netdev.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
* [PATCH] wil6210: check len before memcpy() calls
@ 2019-10-01 12:08 Denis Efremov
  2019-10-02 17:23 ` Kalle Valo
  0 siblings, 1 reply; 2+ messages in thread
From: Denis Efremov @ 2019-10-01 12:08 UTC (permalink / raw)
  To: linux-wireless
  Cc: Denis Efremov, netdev, linux-kernel, wil6210, Maya Erez,
	Kalle Valo, David S. Miller, stable

memcpy() in wmi_set_ie() and wmi_update_ft_ies() is called with
src == NULL and len == 0. This is an undefined behavior. Fix it
by checking "ie_len > 0" before the memcpy() calls.

As suggested by GCC documentation:
"The pointers passed to memmove (and similar functions in <string.h>)
must be non-null even when nbytes==0, so GCC can use that information
to remove the check after the memmove call." [1]

[1] https://gcc.gnu.org/gcc-4.9/porting_to.html

Cc: Maya Erez <merez@codeaurora.org>
Cc: Kalle Valo <kvalo@codeaurora.org>
Cc: "David S. Miller" <davem@davemloft.net>
Cc: stable@vger.kernel.org
Signed-off-by: Denis Efremov <efremov@linux.com>
---
 drivers/net/wireless/ath/wil6210/wmi.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/net/wireless/ath/wil6210/wmi.c b/drivers/net/wireless/ath/wil6210/wmi.c
index 153b84447e40..41389c1eb252 100644
--- a/drivers/net/wireless/ath/wil6210/wmi.c
+++ b/drivers/net/wireless/ath/wil6210/wmi.c
@@ -2505,7 +2505,8 @@ int wmi_set_ie(struct wil6210_vif *vif, u8 type, u16 ie_len, const void *ie)
 	cmd->mgmt_frm_type = type;
 	/* BUG: FW API define ieLen as u8. Will fix FW */
 	cmd->ie_len = cpu_to_le16(ie_len);
-	memcpy(cmd->ie_info, ie, ie_len);
+	if (ie_len)
+		memcpy(cmd->ie_info, ie, ie_len);
 	rc = wmi_send(wil, WMI_SET_APPIE_CMDID, vif->mid, cmd, len);
 	kfree(cmd);
 out:
@@ -2541,7 +2542,8 @@ int wmi_update_ft_ies(struct wil6210_vif *vif, u16 ie_len, const void *ie)
 	}
 
 	cmd->ie_len = cpu_to_le16(ie_len);
-	memcpy(cmd->ie_info, ie, ie_len);
+	if (ie_len)
+		memcpy(cmd->ie_info, ie, ie_len);
 	rc = wmi_send(wil, WMI_UPDATE_FT_IES_CMDID, vif->mid, cmd, len);
 	kfree(cmd);
 
-- 
2.21.0


^ permalink raw reply	[flat|nested] 2+ messages in thread

* Re: [PATCH] wil6210: check len before memcpy() calls
  2019-10-01 12:08 [PATCH] wil6210: check len before memcpy() calls Denis Efremov
@ 2019-10-02 17:23 ` Kalle Valo
  0 siblings, 0 replies; 2+ messages in thread
From: Kalle Valo @ 2019-10-02 17:23 UTC (permalink / raw)
  To: Denis Efremov
  Cc: linux-wireless, Denis Efremov, netdev, linux-kernel, wil6210,
	Maya Erez, David S. Miller, stable

Denis Efremov <efremov@linux.com> wrote:

> memcpy() in wmi_set_ie() and wmi_update_ft_ies() is called with
> src == NULL and len == 0. This is an undefined behavior. Fix it
> by checking "ie_len > 0" before the memcpy() calls.
> 
> As suggested by GCC documentation:
> "The pointers passed to memmove (and similar functions in <string.h>)
> must be non-null even when nbytes==0, so GCC can use that information
> to remove the check after the memmove call." [1]
> 
> [1] https://gcc.gnu.org/gcc-4.9/porting_to.html
> 
> Cc: Maya Erez <merez@codeaurora.org>
> Cc: Kalle Valo <kvalo@codeaurora.org>
> Cc: "David S. Miller" <davem@davemloft.net>
> Cc: stable@vger.kernel.org
> Signed-off-by: Denis Efremov <efremov@linux.com>
> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>

Patch applied to ath-next branch of ath.git, thanks.

2c840676be8f wil6210: check len before memcpy() calls

-- 
https://patchwork.kernel.org/patch/11168621/

https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches


^ permalink raw reply	[flat|nested] 2+ messages in thread

end of thread, other threads:[~2019-10-02 17:23 UTC | newest]

Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-10-01 12:08 [PATCH] wil6210: check len before memcpy() calls Denis Efremov
2019-10-02 17:23 ` Kalle Valo

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).