Acked-by: Roxana Nicolescu --- drivers/net/wireless/intel/iwlwifi/iwl-drv.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-drv.c b/drivers/net/wireless/intel/iwlwifi/iwl-drv.c index fb5e254757e71..8faf4e7872bb9 100644 --- a/drivers/net/wireless/intel/iwlwifi/iwl-drv.c +++ b/drivers/net/wireless/intel/iwlwifi/iwl-drv.c @@ -128,6 +128,7 @@ static void iwl_dealloc_ucode(struct iwl_drv *drv) kfree(drv->fw.ucode_capa.cmd_versions); kfree(drv->fw.phy_integration_ver); kfree(drv->trans->dbg.pc_data); + drv->trans->dbg.pc_data = NULL; for (i = 0; i < IWL_UCODE_TYPE_MAX; i++) iwl_free_fw_img(drv, drv->fw.img + i);