linux-kernel - Re: [PATCH][next] rtw89: Fix potential dereference of the null pointer sta

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <87y26mepbm.fsf@codeaurora.org>
Date:   Thu, 21 Oct 2021 11:48:13 +0300
From:   Kalle Valo <kvalo@...eaurora.org>
To:     Pkshih <pkshih@...ltek.com>
Cc:     Colin King <colin.king@...onical.com>,
        "David S . Miller" <davem@...emloft.net>,
        Jakub Kicinski <kuba@...nel.org>,
        "linux-wireless\@vger.kernel.org" <linux-wireless@...r.kernel.org>,
        "netdev\@vger.kernel.org" <netdev@...r.kernel.org>,
        "kernel-janitors\@vger.kernel.org" <kernel-janitors@...r.kernel.org>,
        "linux-kernel\@vger.kernel.org" <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH][next] rtw89: Fix potential dereference of the null pointer sta

Pkshih <pkshih@...ltek.com> writes:

>> >> > I check the size of object files before/after this patch, and
>> >> > the original one is smaller.
>> >> >
>> >> >    text    data     bss     dec     hex filename
>> >> >   16781    3392       1   20174    4ece core-0.o  // original
>> >> >   16819    3392       1   20212    4ef4 core-1.o  // after this patch
>> >> >
>> >> > Do you think it is worth to apply this patch?
>> >>
>> >> I think that we should apply the patch. Even though the compiler _may_
>> >> reorder the code, it might choose not to do that.
>> >
>> > Understand.
>> >
>> > I have another way to fix this coverity warning, like:
>> >
>> > @@ -1617,7 +1617,7 @@ static bool rtw89_core_txq_agg_wait(struct rtw89_dev *rtwdev,
>> >  {
>> >         struct rtw89_txq *rtwtxq = (struct rtw89_txq *)txq->drv_priv;
>> >         struct ieee80211_sta *sta = txq->sta;
>> > -       struct rtw89_sta *rtwsta = (struct rtw89_sta *)sta->drv_priv;
>> > +       struct rtw89_sta *rtwsta = sta ? (struct rtw89_sta *)sta->drv_priv : NULL;
>> >
>> >         if (!sta || rtwsta->max_agg_wait <= 0)
>> >                 return false;
>> >
>> > Is this acceptable?
>> > It has a little redundant checking of 'sta', but the code looks clean.
>> 
>> I feel that Colin's fix is more readable, but this is just matter of
>> taste. You can choose.
>
> I would like my version. 
>
> There are three similar warnings reported by smatch, so I will fix them by
> myself. Please drop this patch.

Ok, dropped.

> But, still thank Colin to point out this issue.

Indeed, thanks Colin. A good way to thank is to add Reported-by to the
commit log.

-- 
https://patchwork.kernel.org/project/linux-wireless/list/

https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches