lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-ID: <ZDBA7Ay1Y3Yr6Dg5@corigine.com> Date: Fri, 7 Apr 2023 18:12:28 +0200 From: Simon Horman <simon.horman@...igine.com> To: Jia-Ju Bai <baijiaju@...a.edu.cn> Cc: johannes@...solutions.net, davem@...emloft.net, edumazet@...gle.com, kuba@...nel.org, pabeni@...hat.com, linux-wireless@...r.kernel.org, netdev@...r.kernel.org, linux-kernel@...r.kernel.org Subject: Re: [PATCH v3] net: mac80211: Add NULL checks for sta->sdata On Tue, Apr 04, 2023 at 08:47:34PM +0800, Jia-Ju Bai wrote: > In a previous commit 69403bad97aa ("wifi: mac80211: sdata can be NULL > during AMPDU start"), sta->sdata can be NULL, and thus it should be > checked before being used. > > However, in the same call stack, sta->sdata is also used in the > following functions: > > ieee80211_ba_session_work() > ___ieee80211_stop_rx_ba_session(sta) > ht_dbg(sta->sdata, ...); -> No check > sdata_info(sta->sdata, ...); -> No check > ieee80211_send_delba(sta->sdata, ...) -> No check > ___ieee80211_start_rx_ba_session(sta) > ht_dbg(sta->sdata, ...); -> No check > ht_dbg_ratelimited(sta->sdata, ...); -> No check > ieee80211_tx_ba_session_handle_start(sta) > sdata = sta->sdata; if (!sdata) -> Add check by previous commit > ___ieee80211_stop_tx_ba_session(sdata) > ht_dbg(sta->sdata, ...); -> No check > ieee80211_start_tx_ba_cb(sdata) > sdata = sta->sdata; local = sdata->local -> No check > ieee80211_stop_tx_ba_cb(sdata) > ht_dbg(sta->sdata, ...); -> No check > > Thus, to avoid possible null-pointer dereferences, the related checks > should be added. > > These bugs are reported by a static analysis tool implemented by myself, > and they are found by extending a known bug fixed in the previous commit. > Thus, they could be theoretical bugs. > > Signed-off-by: Jia-Ju Bai <baijiaju@...a.edu.cn> Reviewed-by: Simon Horman <simon.horman@...igine.com>
Powered by blists - more mailing lists