2015-02-05 12:28:16

by Dan Carpenter

[permalink] [raw]
Subject: Re: [PATCH v2] staging: rtl8192u: r8192U_core: Fix for possible null pointer dereference

I don't know if this patch was merged before Greg cleaned out his inbox.

It's a good patch if you could just clean it up a bit.

On Thu, Jan 29, 2015 at 07:59:12PM +0100, Rickard Strandqvist wrote:
> Fix a possible null pointer dereference, there is
> otherwise a risk of a possible null pointer dereference.

The change log should say that "driver_info" is the NULL pointer. It
should say that by default stats->RxIs40MHzPacket is zero (as opposed to
uninitialized memory).

>
> This was found using a static code analysis program called cppcheck
>
> Signed-off-by: Rickard Strandqvist <[email protected]>
> ---
> drivers/staging/rtl8192u/r8192U_core.c | 8 ++++----
> 1 file changed, 4 insertions(+), 4 deletions(-)
>
> diff --git a/drivers/staging/rtl8192u/r8192U_core.c b/drivers/staging/rtl8192u/r8192U_core.c
> index e031a25..4a29237 100644
> --- a/drivers/staging/rtl8192u/r8192U_core.c
> +++ b/drivers/staging/rtl8192u/r8192U_core.c
> @@ -4476,11 +4476,11 @@ static void query_rxdesc_status(struct sk_buff *skb,
>
> /* for debug 2008.5.29 */
>
> - //added by vivi, for MP, 20080108
> - stats->RxIs40MHzPacket = driver_info->BW;
> - if (stats->RxDrvInfoSize != 0)
> + if (driver_info && stats->RxDrvInfoSize != 0) {
> + //added by vivi, for MP, 20080108

Delete these kinds of comments, please.


> + stats->RxIs40MHzPacket = driver_info->BW;
> TranslateRxSignalStuff819xUsb(skb, stats, driver_info);
> -
> + }

regards,
dan carpenter


2015-02-05 12:43:34

by Sudip Mukherjee

[permalink] [raw]
Subject: Re: [PATCH v2] staging: rtl8192u: r8192U_core: Fix for possible null pointer dereference

On Thu, Feb 05, 2015 at 03:27:45PM +0300, Dan Carpenter wrote:
> I don't know if this patch was merged before Greg cleaned out his inbox.
>
> It's a good patch if you could just clean it up a bit.
>
> On Thu, Jan 29, 2015 at 07:59:12PM +0100, Rickard Strandqvist wrote:
> > Fix a possible null pointer dereference, there is
> > otherwise a risk of a possible null pointer dereference.
>
> The change log should say that "driver_info" is the NULL pointer. It
> should say that by default stats->RxIs40MHzPacket is zero (as opposed to
> uninitialized memory).
>
> >
<snip>
> > +++ b/drivers/staging/rtl8192u/r8192U_core.c
> > @@ -4476,11 +4476,11 @@ static void query_rxdesc_status(struct sk_buff *skb,
> >
> > /* for debug 2008.5.29 */
> >
> > - //added by vivi, for MP, 20080108
> > - stats->RxIs40MHzPacket = driver_info->BW;
> > - if (stats->RxDrvInfoSize != 0)
> > + if (driver_info && stats->RxDrvInfoSize != 0) {
> > + //added by vivi, for MP, 20080108
>
> Delete these kinds of comments, please.
>
>
> > + stats->RxIs40MHzPacket = driver_info->BW;
> > TranslateRxSignalStuff819xUsb(skb, stats, driver_info);
> > -
> > + }

but in the present form the logic is changing. can you please check the following idea -

if (driver_info) {
stats->RxIs40MHzPacket = driver_info->BW;
if (stats->RxDrvInfoSize != 0)
TranslateRxSignalStuff819xUsb(skb, stats, driver_info);
}


regards
sudip


>
> regards,
> dan carpenter
>
> --
> To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
> the body of a message to [email protected]
> More majordomo info at http://vger.kernel.org/majordomo-info.html
> Please read the FAQ at http://www.tux.org/lkml/

2015-02-05 12:51:42

by Dan Carpenter

[permalink] [raw]
Subject: Re: [PATCH v2] staging: rtl8192u: r8192U_core: Fix for possible null pointer dereference

On Thu, Feb 05, 2015 at 06:13:22PM +0530, Sudip Mukherjee wrote:
> if (driver_info) {
> stats->RxIs40MHzPacket = driver_info->BW;
> if (stats->RxDrvInfoSize != 0)
> TranslateRxSignalStuff819xUsb(skb, stats, driver_info);
> }

If driver_info is non-NULL then stats->RxDrvInfoSize is not zero and
also the reverse. So really you only need to test one.

regards,
dan carpenter

2015-02-05 17:39:17

by Rickard Strandqvist

[permalink] [raw]
Subject: Re: [PATCH v2] staging: rtl8192u: r8192U_core: Fix for possible null pointer dereference

2015-02-05 13:51 GMT+01:00 Dan Carpenter <[email protected]>:
> On Thu, Feb 05, 2015 at 06:13:22PM +0530, Sudip Mukherjee wrote:
>> if (driver_info) {
>> stats->RxIs40MHzPacket = driver_info->BW;
>> if (stats->RxDrvInfoSize != 0)
>> TranslateRxSignalStuff819xUsb(skb, stats, driver_info);
>> }
>
> If driver_info is non-NULL then stats->RxDrvInfoSize is not zero and
> also the reverse. So really you only need to test one.
>
> regards,
> dan carpenter
>

True Dan

Okay, I'll make one last patch then, or if you want to do it Sudip?
Have you not done before Saturday I do it.

Kind regards
Rickard Strandqvist

2015-02-06 14:33:05

by Sudip Mukherjee

[permalink] [raw]
Subject: Re: [PATCH v2] staging: rtl8192u: r8192U_core: Fix for possible null pointer dereference

On Thu, Feb 05, 2015 at 06:39:13PM +0100, Rickard Strandqvist wrote:
> 2015-02-05 13:51 GMT+01:00 Dan Carpenter <[email protected]>:
> > On Thu, Feb 05, 2015 at 06:13:22PM +0530, Sudip Mukherjee wrote:
> >> if (driver_info) {
> >> stats->RxIs40MHzPacket = driver_info->BW;
> >> if (stats->RxDrvInfoSize != 0)
> >> TranslateRxSignalStuff819xUsb(skb, stats, driver_info);
> >> }
> >
> > If driver_info is non-NULL then stats->RxDrvInfoSize is not zero and
> > also the reverse. So really you only need to test one.
> >
> > regards,
> > dan carpenter
> >
>
> True Dan
>
> Okay, I'll make one last patch then, or if you want to do it Sudip?
> Have you not done before Saturday I do it.
no, its yours. you found it so credit should be yours.
I am sure Greg will accept this one. If he drops then maybe I can re-send with you as Reported-by

regards
Sudip

>
> Kind regards
> Rickard Strandqvist

2015-02-07 13:05:04

by Rickard Strandqvist

[permalink] [raw]
Subject: Re: [PATCH v2] staging: rtl8192u: r8192U_core: Fix for possible null pointer dereference

2015-02-06 15:32 GMT+01:00 Sudip Mukherjee <[email protected]>:
> On Thu, Feb 05, 2015 at 06:39:13PM +0100, Rickard Strandqvist wrote:
>> 2015-02-05 13:51 GMT+01:00 Dan Carpenter <[email protected]>:
>> > On Thu, Feb 05, 2015 at 06:13:22PM +0530, Sudip Mukherjee wrote:
>> >> if (driver_info) {
>> >> stats->RxIs40MHzPacket = driver_info->BW;
>> >> if (stats->RxDrvInfoSize != 0)
>> >> TranslateRxSignalStuff819xUsb(skb, stats, driver_info);
>> >> }
>> >
>> > If driver_info is non-NULL then stats->RxDrvInfoSize is not zero and
>> > also the reverse. So really you only need to test one.
>> >
>> > regards,
>> > dan carpenter
>> >
>>
>> True Dan
>>
>> Okay, I'll make one last patch then, or if you want to do it Sudip?
>> Have you not done before Saturday I do it.
> no, its yours. you found it so credit should be yours.
> I am sure Greg will accept this one. If he drops then maybe I can re-send with you as Reported-by
>
> regards
> Sudip
>
>>
>> Kind regards
>> Rickard Strandqvist


Thanks Sudip :)

And after checking some more, I agree with Dan cleaner to only use
if(driver_info)

New patch coming soon.

Kind regards
Rickard Strandqvist