[PATCH] rtw88: fix potential NULL pointer access for firmware

[PATCH] rtw88: fix potential NULL pointer access for firmware

[yhchuang]

From: Yan-Hsuan Chuang <yhchuang@realtek.com>

Driver could access a NULL firmware pointer if we don't
return here.

Fixes: 5195b90426409 ("rtw88: avoid FW info flood")
Reported-by: kbuild test robot <lkp@intel.com>
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Yan-Hsuan Chuang <yhchuang@realtek.com>
---
 drivers/net/wireless/realtek/rtw88/main.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/net/wireless/realtek/rtw88/main.c b/drivers/net/wireless/realtek/rtw88/main.c
index 021668f1b74f..de82d08ea29e 100644
--- a/drivers/net/wireless/realtek/rtw88/main.c
+++ b/drivers/net/wireless/realtek/rtw88/main.c
@@ -1024,8 +1024,10 @@ static void rtw_load_firmware_cb(const struct firmware *firmware, void *context)
 	struct rtw_fw_state *fw = &rtwdev->fw;
 	const struct rtw_fw_hdr *fw_hdr;
 
-	if (!firmware)
+	if (!firmware || !firmware->data) {
 		rtw_err(rtwdev, "failed to request firmware\n");
+		return;
+	}
 
 	fw_hdr = (const struct rtw_fw_hdr *)firmware->data;
 	fw->h2c_version = le16_to_cpu(fw_hdr->h2c_fmt_ver);
-- 
2.17.1

Re: [PATCH] rtw88: fix potential NULL pointer access for firmware

[Kalle Valo]

<yhchuang@realtek.com> wrote:

> From: Yan-Hsuan Chuang <yhchuang@realtek.com>
> 
> Driver could access a NULL firmware pointer if we don't
> return here.
> 
> Fixes: 5195b90426409 ("rtw88: avoid FW info flood")
> Reported-by: kbuild test robot <lkp@intel.com>
> Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
> Signed-off-by: Yan-Hsuan Chuang <yhchuang@realtek.com>

Patch applied to wireless-drivers-next.git, thanks.

f530c1961af2 rtw88: fix potential NULL pointer access for firmware

-- 
https://patchwork.kernel.org/patch/11227185/

https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches

Re: [PATCH] rtw88: fix potential NULL pointer access for firmware

[Brian Norris]

On Tue, Nov 5, 2019 at 1:06 AM <yhchuang@realtek.com> wrote:
...
> Fixes: 5195b90426409 ("rtw88: avoid FW info flood")
...
> --- a/drivers/net/wireless/realtek/rtw88/main.c
> +++ b/drivers/net/wireless/realtek/rtw88/main.c
> @@ -1024,8 +1024,10 @@ static void rtw_load_firmware_cb(const struct firmware *firmware, void *context)
>         struct rtw_fw_state *fw = &rtwdev->fw;
>         const struct rtw_fw_hdr *fw_hdr;
>
> -       if (!firmware)
> +       if (!firmware || !firmware->data) {
>                 rtw_err(rtwdev, "failed to request firmware\n");

I think you still wanted 'complete_all()' here, otherwise your waiters
will hang forever. (They correctly check whether the firmware is NULL,
so that's not a problem there.)

I'll send a follow-up to the follow-up :)

Brian

> +               return;
> +       }