[PATCH] staging: rtl: fix possible NULL pointer dereference

[PATCH] staging: rtl: fix possible NULL pointer dereference

[Arnd Bergmann]

gcc-7 detects that wlanhdr_to_ethhdr() in two drivers calls memcpy() with
a destination argument that an earlier function call may have set to NULL:

staging/rtl8188eu/core/rtw_recv.c: In function 'wlanhdr_to_ethhdr':
staging/rtl8188eu/core/rtw_recv.c:1318:2: warning: argument 1 null where non-null expected [-Wnonnull]
staging/rtl8712/rtl871x_recv.c: In function 'r8712_wlanhdr_to_ethhdr':
staging/rtl8712/rtl871x_recv.c:649:2: warning: argument 1 null where non-null expected [-Wnonnull]

I'm fixing this by adding a NULL pointer check and returning failure
from the function, which is hopefully already handled properly.

This seems to date back to when the drivers were originally added,
so backporting the fix to stable seems appropriate. There are other
related realtek drivers in the kernel, but none of them contain a
function with a similar name or produce this warning.

Cc: stable@vger.kernel.org
Fixes: 1cc18a22b96b ("staging: r8188eu: Add files for new driver - part 5")
Fixes: 2865d42c78a9 ("staging: r8712u: Add the new driver to the mainline kernel")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
---
 drivers/staging/rtl8188eu/core/rtw_recv.c | 2 ++
 drivers/staging/rtl8712/rtl871x_recv.c    | 7 ++++++-
 2 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/drivers/staging/rtl8188eu/core/rtw_recv.c b/drivers/staging/rtl8188eu/core/rtw_recv.c
index 1bc7b97bf2ad..f2021fed704c 100644
--- a/drivers/staging/rtl8188eu/core/rtw_recv.c
+++ b/drivers/staging/rtl8188eu/core/rtw_recv.c
@@ -1313,6 +1313,8 @@ static int wlanhdr_to_ethhdr(struct recv_frame *precvframe)
 	pattrib->eth_type = eth_type;
 
 	ptr = recvframe_pull(precvframe, (rmv_len-sizeof(struct ethhdr) + (bsnaphdr ? 2 : 0)));
+	if (!ptr)
+		return _FAIL;
 
 	memcpy(ptr, pattrib->dst, ETH_ALEN);
 	memcpy(ptr+ETH_ALEN, pattrib->src, ETH_ALEN);
diff --git a/drivers/staging/rtl8712/rtl871x_recv.c b/drivers/staging/rtl8712/rtl871x_recv.c
index 4388ddf02b2c..147b75beea73 100644
--- a/drivers/staging/rtl8712/rtl871x_recv.c
+++ b/drivers/staging/rtl8712/rtl871x_recv.c
@@ -640,11 +640,16 @@ sint r8712_wlanhdr_to_ethhdr(union recv_frame *precvframe)
 		/* append rx status for mp test packets */
 		ptr = recvframe_pull(precvframe, (rmv_len -
 		      sizeof(struct ethhdr) + 2) - 24);
+		if (!ptr)
+			return _FAIL;
 		memcpy(ptr, get_rxmem(precvframe), 24);
 		ptr += 24;
-	} else
+	} else {
 		ptr = recvframe_pull(precvframe, (rmv_len -
 		      sizeof(struct ethhdr) + (bsnaphdr ? 2 : 0)));
+		if (!ptr)
+			return _FAIL;
+	}
 
 	memcpy(ptr, pattrib->dst, ETH_ALEN);
 	memcpy(ptr + ETH_ALEN, pattrib->src, ETH_ALEN);
-- 
2.9.0

Re: [PATCH] staging: rtl: fix possible NULL pointer dereference

[Larry Finger]

On 01/11/2017 08:53 AM, Arnd Bergmann wrote:
> gcc-7 detects that wlanhdr_to_ethhdr() in two drivers calls memcpy() with
> a destination argument that an earlier function call may have set to NULL:
>
> staging/rtl8188eu/core/rtw_recv.c: In function 'wlanhdr_to_ethhdr':
> staging/rtl8188eu/core/rtw_recv.c:1318:2: warning: argument 1 null where non-null expected [-Wnonnull]
> staging/rtl8712/rtl871x_recv.c: In function 'r8712_wlanhdr_to_ethhdr':
> staging/rtl8712/rtl871x_recv.c:649:2: warning: argument 1 null where non-null expected [-Wnonnull]
>
> I'm fixing this by adding a NULL pointer check and returning failure
> from the function, which is hopefully already handled properly.
>
> This seems to date back to when the drivers were originally added,
> so backporting the fix to stable seems appropriate. There are other
> related realtek drivers in the kernel, but none of them contain a
> function with a similar name or produce this warning.

Aced-by: Larry Finger <Larry.Finger@lwfinger.net>

Arnd,

Please let me now if gcc-7 shows any warnings for the code in 
drivers/net/wireless/realtek/rtlwifi/. My distro supplies gcc-4.8, and it wouod 
be a lot of work to implement gcc-7.

Larry

>
> Cc: stable@vger.kernel.org
> Fixes: 1cc18a22b96b ("staging: r8188eu: Add files for new driver - part 5")
> Fixes: 2865d42c78a9 ("staging: r8712u: Add the new driver to the mainline kernel")
> Signed-off-by: Arnd Bergmann <arnd@arndb.de>
> ---
>  drivers/staging/rtl8188eu/core/rtw_recv.c | 2 ++
>  drivers/staging/rtl8712/rtl871x_recv.c    | 7 ++++++-
>  2 files changed, 8 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/staging/rtl8188eu/core/rtw_recv.c b/drivers/staging/rtl8188eu/core/rtw_recv.c
> index 1bc7b97bf2ad..f2021fed704c 100644
> --- a/drivers/staging/rtl8188eu/core/rtw_recv.c
> +++ b/drivers/staging/rtl8188eu/core/rtw_recv.c
> @@ -1313,6 +1313,8 @@ static int wlanhdr_to_ethhdr(struct recv_frame *precvframe)
>  	pattrib->eth_type = eth_type;
>
>  	ptr = recvframe_pull(precvframe, (rmv_len-sizeof(struct ethhdr) + (bsnaphdr ? 2 : 0)));
> +	if (!ptr)
> +		return _FAIL;
>
>  	memcpy(ptr, pattrib->dst, ETH_ALEN);
>  	memcpy(ptr+ETH_ALEN, pattrib->src, ETH_ALEN);
> diff --git a/drivers/staging/rtl8712/rtl871x_recv.c b/drivers/staging/rtl8712/rtl871x_recv.c
> index 4388ddf02b2c..147b75beea73 100644
> --- a/drivers/staging/rtl8712/rtl871x_recv.c
> +++ b/drivers/staging/rtl8712/rtl871x_recv.c
> @@ -640,11 +640,16 @@ sint r8712_wlanhdr_to_ethhdr(union recv_frame *precvframe)
>  		/* append rx status for mp test packets */
>  		ptr = recvframe_pull(precvframe, (rmv_len -
>  		      sizeof(struct ethhdr) + 2) - 24);
> +		if (!ptr)
> +			return _FAIL;
>  		memcpy(ptr, get_rxmem(precvframe), 24);
>  		ptr += 24;
> -	} else
> +	} else {
>  		ptr = recvframe_pull(precvframe, (rmv_len -
>  		      sizeof(struct ethhdr) + (bsnaphdr ? 2 : 0)));
> +		if (!ptr)
> +			return _FAIL;
> +	}
>
>  	memcpy(ptr, pattrib->dst, ETH_ALEN);
>  	memcpy(ptr + ETH_ALEN, pattrib->src, ETH_ALEN);
>