lkml.org 
[lkml]   [2021]   [Apr]   [27]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: [PATCH 082/190] Revert "rsi: Fix NULL pointer dereference in kmalloc"
    On Wed, Apr 21, 2021 at 02:59:17PM +0200, Greg Kroah-Hartman wrote:
    > This reverts commit d5414c2355b20ea8201156d2e874265f1cb0d775.
    >
    > Commits from @umn.edu addresses have been found to be submitted in "bad
    > faith" to try to test the kernel community's ability to review "known
    > malicious" changes. The result of these submissions can be found in a
    > paper published at the 42nd IEEE Symposium on Security and Privacy
    > entitled, "Open Source Insecurity: Stealthily Introducing
    > Vulnerabilities via Hypocrite Commits" written by Qiushi Wu (University
    > of Minnesota) and Kangjie Lu (University of Minnesota).
    >
    > Because of this, all submissions from this group must be reverted from
    > the kernel tree and will need to be re-reviewed again to determine if
    > they actually are a valid fix. Until that work is complete, remove this
    > change to ensure that no problems are being introduced into the
    > codebase.
    >
    > Cc: Aditya Pakki <pakki001@umn.edu>
    > Cc: Kalle Valo <kvalo@codeaurora.org>
    > Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    > ---
    > drivers/net/wireless/rsi/rsi_91x_mac80211.c | 30 +++++++++------------
    > 1 file changed, 12 insertions(+), 18 deletions(-)
    >
    > diff --git a/drivers/net/wireless/rsi/rsi_91x_mac80211.c b/drivers/net/wireless/rsi/rsi_91x_mac80211.c
    > index 16025300cddb..714d4d53236c 100644
    > --- a/drivers/net/wireless/rsi/rsi_91x_mac80211.c
    > +++ b/drivers/net/wireless/rsi/rsi_91x_mac80211.c
    > @@ -188,27 +188,27 @@ bool rsi_is_cipher_wep(struct rsi_common *common)
    > * @adapter: Pointer to the adapter structure.
    > * @band: Operating band to be set.
    > *
    > - * Return: int - 0 on success, negative error on failure.
    > + * Return: None.
    > */
    > -static int rsi_register_rates_channels(struct rsi_hw *adapter, int band)
    > +static void rsi_register_rates_channels(struct rsi_hw *adapter, int band)
    > {
    > struct ieee80211_supported_band *sbands = &adapter->sbands[band];
    > void *channels = NULL;
    >
    > if (band == NL80211_BAND_2GHZ) {
    > - channels = kmemdup(rsi_2ghz_channels, sizeof(rsi_2ghz_channels),
    > - GFP_KERNEL);
    > - if (!channels)
    > - return -ENOMEM;
    > + channels = kmalloc(sizeof(rsi_2ghz_channels), GFP_KERNEL);
    > + memcpy(channels,
    > + rsi_2ghz_channels,
    > + sizeof(rsi_2ghz_channels));
    > sbands->band = NL80211_BAND_2GHZ;
    > sbands->n_channels = ARRAY_SIZE(rsi_2ghz_channels);
    > sbands->bitrates = rsi_rates;
    > sbands->n_bitrates = ARRAY_SIZE(rsi_rates);
    > } else {
    > - channels = kmemdup(rsi_5ghz_channels, sizeof(rsi_5ghz_channels),
    > - GFP_KERNEL);
    > - if (!channels)
    > - return -ENOMEM;
    > + channels = kmalloc(sizeof(rsi_5ghz_channels), GFP_KERNEL);
    > + memcpy(channels,
    > + rsi_5ghz_channels,
    > + sizeof(rsi_5ghz_channels));
    > sbands->band = NL80211_BAND_5GHZ;
    > sbands->n_channels = ARRAY_SIZE(rsi_5ghz_channels);
    > sbands->bitrates = &rsi_rates[4];
    > @@ -227,7 +227,6 @@ static int rsi_register_rates_channels(struct rsi_hw *adapter, int band)
    > sbands->ht_cap.mcs.rx_mask[0] = 0xff;
    > sbands->ht_cap.mcs.tx_params = IEEE80211_HT_MCS_TX_DEFINED;
    > /* sbands->ht_cap.mcs.rx_highest = 0x82; */
    > - return 0;
    > }
    >
    > static int rsi_mac80211_hw_scan_start(struct ieee80211_hw *hw,
    > @@ -2067,16 +2066,11 @@ int rsi_mac80211_attach(struct rsi_common *common)
    > wiphy->available_antennas_rx = 1;
    > wiphy->available_antennas_tx = 1;
    >
    > - status = rsi_register_rates_channels(adapter, NL80211_BAND_2GHZ);
    > - if (status)
    > - return status;
    > + rsi_register_rates_channels(adapter, NL80211_BAND_2GHZ);
    > wiphy->bands[NL80211_BAND_2GHZ] =
    > &adapter->sbands[NL80211_BAND_2GHZ];
    > if (common->num_supp_bands > 1) {
    > - status = rsi_register_rates_channels(adapter,
    > - NL80211_BAND_5GHZ);
    > - if (status)
    > - return status;
    > + rsi_register_rates_channels(adapter, NL80211_BAND_5GHZ);
    > wiphy->bands[NL80211_BAND_5GHZ] =
    > &adapter->sbands[NL80211_BAND_5GHZ];
    > }
    > --
    > 2.31.1
    >

    This looks correct, will drop the revert.

    greg k-h

    \
     
     \ /
      Last update: 2021-04-27 18:37    [W:3.302 / U:0.368 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site