diff options
author | Bjoern A. Zeeb <bz@FreeBSD.org> | 2025-06-08 18:05:54 +0000 |
---|---|---|
committer | Bjoern A. Zeeb <bz@FreeBSD.org> | 2025-06-08 18:19:36 +0000 |
commit | 3a427b8320840f1e69779efeccc5898eb2972030 (patch) | |
tree | 10b271b1054dfc668b51f193ffe49c531a4a0214 /usr.bin/rpcgen/(public-mirror) | |
parent | 99ec65e7fe61e3148dde543ed7d6566fe589a565 (diff) |
rtw89: prevent a NULL pointer deref in rtw89_swap_chanctx()
It is currently unclear if this is a result of the driver itself already
or the way LinuxKPI drives channels and the driver simply accepting and
acting on things it no longer should.
For now put the bandaid into place to make the driver work and pass
packets. For better resilience the check does not hurt anyway.
The moment we enter rtw89_chanctx_ops_add() the first time,
entity_map 0x00000001 has the lowest bit set and find_next_zero_bit()
will return 1. As a result the driver will try to swap chanctxs and
trip over a NULL pointer in rtw89_swap_chanctx(). See comment there
for how to (likely) trigger it.
Sponsored by: The FreeBSD Foundation
Reported by: Axel Rau (Axel.Rau Chaos1.DE) with 8852CE
MFC after: 3 days
Diffstat (limited to 'usr.bin/rpcgen/(public-mirror)')
0 files changed, 0 insertions, 0 deletions