linux-kernel - Re: [PATCH] staging: rtl8712: Fix pointer dereferenced before checking

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 30 May 2022 16:44:23 +0800
From:   baihaowen <baihaowen@...zu.com>
To:     Greg Kroah-Hartman <gregkh@...uxfoundation.org>
CC:     Larry Finger <Larry.Finger@...inger.net>,
        Florian Schilhabel <florian.c.schilhabel@...glemail.com>,
        <linux-staging@...ts.linux.dev>, <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH] staging: rtl8712: Fix pointer dereferenced before
 checking

在 2022/5/30 下午4:26, Greg Kroah-Hartman 写道:
> On Mon, May 30, 2022 at 04:22:11PM +0800, baihaowen wrote:
>> 在 2022/5/30 下午4:14, Greg Kroah-Hartman 写道:
>>> On Mon, May 30, 2022 at 04:05:32PM +0800, Haowen Bai wrote:
>>>> The padapter->recvpriv.signal_qual_data is dereferencing before null
>>>> checking, so move it after checking.
>>>>
>>>> Signed-off-by: Haowen Bai <baihaowen@...zu.com>
>>>> ---
>>>>  drivers/staging/rtl8712/rtl8712_recv.c | 4 +++-
>>>>  1 file changed, 3 insertions(+), 1 deletion(-)
>>>>
>>>> diff --git a/drivers/staging/rtl8712/rtl8712_recv.c b/drivers/staging/rtl8712/rtl8712_recv.c
>>>> index 7f1fdd058551..8ed94b259dbe 100644
>>>> --- a/drivers/staging/rtl8712/rtl8712_recv.c
>>>> +++ b/drivers/staging/rtl8712/rtl8712_recv.c
>>>> @@ -863,10 +863,12 @@ static void process_link_qual(struct _adapter *padapter,
>>>>  {
>>>>  	u32	last_evm = 0, tmpVal;
>>>>  	struct rx_pkt_attrib *pattrib;
>>>> -	struct smooth_rssi_data *sqd = &padapter->recvpriv.signal_qual_data;
>>>> +	struct smooth_rssi_data *sqd;
>>>>  
>>>>  	if (!prframe || !padapter)
>>>>  		return;
>>>> +
>>>> +	sqd = &padapter->recvpriv.signal_qual_data;
>>> How can padapter ever be NULL in this codepath?
>>>
>>> thanks,
>>>
>>> greg k-h
>> Just the original  code, show me
>>
>> if (!prframe || !padapter)
>>
>> It would be null, and then return.
> Again, trace things backwards, how can padapter ever be NULL?

padapter will not be null, since it's initialized by netdev_priv(pnetdev) and return if pnetdev is null. r871xu_drv_init() ...... pnetdev = r8712_init_netdev(); if (!pnetdev) goto error; padapter = netdev_priv(pnetdev); status = r8712_init_drv_sw(padapter); ......

-- 
Haowen Bai