lkml.org 
[lkml]   [2017]   [Jan]   [11]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
SubjectRe: [PATCH] staging: rtl: fix possible NULL pointer dereference
From
Date
On 01/11/2017 08:53 AM, Arnd Bergmann wrote:
> gcc-7 detects that wlanhdr_to_ethhdr() in two drivers calls memcpy() with
> a destination argument that an earlier function call may have set to NULL:
>
> staging/rtl8188eu/core/rtw_recv.c: In function 'wlanhdr_to_ethhdr':
> staging/rtl8188eu/core/rtw_recv.c:1318:2: warning: argument 1 null where non-null expected [-Wnonnull]
> staging/rtl8712/rtl871x_recv.c: In function 'r8712_wlanhdr_to_ethhdr':
> staging/rtl8712/rtl871x_recv.c:649:2: warning: argument 1 null where non-null expected [-Wnonnull]
>
> I'm fixing this by adding a NULL pointer check and returning failure
> from the function, which is hopefully already handled properly.
>
> This seems to date back to when the drivers were originally added,
> so backporting the fix to stable seems appropriate. There are other
> related realtek drivers in the kernel, but none of them contain a
> function with a similar name or produce this warning.

Aced-by: Larry Finger <Larry.Finger@lwfinger.net>

Arnd,

Please let me now if gcc-7 shows any warnings for the code in
drivers/net/wireless/realtek/rtlwifi/. My distro supplies gcc-4.8, and it wouod
be a lot of work to implement gcc-7.

Larry

>
> Cc: stable@vger.kernel.org
> Fixes: 1cc18a22b96b ("staging: r8188eu: Add files for new driver - part 5")
> Fixes: 2865d42c78a9 ("staging: r8712u: Add the new driver to the mainline kernel")
> Signed-off-by: Arnd Bergmann <arnd@arndb.de>
> ---
> drivers/staging/rtl8188eu/core/rtw_recv.c | 2 ++
> drivers/staging/rtl8712/rtl871x_recv.c | 7 ++++++-
> 2 files changed, 8 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/staging/rtl8188eu/core/rtw_recv.c b/drivers/staging/rtl8188eu/core/rtw_recv.c
> index 1bc7b97bf2ad..f2021fed704c 100644
> --- a/drivers/staging/rtl8188eu/core/rtw_recv.c
> +++ b/drivers/staging/rtl8188eu/core/rtw_recv.c
> @@ -1313,6 +1313,8 @@ static int wlanhdr_to_ethhdr(struct recv_frame *precvframe)
> pattrib->eth_type = eth_type;
>
> ptr = recvframe_pull(precvframe, (rmv_len-sizeof(struct ethhdr) + (bsnaphdr ? 2 : 0)));
> + if (!ptr)
> + return _FAIL;
>
> memcpy(ptr, pattrib->dst, ETH_ALEN);
> memcpy(ptr+ETH_ALEN, pattrib->src, ETH_ALEN);
> diff --git a/drivers/staging/rtl8712/rtl871x_recv.c b/drivers/staging/rtl8712/rtl871x_recv.c
> index 4388ddf02b2c..147b75beea73 100644
> --- a/drivers/staging/rtl8712/rtl871x_recv.c
> +++ b/drivers/staging/rtl8712/rtl871x_recv.c
> @@ -640,11 +640,16 @@ sint r8712_wlanhdr_to_ethhdr(union recv_frame *precvframe)
> /* append rx status for mp test packets */
> ptr = recvframe_pull(precvframe, (rmv_len -
> sizeof(struct ethhdr) + 2) - 24);
> + if (!ptr)
> + return _FAIL;
> memcpy(ptr, get_rxmem(precvframe), 24);
> ptr += 24;
> - } else
> + } else {
> ptr = recvframe_pull(precvframe, (rmv_len -
> sizeof(struct ethhdr) + (bsnaphdr ? 2 : 0)));
> + if (!ptr)
> + return _FAIL;
> + }
>
> memcpy(ptr, pattrib->dst, ETH_ALEN);
> memcpy(ptr + ETH_ALEN, pattrib->src, ETH_ALEN);
>

\
 
 \ /
  Last update: 2017-01-11 22:34    [W:0.046 / U:8.824 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site