lkml.org 
[lkml]   [2023]   [Apr]   [7]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: [PATCH v3] net: mac80211: Add NULL checks for sta->sdata
    On Tue, Apr 04, 2023 at 08:47:34PM +0800, Jia-Ju Bai wrote:
    > In a previous commit 69403bad97aa ("wifi: mac80211: sdata can be NULL
    > during AMPDU start"), sta->sdata can be NULL, and thus it should be
    > checked before being used.
    >
    > However, in the same call stack, sta->sdata is also used in the
    > following functions:
    >
    > ieee80211_ba_session_work()
    > ___ieee80211_stop_rx_ba_session(sta)
    > ht_dbg(sta->sdata, ...); -> No check
    > sdata_info(sta->sdata, ...); -> No check
    > ieee80211_send_delba(sta->sdata, ...) -> No check
    > ___ieee80211_start_rx_ba_session(sta)
    > ht_dbg(sta->sdata, ...); -> No check
    > ht_dbg_ratelimited(sta->sdata, ...); -> No check
    > ieee80211_tx_ba_session_handle_start(sta)
    > sdata = sta->sdata; if (!sdata) -> Add check by previous commit
    > ___ieee80211_stop_tx_ba_session(sdata)
    > ht_dbg(sta->sdata, ...); -> No check
    > ieee80211_start_tx_ba_cb(sdata)
    > sdata = sta->sdata; local = sdata->local -> No check
    > ieee80211_stop_tx_ba_cb(sdata)
    > ht_dbg(sta->sdata, ...); -> No check
    >
    > Thus, to avoid possible null-pointer dereferences, the related checks
    > should be added.
    >
    > These bugs are reported by a static analysis tool implemented by myself,
    > and they are found by extending a known bug fixed in the previous commit.
    > Thus, they could be theoretical bugs.
    >
    > Signed-off-by: Jia-Ju Bai <baijiaju@buaa.edu.cn>

    Reviewed-by: Simon Horman <simon.horman@corigine.com>

    \
     
     \ /
      Last update: 2023-04-07 18:14    [W:2.860 / U:0.024 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site