wifi: mwifiex: duplicate static structs used in driver instances

commit 27ec3c57fcadb43c79ed05b2ea31bc18c72d798a upstream.

mwifiex_band_2ghz and mwifiex_band_5ghz are statically allocated, but
used and modified in driver instances. Duplicate them before using
them in driver instances so that different driver instances do not
influence each other.

This was observed on a board which has one PCIe and one SDIO mwifiex
adapter. It blew up in mwifiex_setup_ht_caps(). This was called with
the statically allocated struct which is modified in this function.

Cc: stable@vger.kernel.org
Fixes: d6bffe8bb520 ("mwifiex: support for creation of AP interface")
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
Reviewed-by: Francesco Dolcini <francesco.dolcini@toradex.com>
Acked-by: Brian Norris <briannorris@chromium.org>
Signed-off-by: Kalle Valo <kvalo@kernel.org>
Link: https://patch.msgid.link/20240809-mwifiex-duplicate-static-structs-v1-1-6837b903b1a4@pengutronix.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/net/wireless/marvell/mwifiex/cfg80211.c b/drivers/net/wireless/marvell/mwifiex/cfg80211.c
index 03ba8ed995bf27fd15a4384c482b663535b1fe89..9c90a5bd3a81ea74884f44aeaa1b14f1af9c25fb 100644 (file)
--- a/drivers/net/wireless/marvell/mwifiex/cfg80211.c
+++ b/drivers/net/wireless/marvell/mwifiex/cfg80211.c
@@ -4314,11 +4314,27 @@ int mwifiex_register_cfg80211(struct mwifiex_adapter *adapter)
        if (ISSUPP_ADHOC_ENABLED(adapter->fw_cap_info))
                wiphy->interface_modes |= BIT(NL80211_IFTYPE_ADHOC);
 
-       wiphy->bands[NL80211_BAND_2GHZ] = &mwifiex_band_2ghz;
-       if (adapter->config_bands & BAND_A)
-               wiphy->bands[NL80211_BAND_5GHZ] = &mwifiex_band_5ghz;
-       else
+       wiphy->bands[NL80211_BAND_2GHZ] = devm_kmemdup(adapter->dev,
+                                                      &mwifiex_band_2ghz,
+                                                      sizeof(mwifiex_band_2ghz),
+                                                      GFP_KERNEL);
+       if (!wiphy->bands[NL80211_BAND_2GHZ]) {
+               ret = -ENOMEM;
+               goto err;
+       }
+
+       if (adapter->config_bands & BAND_A) {
+               wiphy->bands[NL80211_BAND_5GHZ] = devm_kmemdup(adapter->dev,
+                                                              &mwifiex_band_5ghz,
+                                                              sizeof(mwifiex_band_5ghz),
+                                                              GFP_KERNEL);
+               if (!wiphy->bands[NL80211_BAND_5GHZ]) {
+                       ret = -ENOMEM;
+                       goto err;
+               }
+       } else {
                wiphy->bands[NL80211_BAND_5GHZ] = NULL;
+       }
 
        if (adapter->drcs_enabled && ISSUPP_DRCS_ENABLED(adapter->fw_cap_info))
                wiphy->iface_combinations = &mwifiex_iface_comb_ap_sta_drcs;
@@ -4411,8 +4427,7 @@ int mwifiex_register_cfg80211(struct mwifiex_adapter *adapter)
        if (ret < 0) {
                mwifiex_dbg(adapter, ERROR,
                            "%s: wiphy_register failed: %d\n", __func__, ret);
-               wiphy_free(wiphy);
-               return ret;
+               goto err;
        }
 
        if (!adapter->regd) {
@@ -4454,4 +4469,9 @@ int mwifiex_register_cfg80211(struct mwifiex_adapter *adapter)
 
        adapter->wiphy = wiphy;
        return ret;
+
+err:
+       wiphy_free(wiphy);
+
+       return ret;
 }