From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1761447AbdAKVeH (ORCPT ); Wed, 11 Jan 2017 16:34:07 -0500 Received: from mail-oi0-f68.google.com ([209.85.218.68]:35253 "EHLO mail-oi0-f68.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1756680AbdAKVeA (ORCPT ); Wed, 11 Jan 2017 16:34:00 -0500 Subject: Re: [PATCH] staging: rtl: fix possible NULL pointer dereference To: Arnd Bergmann , Greg Kroah-Hartman References: <20170111145342.759808-1-arnd@arndb.de> Cc: stable@vger.kernel.org, Florian Schilhabel , Ivan Safonov , devel@driverdev.osuosl.org, linux-kernel@vger.kernel.org From: Larry Finger Message-ID: Date: Wed, 11 Jan 2017 15:33:18 -0600 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Thunderbird/45.6.0 MIME-Version: 1.0 In-Reply-To: <20170111145342.759808-1-arnd@arndb.de> Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 01/11/2017 08:53 AM, Arnd Bergmann wrote: > gcc-7 detects that wlanhdr_to_ethhdr() in two drivers calls memcpy() with > a destination argument that an earlier function call may have set to NULL: > > staging/rtl8188eu/core/rtw_recv.c: In function 'wlanhdr_to_ethhdr': > staging/rtl8188eu/core/rtw_recv.c:1318:2: warning: argument 1 null where non-null expected [-Wnonnull] > staging/rtl8712/rtl871x_recv.c: In function 'r8712_wlanhdr_to_ethhdr': > staging/rtl8712/rtl871x_recv.c:649:2: warning: argument 1 null where non-null expected [-Wnonnull] > > I'm fixing this by adding a NULL pointer check and returning failure > from the function, which is hopefully already handled properly. > > This seems to date back to when the drivers were originally added, > so backporting the fix to stable seems appropriate. There are other > related realtek drivers in the kernel, but none of them contain a > function with a similar name or produce this warning. Aced-by: Larry Finger Arnd, Please let me now if gcc-7 shows any warnings for the code in drivers/net/wireless/realtek/rtlwifi/. My distro supplies gcc-4.8, and it wouod be a lot of work to implement gcc-7. Larry > > Cc: stable@vger.kernel.org > Fixes: 1cc18a22b96b ("staging: r8188eu: Add files for new driver - part 5") > Fixes: 2865d42c78a9 ("staging: r8712u: Add the new driver to the mainline kernel") > Signed-off-by: Arnd Bergmann > --- > drivers/staging/rtl8188eu/core/rtw_recv.c | 2 ++ > drivers/staging/rtl8712/rtl871x_recv.c | 7 ++++++- > 2 files changed, 8 insertions(+), 1 deletion(-) > > diff --git a/drivers/staging/rtl8188eu/core/rtw_recv.c b/drivers/staging/rtl8188eu/core/rtw_recv.c > index 1bc7b97bf2ad..f2021fed704c 100644 > --- a/drivers/staging/rtl8188eu/core/rtw_recv.c > +++ b/drivers/staging/rtl8188eu/core/rtw_recv.c > @@ -1313,6 +1313,8 @@ static int wlanhdr_to_ethhdr(struct recv_frame *precvframe) > pattrib->eth_type = eth_type; > > ptr = recvframe_pull(precvframe, (rmv_len-sizeof(struct ethhdr) + (bsnaphdr ? 2 : 0))); > + if (!ptr) > + return _FAIL; > > memcpy(ptr, pattrib->dst, ETH_ALEN); > memcpy(ptr+ETH_ALEN, pattrib->src, ETH_ALEN); > diff --git a/drivers/staging/rtl8712/rtl871x_recv.c b/drivers/staging/rtl8712/rtl871x_recv.c > index 4388ddf02b2c..147b75beea73 100644 > --- a/drivers/staging/rtl8712/rtl871x_recv.c > +++ b/drivers/staging/rtl8712/rtl871x_recv.c > @@ -640,11 +640,16 @@ sint r8712_wlanhdr_to_ethhdr(union recv_frame *precvframe) > /* append rx status for mp test packets */ > ptr = recvframe_pull(precvframe, (rmv_len - > sizeof(struct ethhdr) + 2) - 24); > + if (!ptr) > + return _FAIL; > memcpy(ptr, get_rxmem(precvframe), 24); > ptr += 24; > - } else > + } else { > ptr = recvframe_pull(precvframe, (rmv_len - > sizeof(struct ethhdr) + (bsnaphdr ? 2 : 0))); > + if (!ptr) > + return _FAIL; > + } > > memcpy(ptr, pattrib->dst, ETH_ALEN); > memcpy(ptr + ETH_ALEN, pattrib->src, ETH_ALEN); >