* [PATCH] staging: rtl8188eu: fix possible null dereference
@ 2019-09-25 21:32 Connor Kuehl
2019-09-26 0:05 ` Larry Finger
0 siblings, 1 reply; 4+ messages in thread
From: Connor Kuehl @ 2019-09-25 21:32 UTC (permalink / raw)
To: Larry.Finger, gregkh, straube.linux, devel; +Cc: linux-kernel, kernel-janitors
Inside a nested 'else' block at the beginning of this function is a
call that assigns 'psta' to the return value of 'rtw_get_stainfo()'.
If 'rtw_get_stainfo()' returns NULL and the flow of control reaches
the 'else if' where 'psta' is dereferenced, then we will dereference
a NULL pointer.
Fix this by checking if 'psta' is not NULL before reading its
'psta->qos_option' data member.
Addresses-Coverity: ("Dereference null return value")
Signed-off-by: Connor Kuehl <connor.kuehl@canonical.com>
---
drivers/staging/rtl8188eu/core/rtw_xmit.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/staging/rtl8188eu/core/rtw_xmit.c b/drivers/staging/rtl8188eu/core/rtw_xmit.c
index 952f2ab51347..bf8877cbe9b6 100644
--- a/drivers/staging/rtl8188eu/core/rtw_xmit.c
+++ b/drivers/staging/rtl8188eu/core/rtw_xmit.c
@@ -784,7 +784,7 @@ s32 rtw_make_wlanhdr(struct adapter *padapter, u8 *hdr, struct pkt_attrib *pattr
memcpy(pwlanhdr->addr2, pattrib->src, ETH_ALEN);
memcpy(pwlanhdr->addr3, get_bssid(pmlmepriv), ETH_ALEN);
- if (psta->qos_option)
+ if (psta && psta->qos_option)
qos_option = true;
} else {
RT_TRACE(_module_rtl871x_xmit_c_, _drv_err_, ("fw_state:%x is not allowed to xmit frame\n", get_fwstate(pmlmepriv)));
--
2.17.1
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [PATCH] staging: rtl8188eu: fix possible null dereference
2019-09-25 21:32 [PATCH] staging: rtl8188eu: fix possible null dereference Connor Kuehl
@ 2019-09-26 0:05 ` Larry Finger
2019-09-26 15:01 ` Connor Kuehl
0 siblings, 1 reply; 4+ messages in thread
From: Larry Finger @ 2019-09-26 0:05 UTC (permalink / raw)
To: Connor Kuehl, gregkh, straube.linux, devel; +Cc: linux-kernel, kernel-janitors
On 9/25/19 4:32 PM, Connor Kuehl wrote:
> Inside a nested 'else' block at the beginning of this function is a
> call that assigns 'psta' to the return value of 'rtw_get_stainfo()'.
> If 'rtw_get_stainfo()' returns NULL and the flow of control reaches
> the 'else if' where 'psta' is dereferenced, then we will dereference
> a NULL pointer.
>
> Fix this by checking if 'psta' is not NULL before reading its
> 'psta->qos_option' data member.
>
> Addresses-Coverity: ("Dereference null return value")
>
> Signed-off-by: Connor Kuehl <connor.kuehl@canonical.com>
> ---
> drivers/staging/rtl8188eu/core/rtw_xmit.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/staging/rtl8188eu/core/rtw_xmit.c b/drivers/staging/rtl8188eu/core/rtw_xmit.c
> index 952f2ab51347..bf8877cbe9b6 100644
> --- a/drivers/staging/rtl8188eu/core/rtw_xmit.c
> +++ b/drivers/staging/rtl8188eu/core/rtw_xmit.c
> @@ -784,7 +784,7 @@ s32 rtw_make_wlanhdr(struct adapter *padapter, u8 *hdr, struct pkt_attrib *pattr
> memcpy(pwlanhdr->addr2, pattrib->src, ETH_ALEN);
> memcpy(pwlanhdr->addr3, get_bssid(pmlmepriv), ETH_ALEN);
>
> - if (psta->qos_option)
> + if (psta && psta->qos_option)
> qos_option = true;
> } else {
> RT_TRACE(_module_rtl871x_xmit_c_, _drv_err_, ("fw_state:%x is not allowed to xmit frame\n", get_fwstate(pmlmepriv)));
>
This change is a good one, but why not get the same fix at line 779?
Larry
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH] staging: rtl8188eu: fix possible null dereference
2019-09-26 0:05 ` Larry Finger
@ 2019-09-26 15:01 ` Connor Kuehl
0 siblings, 0 replies; 4+ messages in thread
From: Connor Kuehl @ 2019-09-26 15:01 UTC (permalink / raw)
To: Larry Finger, gregkh, straube.linux, devel; +Cc: linux-kernel, kernel-janitors
On 9/25/19 5:05 PM, Larry Finger wrote:
> This change is a good one, but why not get the same fix at line 779?
Ah yes! Thanks for pointing that out. I missed that. I will send a V2
shortly.
Thank you,
Connor
>
> Larry
>
^ permalink raw reply [flat|nested] 4+ messages in thread
* [PATCH] staging: rtl8188eu: fix possible NULL dereference
@ 2015-08-14 16:27 Sudip Mukherjee
0 siblings, 0 replies; 4+ messages in thread
From: Sudip Mukherjee @ 2015-08-14 16:27 UTC (permalink / raw)
To: Greg Kroah-Hartman; +Cc: linux-kernel, devel, Sudip Mukherjee
dm_odm was being checked for NULL after dereferencing it. Lets check for
NULL first before derefenrencing it.
Signed-off-by: Sudip Mukherjee <sudip@vectorindia.org>
---
drivers/staging/rtl8188eu/hal/Hal8188ERateAdaptive.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/drivers/staging/rtl8188eu/hal/Hal8188ERateAdaptive.c b/drivers/staging/rtl8188eu/hal/Hal8188ERateAdaptive.c
index 15a1765..2633a13 100644
--- a/drivers/staging/rtl8188eu/hal/Hal8188ERateAdaptive.c
+++ b/drivers/staging/rtl8188eu/hal/Hal8188ERateAdaptive.c
@@ -659,11 +659,11 @@ void ODM_RA_UpdateRateInfo_8188E(struct odm_dm_struct *dm_odm, u8 macid, u8 Rate
{
struct odm_ra_info *pRaInfo = NULL;
+ if ((NULL == dm_odm) || (macid >= ASSOCIATE_ENTRY_NUM))
+ return;
ODM_RT_TRACE(dm_odm, ODM_COMP_RATE_ADAPTIVE, ODM_DBG_LOUD,
("macid =%d RateID = 0x%x RateMask = 0x%x SGIEnable =%d\n",
macid, RateID, RateMask, SGIEnable));
- if ((NULL == dm_odm) || (macid >= ASSOCIATE_ENTRY_NUM))
- return;
pRaInfo = &(dm_odm->RAInfo[macid]);
pRaInfo->RateID = RateID;
@@ -676,10 +676,10 @@ void ODM_RA_SetRSSI_8188E(struct odm_dm_struct *dm_odm, u8 macid, u8 Rssi)
{
struct odm_ra_info *pRaInfo = NULL;
- ODM_RT_TRACE(dm_odm, ODM_COMP_RATE_ADAPTIVE, ODM_DBG_TRACE,
- (" macid =%d Rssi =%d\n", macid, Rssi));
if ((NULL == dm_odm) || (macid >= ASSOCIATE_ENTRY_NUM))
return;
+ ODM_RT_TRACE(dm_odm, ODM_COMP_RATE_ADAPTIVE, ODM_DBG_TRACE,
+ (" macid =%d Rssi =%d\n", macid, Rssi));
pRaInfo = &(dm_odm->RAInfo[macid]);
pRaInfo->RssiStaRA = Rssi;
--
1.9.1
^ permalink raw reply related [flat|nested] 4+ messages in thread
end of thread, other threads:[~2019-09-26 15:01 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-09-25 21:32 [PATCH] staging: rtl8188eu: fix possible null dereference Connor Kuehl
2019-09-26 0:05 ` Larry Finger
2019-09-26 15:01 ` Connor Kuehl
-- strict thread matches above, loose matches on Subject: below --
2015-08-14 16:27 [PATCH] staging: rtl8188eu: fix possible NULL dereference Sudip Mukherjee
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).