linux-wireless.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Luciano Coelho <luciano.coelho@intel.com>
To: Markus Elfring <Markus.Elfring@web.de>,
	linux-wireless@vger.kernel.org, linuxwifi@intel.com,
	netdev@vger.kernel.org, "David S. Miller" <davem@davemloft.net>,
	Emmanuel Grumbach <emmanuel.grumbach@intel.com>,
	Johannes Berg <johannes.berg@intel.com>,
	Kalle Valo <kvalo@codeaurora.org>
Cc: LKML <linux-kernel@vger.kernel.org>,
	kernel-janitors@vger.kernel.org, Aditya Pakki <pakki001@umn.edu>,
	Kangjie Lu <kjlu@umn.edu>, Navid Emamdoost <emamd001@umn.edu>,
	Stephen McCamant <smccaman@umn.edu>
Subject: Re: iwlwifi: Checking a kmemdup() call in iwl_req_fw_callback()
Date: Mon, 25 Nov 2019 09:24:58 +0200	[thread overview]
Message-ID: <ea75c55485c0d893b15a67462728b45b775921b0.camel@intel.com> (raw)
In-Reply-To: <71774617-79f9-1365-4267-a15a47422d10@web.de>

On Sat, 2019-10-12 at 19:26 +0200, Markus Elfring wrote:
> Hello,
> 
> I tried another script for the semantic patch language out.
> This source code analysis approach points out that the implementation
> of the function “iwl_req_fw_callback” contains still an unchecked call
> of the function “kmemdup”.
> https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/drivers/net/wireless/intel/iwlwifi/iwl-drv.c?id=1c0cc5f1ae5ee5a6913704c0d75a6e99604ee30a#n1454
> https://elixir.bootlin.com/linux/v5.4-rc2/source/drivers/net/wireless/intel/iwlwifi/iwl-drv.c#L1454
> 
> Can it be that just an other data structure member should be used
> for the desired null pointer check at this place?

Hi Markus,

Sorry for the delay in replying to this.

I've checked this now and you are right.  We are checking the element
in the array that contains the length of the allocation we requested
instead of checking the pointer returned by kmemdup().  This was
probably a typo.

I have fixed this in our internal tree and it will reach the mainline
following our normal upstreaming process.

Thanks for reporting!

--
Cheers,
Luca.


      reply	other threads:[~2019-11-25  7:25 UTC|newest]

Thread overview: 2+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2019-10-12 17:26 iwlwifi: Checking a kmemdup() call in iwl_req_fw_callback() Markus Elfring
2019-11-25  7:24 ` Luciano Coelho [this message]

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=ea75c55485c0d893b15a67462728b45b775921b0.camel@intel.com \
    --to=luciano.coelho@intel.com \
    --cc=Markus.Elfring@web.de \
    --cc=davem@davemloft.net \
    --cc=emamd001@umn.edu \
    --cc=emmanuel.grumbach@intel.com \
    --cc=johannes.berg@intel.com \
    --cc=kernel-janitors@vger.kernel.org \
    --cc=kjlu@umn.edu \
    --cc=kvalo@codeaurora.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-wireless@vger.kernel.org \
    --cc=linuxwifi@intel.com \
    --cc=netdev@vger.kernel.org \
    --cc=pakki001@umn.edu \
    --cc=smccaman@umn.edu \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).