[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <23609ad3-68bb-6df6-609d-5630597c7e0f@gmail.com>
Date: Mon, 23 Aug 2021 22:34:54 +0300
From: Pavel Skripkin <paskripkin@...il.com>
To: cgel.zte@...il.com, gregkh@...uxfoundation.org
Cc: linux-staging@...ts.linux.dev, linux-kernel@...r.kernel.org,
xu xin <xu.xin16@....com.cn>, Zeal Robot <zealci@....com.cn>
Subject: Re: [PATCH Linux-next] ioctl_linux: fix a potential NULL pointer
dereference bug
On 8/23/21 6:06 AM, cgel.zte@...il.com wrote:
> From: xu xin <xu.xin16@....com.cn>
>
> The pointer might be NULL, but it is dereferenced.
>
> Reported-by: Zeal Robot <zealci@....com.cn>
> Signed-off-by: xu xin <xu.xin16@....com.cn>
> ---
> drivers/staging/r8188eu/os_dep/ioctl_linux.c | 6 ++++--
> 1 file changed, 4 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/staging/r8188eu/os_dep/ioctl_linux.c b/drivers/staging/r8188eu/os_dep/ioctl_linux.c
> index a3e6d761e748..ce4ce9190f5f 100644
> --- a/drivers/staging/r8188eu/os_dep/ioctl_linux.c
> +++ b/drivers/staging/r8188eu/os_dep/ioctl_linux.c
> @@ -4389,7 +4389,8 @@ static int rtw_dbg_port(struct net_device *dev,
> pregpriv->rx_stbc = extra_arg;
> DBG_88E("set rx_stbc =%d\n", pregpriv->rx_stbc);
> } else {
> - DBG_88E("get rx_stbc =%d\n", pregpriv->rx_stbc);
> + if (pregpriv)
> + DBG_88E("get rx_stbc =%d\n", pregpriv->rx_stbc);
> }
> }
> break;
> @@ -4401,7 +4402,8 @@ static int rtw_dbg_port(struct net_device *dev,
> pregpriv->ampdu_enable = extra_arg;
> DBG_88E("set ampdu_enable =%d\n", pregpriv->ampdu_enable);
> } else {
> - DBG_88E("get ampdu_enable =%d\n", pregpriv->ampdu_enable);
> + if (pregpriv)
> + DBG_88E("get ampdu_enable =%d\n", pregpriv->ampdu_enable);
> }
> }
> break;
>
Hi, Xu!
I can't see how pregpriv can be NULL:
struct registry_priv *pregpriv = &padapter->registrypriv;
It can be NULL in case of completely wrong padapter pointer, but I can't
see how it's possible. Do you have a calltrace?
I guess, your robot reported this, because there is useless check in
same code block:
if (pregpriv &&
(extra_arg == 0 ||
extra_arg == 1 ||
extra_arg == 2 ||
extra_arg == 3))
So, I think, "pregpriv &&" part should be removed, instead of adding 2
branches.
Also, subject line should be "staging: r8118eu: <subject>". Thank you!
With regards,
Pavel Skripkin
Powered by blists - more mailing lists