From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1030243AbdAKOyA (ORCPT ); Wed, 11 Jan 2017 09:54:00 -0500 Received: from mout.kundenserver.de ([217.72.192.75]:54143 "EHLO mout.kundenserver.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752194AbdAKOx6 (ORCPT ); Wed, 11 Jan 2017 09:53:58 -0500 From: Arnd Bergmann To: Greg Kroah-Hartman Cc: Arnd Bergmann , stable@vger.kernel.org, Larry Finger , Florian Schilhabel , Ivan Safonov , devel@driverdev.osuosl.org, linux-kernel@vger.kernel.org Subject: [PATCH] staging: rtl: fix possible NULL pointer dereference Date: Wed, 11 Jan 2017 15:53:08 +0100 Message-Id: <20170111145342.759808-1-arnd@arndb.de> X-Mailer: git-send-email 2.9.0 X-Provags-ID: V03:K0:jiWlFxQJB+7m1B4rtATjrqulZ7kA5r0zt5HsB+VcHqLiTbhstjn 4IeuXIgeB7Na6lDv+ipKg34CIIDy04+p/bXQPrGhf83P76CMuhczUSmvHQClTXmp6wThSzk 4NHPdG/W3yV31fdsXF38HXD93F+Kgmn4z1UcavhTcYPd0XTKhUkHEE1aeD5qmZbfxR8HEaM MyvNtQ2JkhmN81ipuDKlw== X-UI-Out-Filterresults: notjunk:1;V01:K0:XWcFmnFShSM=:y/f/Cwga6CyOaPXATxR15n dCNtfnJQp6Wg882b1Ou74yn+EK2Z7hQxNPGEQUMSzOJXwNYzhN4PJMeLAg9JEr6brUnwxo2kq Oshm8Lq1eNRc9WSakRWCaKt8KHDCCUD5z1zUJjQM5DjTg49drP0TR8SP+Fjoyxg2wAtT7zy9S fcRd7mt9BuF6lbPMldiyR+1gMh4e9n1cLtHSYj079dbjsdcMPBPgN3LRL/Ue7m3IAlNe8gCHy fhIjaz+oVkZAGm8Y/xZv4BwpTQpWvzKEP8w3oPp1tLIlpz7tcygt6rp3gVKMwE/1urHEQ6/Ic zUM1H3SYMiuKLJ+iderQHFTMuyLsF6MQCMWeWmXBWirVn6CPve88qeQCaMG0APV7VtHtdeRJB C+IccRnmUgh3X8Zsh2Rmt03jcskomheIgSO5d/eM+2vdLcr5wMkYOWcbIZTCPV5Y8ocAd8Blo 6Rm2R3Rmy0t6oufSPNjvN1LAxPqVyry/GcU227CGcf+QMsnGoT/55T4EeMuYh2KMa3bQtHP4z vgZpFalSgdcU349j4mdpTZl2fts6IrR0neEeU4fVF4V1DU8lw4qjQPbXbx0CcgU7JLNaGyKnD Bmm27kopetD1PdkB+dHh55Gc8EWO1iQxFe0mN9uUxj/SD/SC9tXNtQVQMtHFYh1/+aqC4x1iU rx1ZATa/ScLALM3I9k52sEulBrdnKq2e1iR/sLIwAIVuxHpgzFVQjD5SJYZ+XAajG1aY= Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org gcc-7 detects that wlanhdr_to_ethhdr() in two drivers calls memcpy() with a destination argument that an earlier function call may have set to NULL: staging/rtl8188eu/core/rtw_recv.c: In function 'wlanhdr_to_ethhdr': staging/rtl8188eu/core/rtw_recv.c:1318:2: warning: argument 1 null where non-null expected [-Wnonnull] staging/rtl8712/rtl871x_recv.c: In function 'r8712_wlanhdr_to_ethhdr': staging/rtl8712/rtl871x_recv.c:649:2: warning: argument 1 null where non-null expected [-Wnonnull] I'm fixing this by adding a NULL pointer check and returning failure from the function, which is hopefully already handled properly. This seems to date back to when the drivers were originally added, so backporting the fix to stable seems appropriate. There are other related realtek drivers in the kernel, but none of them contain a function with a similar name or produce this warning. Cc: stable@vger.kernel.org Fixes: 1cc18a22b96b ("staging: r8188eu: Add files for new driver - part 5") Fixes: 2865d42c78a9 ("staging: r8712u: Add the new driver to the mainline kernel") Signed-off-by: Arnd Bergmann --- drivers/staging/rtl8188eu/core/rtw_recv.c | 2 ++ drivers/staging/rtl8712/rtl871x_recv.c | 7 ++++++- 2 files changed, 8 insertions(+), 1 deletion(-) diff --git a/drivers/staging/rtl8188eu/core/rtw_recv.c b/drivers/staging/rtl8188eu/core/rtw_recv.c index 1bc7b97bf2ad..f2021fed704c 100644 --- a/drivers/staging/rtl8188eu/core/rtw_recv.c +++ b/drivers/staging/rtl8188eu/core/rtw_recv.c @@ -1313,6 +1313,8 @@ static int wlanhdr_to_ethhdr(struct recv_frame *precvframe) pattrib->eth_type = eth_type; ptr = recvframe_pull(precvframe, (rmv_len-sizeof(struct ethhdr) + (bsnaphdr ? 2 : 0))); + if (!ptr) + return _FAIL; memcpy(ptr, pattrib->dst, ETH_ALEN); memcpy(ptr+ETH_ALEN, pattrib->src, ETH_ALEN); diff --git a/drivers/staging/rtl8712/rtl871x_recv.c b/drivers/staging/rtl8712/rtl871x_recv.c index 4388ddf02b2c..147b75beea73 100644 --- a/drivers/staging/rtl8712/rtl871x_recv.c +++ b/drivers/staging/rtl8712/rtl871x_recv.c @@ -640,11 +640,16 @@ sint r8712_wlanhdr_to_ethhdr(union recv_frame *precvframe) /* append rx status for mp test packets */ ptr = recvframe_pull(precvframe, (rmv_len - sizeof(struct ethhdr) + 2) - 24); + if (!ptr) + return _FAIL; memcpy(ptr, get_rxmem(precvframe), 24); ptr += 24; - } else + } else { ptr = recvframe_pull(precvframe, (rmv_len - sizeof(struct ethhdr) + (bsnaphdr ? 2 : 0))); + if (!ptr) + return _FAIL; + } memcpy(ptr, pattrib->dst, ETH_ALEN); memcpy(ptr + ETH_ALEN, pattrib->src, ETH_ALEN); -- 2.9.0