netdev - Re: [PATCH 1/1] iwlwifi: rs: remove superfluous check

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:	Thu, 19 May 2016 08:27:13 +0000
From:	"Coelho, Luciano" <luciano.coelho@...el.com>
To:	"kvalo@...eaurora.org" <kvalo@...eaurora.org>,
	"xypron.glpk@....de" <xypron.glpk@....de>,
	"Berg, Johannes" <johannes.berg@...el.com>,
	"Grumbach, Emmanuel" <emmanuel.grumbach@...el.com>
CC:	linuxwifi <linuxwifi@...el.com>,
	"eyal@...ery.com" <eyal@...ery.com>,
	"netdev@...r.kernel.org" <netdev@...r.kernel.org>,
	"linux-wireless@...r.kernel.org" <linux-wireless@...r.kernel.org>,
	"Greenman, Gregory" <gregory.greenman@...el.com>,
	"Bondar, Alexander" <alexander.bondar@...el.com>,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH 1/1] iwlwifi: rs: remove superfluous check

On Wed, 2016-05-18 at 01:31 +0200, Heinrich Schuchardt wrote:
> If we dereference a variable anyway in other parts of the code,
> there is no need to check against NULL in a single place.

NACK.  This is not true.

If lq_sta is NULL, it means that mvm_sta is also NULL.  Then we call
the rate_control_send with mvm_sta == NULL:

	if (rate_control_send_low(sta, mvm_sta, txrc))
		return;

The rate_control_send_low() function looks like this:


bool rate_control_send_low(struct ieee80211_sta *pubsta,
			   void *priv_sta,
			   struct ieee80211_tx_rate_control *txrc)
{
[...]
	if (!pubsta || !priv_sta || rc_no_data_or_no_ack_use_min(txrc)) {
[...]
		return true;
	}
[...]
}


Which means that if priv_sta (aka mvm_sta) is NULL, we will return
without running the rest of rs_get_rate() where lq_sta is accessed
without checks.

I admit that the rs_get_rate() function is a bit hard to read, but
removing the lq_sta check as you did doesn't help, but makes things
worse.

--
Cheers,
Luca.