2021-12-25 17:04:46

by Jiapeng Chong

Subject: [PATCH v4] staging: r8188eu: Use strndup_user instead of kmalloc/copy_from_user

This code assumes that the user is going to give us a NUL terminated
string which is not necessarily true.

Fix following coccicheck warning:

./drivers/staging/r8188eu/os_dep/ioctl_linux.c:4253:8-15: WARNING
opportunity for memdup_user.

Reported-by: Abaci Robot <[email protected]>
Fixes: 2b42bd58b321 ("staging: r8188eu: introduce new os_dep dir for RTL8188eu driver")
Signed-off-by: Jiapeng Chong <[email protected]>
---
Changes in v2:
-This function does nothing, so it should just be deleted entirely.

drivers/staging/r8188eu/os_dep/ioctl_linux.c | 38 --------------------
1 file changed, 38 deletions(-)

diff --git a/drivers/staging/r8188eu/os_dep/ioctl_linux.c b/drivers/staging/r8188eu/os_dep/ioctl_linux.c
index e7f35143dfe1..518625730883 100644
--- a/drivers/staging/r8188eu/os_dep/ioctl_linux.c
+++ b/drivers/staging/r8188eu/os_dep/ioctl_linux.c
@@ -4229,43 +4229,6 @@ static int rtw_tdls_get(struct net_device *dev,
return 0;
}

-static int rtw_test(
- struct net_device *dev,
- struct iw_request_info *info,
- union iwreq_data *wrqu, char *extra)
-{
- u32 len;
- u8 *pbuf, *pch;
- char *ptmp;
- u8 *delim = ",";
-
- DBG_88E("+%s\n", __func__);
- len = wrqu->data.length;
-
- pbuf = kzalloc(len, GFP_KERNEL);
- if (!pbuf) {
- DBG_88E("%s: no memory!\n", __func__);
- return -ENOMEM;
- }
-
- if (copy_from_user(pbuf, wrqu->data.pointer, len)) {
- kfree(pbuf);
- DBG_88E("%s: copy from user fail!\n", __func__);
- return -EFAULT;
- }
- DBG_88E("%s: string =\"%s\"\n", __func__, pbuf);
-
- ptmp = (char *)pbuf;
- pch = strsep(&ptmp, delim);
- if (!pch || strlen(pch) == 0) {
- kfree(pbuf);
- DBG_88E("%s: parameter error(level 1)!\n", __func__);
- return -EFAULT;
- }
- kfree(pbuf);
- return 0;
-}
-
static iw_handler rtw_handlers[] = {
IW_HANDLER(SIOCGIWNAME, rtw_wx_get_name),
IW_HANDLER(SIOCGIWFREQ, rtw_wx_get_freq),
@@ -4431,7 +4394,6 @@ NULL, /* 0x03 */
NULL, /* 0x1A */
NULL, /* 0x1B */
NULL, /* 0x1C is reserved for hostapd */
- rtw_test, /* 0x1D */
};

static struct iw_statistics *rtw_get_wireless_stats(struct net_device *dev)
--
2.20.1.7.g153144c

2021-12-25 18:19:44

by Pavel Skripkin

Subject: Re: [PATCH v4] staging: r8188eu: Use strndup_user instead of kmalloc/copy_from_user

On 12/25/21 20:04, Jiapeng Chong wrote:
> This code assumes that the user is going to give us a NUL terminated
> string which is not necessarily true.
>
> Fix following coccicheck warning:
>
> ./drivers/staging/r8188eu/os_dep/ioctl_linux.c:4253:8-15: WARNING
> opportunity for memdup_user.
>
> Reported-by: Abaci Robot <[email protected]>
> Fixes: 2b42bd58b321 ("staging: r8188eu: introduce new os_dep dir for RTL8188eu driver")
> Signed-off-by: Jiapeng Chong <[email protected]>
> ---

Subject line and commit message are completely unrelated to the change
itself, please fix up.


With regards,
Pavel Skripkin