netdev.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
* [PATCH] ar5523: check NULL before memcpy() in ar5523_cmd()
@ 2019-09-30 14:02 Denis Efremov
  2019-09-30 15:35 ` David Laight
  2019-09-30 20:31 ` [PATCH v2] " Denis Efremov
  0 siblings, 2 replies; 4+ messages in thread
From: Denis Efremov @ 2019-09-30 14:02 UTC (permalink / raw)
  To: linux-wireless, netdev, linux-kernel
  Cc: Denis Efremov, Pontus Fuchs, Kalle Valo, David S. Miller, stable

memcpy() call with "idata == NULL && ilen == 0" results in undefined
behavior in ar5523_cmd(). For example, NULL is passed in callchain
"ar5523_stat_work() -> ar5523_cmd_write() -> ar5523_cmd()". This patch
adds idata check before memcpy() call in ar5523_cmd() to prevent an
undefined behavior.

Cc: Pontus Fuchs <pontus.fuchs@gmail.com>
Cc: Kalle Valo <kvalo@codeaurora.org>
Cc: "David S. Miller" <davem@davemloft.net>
Cc: stable@vger.kernel.org
Signed-off-by: Denis Efremov <efremov@linux.com>
---
 drivers/net/wireless/ath/ar5523/ar5523.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/net/wireless/ath/ar5523/ar5523.c b/drivers/net/wireless/ath/ar5523/ar5523.c
index b94759daeacc..f25af5bc5282 100644
--- a/drivers/net/wireless/ath/ar5523/ar5523.c
+++ b/drivers/net/wireless/ath/ar5523/ar5523.c
@@ -255,7 +255,8 @@ static int ar5523_cmd(struct ar5523 *ar, u32 code, const void *idata,
 
 	if (flags & AR5523_CMD_FLAG_MAGIC)
 		hdr->magic = cpu_to_be32(1 << 24);
-	memcpy(hdr + 1, idata, ilen);
+	if (idata)
+		memcpy(hdr + 1, idata, ilen);
 
 	cmd->odata = odata;
 	cmd->olen = olen;
-- 
2.21.0


^ permalink raw reply	[flat|nested] 4+ messages in thread

* RE: [PATCH] ar5523: check NULL before memcpy() in ar5523_cmd()
  2019-09-30 14:02 [PATCH] ar5523: check NULL before memcpy() in ar5523_cmd() Denis Efremov
@ 2019-09-30 15:35 ` David Laight
  2019-09-30 20:31 ` [PATCH v2] " Denis Efremov
  1 sibling, 0 replies; 4+ messages in thread
From: David Laight @ 2019-09-30 15:35 UTC (permalink / raw)
  To: 'Denis Efremov', linux-wireless, netdev, linux-kernel
  Cc: Pontus Fuchs, Kalle Valo, David S. Miller, stable

From: Denis Efremov
> Sent: 30 September 2019 15:02
> 
> memcpy() call with "idata == NULL && ilen == 0" results in undefined
> behavior in ar5523_cmd(). For example, NULL is passed in callchain
> "ar5523_stat_work() -> ar5523_cmd_write() -> ar5523_cmd()". This patch
> adds idata check before memcpy() call in ar5523_cmd() to prevent an
> undefined behavior.
> 
...
> Signed-off-by: Denis Efremov <efremov@linux.com>
> ---
>  drivers/net/wireless/ath/ar5523/ar5523.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/net/wireless/ath/ar5523/ar5523.c b/drivers/net/wireless/ath/ar5523/ar5523.c
> index b94759daeacc..f25af5bc5282 100644
> --- a/drivers/net/wireless/ath/ar5523/ar5523.c
> +++ b/drivers/net/wireless/ath/ar5523/ar5523.c
> @@ -255,7 +255,8 @@ static int ar5523_cmd(struct ar5523 *ar, u32 code, const void *idata,
> 
>  	if (flags & AR5523_CMD_FLAG_MAGIC)
>  		hdr->magic = cpu_to_be32(1 << 24);
> -	memcpy(hdr + 1, idata, ilen);
> +	if (idata)
> +		memcpy(hdr + 1, idata, ilen);

That would be better as if (ilen) ...

	David

-
Registered Address Lakeside, Bramley Road, Mount Farm, Milton Keynes, MK1 1PT, UK
Registration No: 1397386 (Wales)


^ permalink raw reply	[flat|nested] 4+ messages in thread

* [PATCH v2] ar5523: check NULL before memcpy() in ar5523_cmd()
  2019-09-30 14:02 [PATCH] ar5523: check NULL before memcpy() in ar5523_cmd() Denis Efremov
  2019-09-30 15:35 ` David Laight
@ 2019-09-30 20:31 ` Denis Efremov
  2019-10-02 17:22   ` Kalle Valo
  1 sibling, 1 reply; 4+ messages in thread
From: Denis Efremov @ 2019-09-30 20:31 UTC (permalink / raw)
  To: linux-wireless, netdev, linux-kernel
  Cc: Denis Efremov, Pontus Fuchs, Kalle Valo, David S. Miller,
	David Laight, stable

memcpy() call with "idata == NULL && ilen == 0" results in undefined
behavior in ar5523_cmd(). For example, NULL is passed in callchain
"ar5523_stat_work() -> ar5523_cmd_write() -> ar5523_cmd()". This patch
adds ilen check before memcpy() call in ar5523_cmd() to prevent an
undefined behavior.

Cc: Pontus Fuchs <pontus.fuchs@gmail.com>
Cc: Kalle Valo <kvalo@codeaurora.org>
Cc: "David S. Miller" <davem@davemloft.net>
Cc: David Laight <David.Laight@ACULAB.COM>
Cc: stable@vger.kernel.org
Signed-off-by: Denis Efremov <efremov@linux.com>
---
V2: check ilen instead of idata as suggested by David Laight.

 drivers/net/wireless/ath/ar5523/ar5523.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/net/wireless/ath/ar5523/ar5523.c b/drivers/net/wireless/ath/ar5523/ar5523.c
index b94759daeacc..da2d179430ca 100644
--- a/drivers/net/wireless/ath/ar5523/ar5523.c
+++ b/drivers/net/wireless/ath/ar5523/ar5523.c
@@ -255,7 +255,8 @@ static int ar5523_cmd(struct ar5523 *ar, u32 code, const void *idata,
 
 	if (flags & AR5523_CMD_FLAG_MAGIC)
 		hdr->magic = cpu_to_be32(1 << 24);
-	memcpy(hdr + 1, idata, ilen);
+	if (ilen)
+		memcpy(hdr + 1, idata, ilen);
 
 	cmd->odata = odata;
 	cmd->olen = olen;
-- 
2.21.0


^ permalink raw reply	[flat|nested] 4+ messages in thread

* Re: [PATCH v2] ar5523: check NULL before memcpy() in ar5523_cmd()
  2019-09-30 20:31 ` [PATCH v2] " Denis Efremov
@ 2019-10-02 17:22   ` Kalle Valo
  0 siblings, 0 replies; 4+ messages in thread
From: Kalle Valo @ 2019-10-02 17:22 UTC (permalink / raw)
  To: Denis Efremov
  Cc: linux-wireless, netdev, linux-kernel, Denis Efremov,
	Pontus Fuchs, David S. Miller, David Laight, stable

Denis Efremov <efremov@linux.com> wrote:

> memcpy() call with "idata == NULL && ilen == 0" results in undefined
> behavior in ar5523_cmd(). For example, NULL is passed in callchain
> "ar5523_stat_work() -> ar5523_cmd_write() -> ar5523_cmd()". This patch
> adds ilen check before memcpy() call in ar5523_cmd() to prevent an
> undefined behavior.
> 
> Cc: Pontus Fuchs <pontus.fuchs@gmail.com>
> Cc: Kalle Valo <kvalo@codeaurora.org>
> Cc: "David S. Miller" <davem@davemloft.net>
> Cc: David Laight <David.Laight@ACULAB.COM>
> Cc: stable@vger.kernel.org
> Signed-off-by: Denis Efremov <efremov@linux.com>
> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>

Patch applied to ath-next branch of ath.git, thanks.

315cee426f87 ar5523: check NULL before memcpy() in ar5523_cmd()

-- 
https://patchwork.kernel.org/patch/11167401/

https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches


^ permalink raw reply	[flat|nested] 4+ messages in thread

end of thread, other threads:[~2019-10-02 17:22 UTC | newest]

Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-09-30 14:02 [PATCH] ar5523: check NULL before memcpy() in ar5523_cmd() Denis Efremov
2019-09-30 15:35 ` David Laight
2019-09-30 20:31 ` [PATCH v2] " Denis Efremov
2019-10-02 17:22   ` Kalle Valo

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).