linux-kernel - Re: [PATCH] staging: r8188eu: simplify unnecessary NULL check

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20220311111120.GJ3293@kadam>
Date:   Fri, 11 Mar 2022 14:11:20 +0300
From:   Dan Carpenter <dan.carpenter@...cle.com>
To:     Haowen Bai <baihaowen@...zu.com>
Cc:     Larry.Finger@...inger.net, phil@...lpotter.co.uk,
        gregkh@...uxfoundation.org, linux-staging@...ts.linux.dev,
        linux-kernel@...r.kernel.org
Subject: Re: [PATCH] staging: r8188eu: simplify unnecessary NULL check

On Fri, Mar 11, 2022 at 06:33:21PM +0800, Haowen Bai wrote:
> remove the optimisation of NULL checking it inline, kfree/rtw_free_netdev
> will take care if that would ever be the case.
> 
> Signed-off-by: Haowen Bai <baihaowen@...zu.com>
> ---
>  drivers/staging/r8188eu/os_dep/usb_intf.c | 6 ++----
>  1 file changed, 2 insertions(+), 4 deletions(-)
> 
> diff --git a/drivers/staging/r8188eu/os_dep/usb_intf.c b/drivers/staging/r8188eu/os_dep/usb_intf.c
> index 91792df..8d1ac48 100644
> --- a/drivers/staging/r8188eu/os_dep/usb_intf.c
> +++ b/drivers/staging/r8188eu/os_dep/usb_intf.c
> @@ -425,10 +425,8 @@ static struct adapter *rtw_usb_if1_init(struct dvobj_priv *dvobj,
>  		rtw_handle_dualmac(padapter, 0);
>  free_adapter:
>  	if (status != _SUCCESS) {
> -		if (pnetdev)
> -			rtw_free_netdev(pnetdev);
> -		else if (padapter)
> -			vfree(padapter);
> +		rtw_free_netdev(pnetdev);
> +		vfree(padapter);

The rtw_free_netdev() frees padapter so this patch would introduce a
double free.

This driver is kind of garbage so I don't really fault you for making
this mistake.  If the error handling and cleanup were written in the
correct way it would avoid accidentally creating bugs like this:

https://lore.kernel.org/all/20210831084735.GL12231@kadam/

The correct thing is to not call rtw_free_netdev() from rtw_usb_if1_init()
but to instead call:

free_netdev:
	free_netdev(pnetdev);
handle_dualmac:
	rtw_handle_dualmac(padapter, 0);
free_padapter:
	vfree(padapter);

Also you need to work against the latest linux-next or staging-next
tree.

regards,
dan carpenter