diff options
| author | Felix Fietkau <nbd@nbd.name> | 2026-07-02 15:51:53 +0000 |
|---|---|---|
| committer | Felix Fietkau <nbd@nbd.name> | 2026-10-07 12:50:40 +0200 |
| commit | decf5142c2d4c295684da8644d4cb93dcf956c5d (patch) | |
| tree | 7d3a08a6bfba535d6879ac343d05e93a9cf4754d /drivers/net/wireless | |
| parent | b8286bc7fe520e7117e7b6e1a1fd4c0df439aa3a (diff) | |
wifi: mt76: mt7915: guard firmware memory dump write on disabled memdump
mt7915_coredump_build()/mt7996_coredump_build() wrote dump_mem->len
unconditionally, but the allocation only reserves room for the memory
dump header when coredump_memdump is enabled and memdump_buf_len is
non-zero. In the default configuration the allocation ends right after
the fixed header, so the write landed one struct past the buffer. Only
populate the memory-dump section when it was actually allocated.
Fixes: 4dbcb9125cc3 ("wifi: mt76: mt7915: enable coredump support")
Fixes: 878161d5d4a4 ("wifi: mt76: mt7996: enable coredump support")
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Diffstat (limited to 'drivers/net/wireless')
| -rw-r--r-- | drivers/net/wireless/mediatek/mt76/mt7915/coredump.c | 7 | ||||
| -rw-r--r-- | drivers/net/wireless/mediatek/mt76/mt7996/coredump.c | 7 |
2 files changed, 8 insertions, 6 deletions
diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/coredump.c b/drivers/net/wireless/mediatek/mt76/mt7915/coredump.c index 6c7273e5b0bc..db079b274a93 100644 --- a/drivers/net/wireless/mediatek/mt76/mt7915/coredump.c +++ b/drivers/net/wireless/mediatek/mt76/mt7915/coredump.c @@ -345,11 +345,12 @@ static struct mt7915_coredump *mt7915_coredump_build(struct mt7915_dev *dev) mt7915_coredump_fw_stack(dev, dump, exception); /* gather memory content */ - dump_mem = (struct mt7915_coredump_mem *)(buf + sofar); - dump_mem->len = crash_data->memdump_buf_len; - if (coredump_memdump && crash_data->memdump_buf_len) + if (coredump_memdump && crash_data->memdump_buf_len) { + dump_mem = (struct mt7915_coredump_mem *)(buf + sofar); + dump_mem->len = crash_data->memdump_buf_len; memcpy(dump_mem->data, crash_data->memdump_buf, crash_data->memdump_buf_len); + } mutex_unlock(&dev->dump_mutex); diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/coredump.c b/drivers/net/wireless/mediatek/mt76/mt7996/coredump.c index 5c293ae965cd..be4c882b3184 100644 --- a/drivers/net/wireless/mediatek/mt76/mt7996/coredump.c +++ b/drivers/net/wireless/mediatek/mt76/mt7996/coredump.c @@ -202,11 +202,12 @@ static struct mt7996_coredump *mt7996_coredump_build(struct mt7996_dev *dev) mt7996_coredump_fw_stack(dev, dump, exception); /* gather memory content */ - dump_mem = (struct mt7996_coredump_mem *)(buf + sofar); - dump_mem->len = crash_data->memdump_buf_len; - if (coredump_memdump && crash_data->memdump_buf_len) + if (coredump_memdump && crash_data->memdump_buf_len) { + dump_mem = (struct mt7996_coredump_mem *)(buf + sofar); + dump_mem->len = crash_data->memdump_buf_len; memcpy(dump_mem->data, crash_data->memdump_buf, crash_data->memdump_buf_len); + } mutex_unlock(&dev->dump_mutex); |