* [PATCH] brcm80211: Avoid possible null-pointer dereferences in wlc_phy_radio_init_2056()
@ 2019-07-29 9:56 Jia-Ju Bai
2019-09-03 13:37 ` Kalle Valo
0 siblings, 1 reply; 2+ messages in thread
From: Jia-Ju Bai @ 2019-07-29 9:56 UTC (permalink / raw)
To: arend.vanspriel, franky.lin, hante.meuleman, chi-hsien.lin,
wright.feng, kvalo, davem, pieter-paul.giesberts, plaes,
rvarsha016
Cc: linux-wireless, brcm80211-dev-list.pdl, brcm80211-dev-list,
netdev, linux-kernel, Jia-Ju Bai
In wlc_phy_radio_init_2056(), regs_SYN_2056_ptr, regs_TX_2056_ptr and
regs_RX_2056_ptr may be not assigned, and thus they are still NULL.
Then, they are used on lines 20042-20050:
wlc_phy_init_radio_regs(pi, regs_SYN_2056_ptr, (u16) RADIO_2056_SYN);
wlc_phy_init_radio_regs(pi, regs_TX_2056_ptr, (u16) RADIO_2056_TX0);
wlc_phy_init_radio_regs(pi, regs_TX_2056_ptr, (u16) RADIO_2056_TX1);
wlc_phy_init_radio_regs(pi, regs_RX_2056_ptr, (u16) RADIO_2056_RX0);
wlc_phy_init_radio_regs(pi, regs_RX_2056_ptr, (u16) RADIO_2056_RX1);
Thus, possible null-pointer dereferences may occur.
To avoid these bugs, when these variables are not assigned,
wlc_phy_radio_init_2056() directly returns.
Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com>
---
drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_n.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_n.c b/drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_n.c
index 07f61d6155ea..0c57d48f47b1 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_n.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_n.c
@@ -20035,7 +20035,7 @@ static void wlc_phy_radio_init_2056(struct brcms_phy *pi)
break;
default:
- break;
+ return;
}
}
--
2.17.0
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH] brcm80211: Avoid possible null-pointer dereferences in wlc_phy_radio_init_2056()
2019-07-29 9:56 [PATCH] brcm80211: Avoid possible null-pointer dereferences in wlc_phy_radio_init_2056() Jia-Ju Bai
@ 2019-09-03 13:37 ` Kalle Valo
0 siblings, 0 replies; 2+ messages in thread
From: Kalle Valo @ 2019-09-03 13:37 UTC (permalink / raw)
To: Jia-Ju Bai
Cc: arend.vanspriel, franky.lin, hante.meuleman, chi-hsien.lin,
wright.feng, davem, pieter-paul.giesberts, plaes, rvarsha016,
linux-wireless, brcm80211-dev-list.pdl, brcm80211-dev-list,
netdev, linux-kernel, Jia-Ju Bai
Jia-Ju Bai <baijiaju1990@gmail.com> wrote:
> In wlc_phy_radio_init_2056(), regs_SYN_2056_ptr, regs_TX_2056_ptr and
> regs_RX_2056_ptr may be not assigned, and thus they are still NULL.
> Then, they are used on lines 20042-20050:
> wlc_phy_init_radio_regs(pi, regs_SYN_2056_ptr, (u16) RADIO_2056_SYN);
> wlc_phy_init_radio_regs(pi, regs_TX_2056_ptr, (u16) RADIO_2056_TX0);
> wlc_phy_init_radio_regs(pi, regs_TX_2056_ptr, (u16) RADIO_2056_TX1);
> wlc_phy_init_radio_regs(pi, regs_RX_2056_ptr, (u16) RADIO_2056_RX0);
> wlc_phy_init_radio_regs(pi, regs_RX_2056_ptr, (u16) RADIO_2056_RX1);
>
> Thus, possible null-pointer dereferences may occur.
>
> To avoid these bugs, when these variables are not assigned,
> wlc_phy_radio_init_2056() directly returns.
>
> Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com>
Patch applied to wireless-drivers-next.git, thanks.
b80df89f3909 brcm80211: Avoid possible null-pointer dereferences in wlc_phy_radio_init_2056()
--
https://patchwork.kernel.org/patch/11063553/
https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2019-09-03 13:37 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-07-29 9:56 [PATCH] brcm80211: Avoid possible null-pointer dereferences in wlc_phy_radio_init_2056() Jia-Ju Bai
2019-09-03 13:37 ` Kalle Valo
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).