diff --git a/patches.suse/wifi-iwlwifi-pcie-fix-possible-NULL-pointer-derefere.patch b/patches.suse/wifi-iwlwifi-pcie-fix-possible-NULL-pointer-derefere.patch new file mode 100644 index 0000000..72eba8f --- /dev/null +++ b/patches.suse/wifi-iwlwifi-pcie-fix-possible-NULL-pointer-derefere.patch @@ -0,0 +1,56 @@ +From b655b9a9f8467684cfa8906713d33b71ea8c8f54 Mon Sep 17 00:00:00 2001 +From: Daniel Gabay +Date: Thu, 13 Apr 2023 21:40:32 +0300 +Subject: [PATCH] wifi: iwlwifi: pcie: fix possible NULL pointer dereference +Git-commit: b655b9a9f8467684cfa8906713d33b71ea8c8f54 +Patch-mainline: v6.4-rc1 +References: git-fixes + +It is possible that iwl_pci_probe() will fail and free the trans, +then afterwards iwl_pci_remove() will be called and crash by trying +to access trans which is already freed, fix it. + +iwlwifi 0000:01:00.0: Detected crf-id 0xa5a5a5a2, cnv-id 0xa5a5a5a2 + wfpm id 0xa5a5a5a2 +iwlwifi 0000:01:00.0: Can't find a correct rfid for crf id 0x5a2 +... +Bug: kernel NULL pointer dereference, address: 0000000000000028 +... +Rip: 0010:iwl_pci_remove+0x12/0x30 [iwlwifi] +pci_device_remove+0x3e/0xb0 +device_release_driver_internal+0x103/0x1f0 +driver_detach+0x4c/0x90 +bus_remove_driver+0x5c/0xd0 +driver_unregister+0x31/0x50 +pci_unregister_driver+0x40/0x90 +iwl_pci_unregister_driver+0x15/0x20 [iwlwifi] +__exit_compat+0x9/0x98 [iwlwifi] +__x64_sys_delete_module+0x147/0x260 + +Signed-off-by: Daniel Gabay +Signed-off-by: Gregory Greenman +Link: https://lore.kernel.org/r/20230413213309.082f6e21341b.I0db21d7fa9a828d571ca886713bd0b5d0b6e1e5c@changeid +Signed-off-by: Johannes Berg +Acked-by: Takashi Iwai + +--- + drivers/net/wireless/intel/iwlwifi/pcie/drv.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/drv.c b/drivers/net/wireless/intel/iwlwifi/pcie/drv.c +index 70f6c59eec5d..a60329079167 100644 +--- a/drivers/net/wireless/intel/iwlwifi/pcie/drv.c ++++ b/drivers/net/wireless/intel/iwlwifi/pcie/drv.c +@@ -1733,6 +1733,9 @@ static void iwl_pci_remove(struct pci_dev *pdev) + { + struct iwl_trans *trans = pci_get_drvdata(pdev); + ++ if (!trans) ++ return; ++ + iwl_drv_stop(trans->drv); + + iwl_trans_pcie_free(trans); +-- +2.35.3 + diff --git a/series.conf b/series.conf index 87efdc1..b4fbc65 100644 --- a/series.conf +++ b/series.conf @@ -19932,6 +19932,7 @@ patches.suse/wifi-iwlwifi-debug-fix-crash-in-__iwl_err.patch patches.suse/wifi-iwlwifi-trans-don-t-trigger-d3-interrupt-twice.patch patches.suse/wifi-iwlwifi-mvm-don-t-set-CHECKSUM_COMPLETE-for-uns.patch + patches.suse/wifi-iwlwifi-pcie-fix-possible-NULL-pointer-derefere.patch patches.suse/wifi-iwlwifi-yoyo-skip-dump-correctly-on-hw-error.patch patches.suse/wifi-iwlwifi-yoyo-Fix-possible-division-by-zero.patch patches.suse/wifi-iwlwifi-mvm-initialize-seq-variable.patch