* [PATCH] ar5523: check NULL before memcpy() in ar5523_cmd()
@ 2019-09-30 14:02 Denis Efremov
2019-09-30 15:35 ` David Laight
2019-09-30 20:31 ` [PATCH v2] " Denis Efremov
0 siblings, 2 replies; 4+ messages in thread
From: Denis Efremov @ 2019-09-30 14:02 UTC (permalink / raw)
To: linux-wireless, netdev, linux-kernel
Cc: Denis Efremov, Pontus Fuchs, Kalle Valo, David S. Miller, stable
memcpy() call with "idata == NULL && ilen == 0" results in undefined
behavior in ar5523_cmd(). For example, NULL is passed in callchain
"ar5523_stat_work() -> ar5523_cmd_write() -> ar5523_cmd()". This patch
adds idata check before memcpy() call in ar5523_cmd() to prevent an
undefined behavior.
Cc: Pontus Fuchs <pontus.fuchs@gmail.com>
Cc: Kalle Valo <kvalo@codeaurora.org>
Cc: "David S. Miller" <davem@davemloft.net>
Cc: stable@vger.kernel.org
Signed-off-by: Denis Efremov <efremov@linux.com>
---
drivers/net/wireless/ath/ar5523/ar5523.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/net/wireless/ath/ar5523/ar5523.c b/drivers/net/wireless/ath/ar5523/ar5523.c
index b94759daeacc..f25af5bc5282 100644
--- a/drivers/net/wireless/ath/ar5523/ar5523.c
+++ b/drivers/net/wireless/ath/ar5523/ar5523.c
@@ -255,7 +255,8 @@ static int ar5523_cmd(struct ar5523 *ar, u32 code, const void *idata,
if (flags & AR5523_CMD_FLAG_MAGIC)
hdr->magic = cpu_to_be32(1 << 24);
- memcpy(hdr + 1, idata, ilen);
+ if (idata)
+ memcpy(hdr + 1, idata, ilen);
cmd->odata = odata;
cmd->olen = olen;
--
2.21.0
^ permalink raw reply related [flat|nested] 4+ messages in thread
* RE: [PATCH] ar5523: check NULL before memcpy() in ar5523_cmd()
2019-09-30 14:02 [PATCH] ar5523: check NULL before memcpy() in ar5523_cmd() Denis Efremov
@ 2019-09-30 15:35 ` David Laight
2019-09-30 20:31 ` [PATCH v2] " Denis Efremov
1 sibling, 0 replies; 4+ messages in thread
From: David Laight @ 2019-09-30 15:35 UTC (permalink / raw)
To: 'Denis Efremov', linux-wireless, netdev, linux-kernel
Cc: Pontus Fuchs, Kalle Valo, David S. Miller, stable
From: Denis Efremov
> Sent: 30 September 2019 15:02
>
> memcpy() call with "idata == NULL && ilen == 0" results in undefined
> behavior in ar5523_cmd(). For example, NULL is passed in callchain
> "ar5523_stat_work() -> ar5523_cmd_write() -> ar5523_cmd()". This patch
> adds idata check before memcpy() call in ar5523_cmd() to prevent an
> undefined behavior.
>
...
> Signed-off-by: Denis Efremov <efremov@linux.com>
> ---
> drivers/net/wireless/ath/ar5523/ar5523.c | 3 ++-
> 1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/net/wireless/ath/ar5523/ar5523.c b/drivers/net/wireless/ath/ar5523/ar5523.c
> index b94759daeacc..f25af5bc5282 100644
> --- a/drivers/net/wireless/ath/ar5523/ar5523.c
> +++ b/drivers/net/wireless/ath/ar5523/ar5523.c
> @@ -255,7 +255,8 @@ static int ar5523_cmd(struct ar5523 *ar, u32 code, const void *idata,
>
> if (flags & AR5523_CMD_FLAG_MAGIC)
> hdr->magic = cpu_to_be32(1 << 24);
> - memcpy(hdr + 1, idata, ilen);
> + if (idata)
> + memcpy(hdr + 1, idata, ilen);
That would be better as if (ilen) ...
David
-
Registered Address Lakeside, Bramley Road, Mount Farm, Milton Keynes, MK1 1PT, UK
Registration No: 1397386 (Wales)
^ permalink raw reply [flat|nested] 4+ messages in thread
* [PATCH v2] ar5523: check NULL before memcpy() in ar5523_cmd()
2019-09-30 14:02 [PATCH] ar5523: check NULL before memcpy() in ar5523_cmd() Denis Efremov
2019-09-30 15:35 ` David Laight
@ 2019-09-30 20:31 ` Denis Efremov
2019-10-02 17:22 ` Kalle Valo
1 sibling, 1 reply; 4+ messages in thread
From: Denis Efremov @ 2019-09-30 20:31 UTC (permalink / raw)
To: linux-wireless, netdev, linux-kernel
Cc: Denis Efremov, Pontus Fuchs, Kalle Valo, David S. Miller,
David Laight, stable
memcpy() call with "idata == NULL && ilen == 0" results in undefined
behavior in ar5523_cmd(). For example, NULL is passed in callchain
"ar5523_stat_work() -> ar5523_cmd_write() -> ar5523_cmd()". This patch
adds ilen check before memcpy() call in ar5523_cmd() to prevent an
undefined behavior.
Cc: Pontus Fuchs <pontus.fuchs@gmail.com>
Cc: Kalle Valo <kvalo@codeaurora.org>
Cc: "David S. Miller" <davem@davemloft.net>
Cc: David Laight <David.Laight@ACULAB.COM>
Cc: stable@vger.kernel.org
Signed-off-by: Denis Efremov <efremov@linux.com>
---
V2: check ilen instead of idata as suggested by David Laight.
drivers/net/wireless/ath/ar5523/ar5523.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/net/wireless/ath/ar5523/ar5523.c b/drivers/net/wireless/ath/ar5523/ar5523.c
index b94759daeacc..da2d179430ca 100644
--- a/drivers/net/wireless/ath/ar5523/ar5523.c
+++ b/drivers/net/wireless/ath/ar5523/ar5523.c
@@ -255,7 +255,8 @@ static int ar5523_cmd(struct ar5523 *ar, u32 code, const void *idata,
if (flags & AR5523_CMD_FLAG_MAGIC)
hdr->magic = cpu_to_be32(1 << 24);
- memcpy(hdr + 1, idata, ilen);
+ if (ilen)
+ memcpy(hdr + 1, idata, ilen);
cmd->odata = odata;
cmd->olen = olen;
--
2.21.0
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [PATCH v2] ar5523: check NULL before memcpy() in ar5523_cmd()
2019-09-30 20:31 ` [PATCH v2] " Denis Efremov
@ 2019-10-02 17:22 ` Kalle Valo
0 siblings, 0 replies; 4+ messages in thread
From: Kalle Valo @ 2019-10-02 17:22 UTC (permalink / raw)
To: Denis Efremov
Cc: linux-wireless, netdev, linux-kernel, Denis Efremov,
Pontus Fuchs, David S. Miller, David Laight, stable
Denis Efremov <efremov@linux.com> wrote:
> memcpy() call with "idata == NULL && ilen == 0" results in undefined
> behavior in ar5523_cmd(). For example, NULL is passed in callchain
> "ar5523_stat_work() -> ar5523_cmd_write() -> ar5523_cmd()". This patch
> adds ilen check before memcpy() call in ar5523_cmd() to prevent an
> undefined behavior.
>
> Cc: Pontus Fuchs <pontus.fuchs@gmail.com>
> Cc: Kalle Valo <kvalo@codeaurora.org>
> Cc: "David S. Miller" <davem@davemloft.net>
> Cc: David Laight <David.Laight@ACULAB.COM>
> Cc: stable@vger.kernel.org
> Signed-off-by: Denis Efremov <efremov@linux.com>
> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Patch applied to ath-next branch of ath.git, thanks.
315cee426f87 ar5523: check NULL before memcpy() in ar5523_cmd()
--
https://patchwork.kernel.org/patch/11167401/
https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2019-10-02 17:22 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-09-30 14:02 [PATCH] ar5523: check NULL before memcpy() in ar5523_cmd() Denis Efremov
2019-09-30 15:35 ` David Laight
2019-09-30 20:31 ` [PATCH v2] " Denis Efremov
2019-10-02 17:22 ` Kalle Valo
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).