linux-kernel - [PATCH] staging: r8822be: check kzalloc return or bail

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 15 Feb 2019 10:24:22 +0100
From:   Nicholas Mc Guire <hofrat@...dl.org>
To:     Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Cc:     Nathan Chancellor <natechancellor@...il.com>,
        devel@...verdev.osuosl.org, linux-kernel@...r.kernel.org,
        Nicholas Mc Guire <hofrat@...dl.org>
Subject: [PATCH] staging: r8822be: check kzalloc return or bail

The kzalloc() in halmac_parse_psd_data_88xx() can fail and return NULL
so check the psd_set->data after allocation and if allocation failed
return HALMAC_CMD_PROCESS_ERROR.

Signed-off-by: Nicholas Mc Guire <hofrat@...dl.org>
Fixes: 938a0447f094 ("staging: r8822be: Add code for halmac sub-drive")
---

Problem was located with an experimental coccinelle script

Patch was compile tested with: x86_64_defconfig + STAGING=y,
R8822BE=m
(with a smatch error that looks like a false-positive

  CHECK   drivers/staging/rtlwifi/halmac/halmac_88xx/halmac_func_88xx.c
drivers/staging/rtlwifi/halmac/halmac_88xx/halmac_func_88xx.c:624 halmac_func_write_logical_efuse_88xx() error: uninitialized symbol 'pg_efuse_header2'.
  CC [M]  drivers/staging/rtlwifi/halmac/halmac_88xx/halmac_func_88xx.o

as the initialization of pg_efuse_header2 is under the same if condition (line 592) as the
use at line 624 it is initialized)

Patch is agaisnt 5.0-rc6 (localversion-next is next-20190215)

 drivers/staging/rtlwifi/halmac/halmac_88xx/halmac_func_88xx.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/staging/rtlwifi/halmac/halmac_88xx/halmac_func_88xx.c b/drivers/staging/rtlwifi/halmac/halmac_88xx/halmac_func_88xx.c
index 53f55f12..bf783a0 100644
--- a/drivers/staging/rtlwifi/halmac/halmac_88xx/halmac_func_88xx.c
+++ b/drivers/staging/rtlwifi/halmac/halmac_88xx/halmac_func_88xx.c
@@ -2466,8 +2466,11 @@ halmac_parse_psd_data_88xx(struct halmac_adapter *halmac_adapter, u8 *c2h_buf,
 	segment_size = (u8)PSD_DATA_GET_SEGMENT_SIZE(c2h_buf);
 	psd_set->data_size = total_size;
 
-	if (!psd_set->data)
+	if (!psd_set->data) {
 		psd_set->data = kzalloc(psd_set->data_size, GFP_KERNEL);
+		if (!psd_set->data)
+			return HALMAC_CMD_PROCESS_ERROR;
+	}
 
 	if (segment_id == 0)
 		psd_set->segment_size = segment_size;
-- 
2.1.4