2019-09-26 15:08:11

by Connor Kuehl

Subject: [PATCH v2] staging: rtl8188eu: fix possible null dereference

Inside a nested 'else' block at the beginning of this function is a
call that assigns 'psta' to the return value of 'rtw_get_stainfo()'.
If 'rtw_get_stainfo()' returns NULL and the flow of control reaches
the 'else if' where 'psta' is dereferenced, then we will dereference
a NULL pointer.

Fix this by checking if 'psta' is not NULL before reading its
'psta->qos_option' data member.

Addresses-Coverity: ("Dereference null return value")

Signed-off-by: Connor Kuehl <[email protected]>
---
v1 -> v2:
- Add the same null check to line 779

drivers/staging/rtl8188eu/core/rtw_xmit.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/staging/rtl8188eu/core/rtw_xmit.c b/drivers/staging/rtl8188eu/core/rtw_xmit.c
index 952f2ab51347..c37591657bac 100644
--- a/drivers/staging/rtl8188eu/core/rtw_xmit.c
+++ b/drivers/staging/rtl8188eu/core/rtw_xmit.c
@@ -776,7 +776,7 @@ s32 rtw_make_wlanhdr(struct adapter *padapter, u8 *hdr, struct pkt_attrib *pattr
memcpy(pwlanhdr->addr2, get_bssid(pmlmepriv), ETH_ALEN);
memcpy(pwlanhdr->addr3, pattrib->src, ETH_ALEN);

- if (psta->qos_option)
+ if (psta && psta->qos_option)
qos_option = true;
} else if (check_fwstate(pmlmepriv, WIFI_ADHOC_STATE) ||
check_fwstate(pmlmepriv, WIFI_ADHOC_MASTER_STATE)) {
@@ -784,7 +784,7 @@ s32 rtw_make_wlanhdr(struct adapter *padapter, u8 *hdr, struct pkt_attrib *pattr
memcpy(pwlanhdr->addr2, pattrib->src, ETH_ALEN);
memcpy(pwlanhdr->addr3, get_bssid(pmlmepriv), ETH_ALEN);

- if (psta->qos_option)
+ if (psta && psta->qos_option)
qos_option = true;
} else {
RT_TRACE(_module_rtl871x_xmit_c_, _drv_err_, ("fw_state:%x is not allowed to xmit frame\n", get_fwstate(pmlmepriv)));
--
2.17.1

2019-09-26 17:08:22

by Larry Finger

Subject: Re: [PATCH v2] staging: rtl8188eu: fix possible null dereference

On 9/26/19 10:03 AM, Connor Kuehl wrote:
> Inside a nested 'else' block at the beginning of this function is a
> call that assigns 'psta' to the return value of 'rtw_get_stainfo()'.
> If 'rtw_get_stainfo()' returns NULL and the flow of control reaches
> the 'else if' where 'psta' is dereferenced, then we will dereference
> a NULL pointer.
>
> Fix this by checking if 'psta' is not NULL before reading its
> 'psta->qos_option' data member.
>
> Addresses-Coverity: ("Dereference null return value")
>
> Signed-off-by: Connor Kuehl <[email protected]>
> ---
> v1 -> v2:
> - Add the same null check to line 779
>
> drivers/staging/rtl8188eu/core/rtw_xmit.c | 4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/staging/rtl8188eu/core/rtw_xmit.c b/drivers/staging/rtl8188eu/core/rtw_xmit.c
> index 952f2ab51347..c37591657bac 100644
> --- a/drivers/staging/rtl8188eu/core/rtw_xmit.c
> +++ b/drivers/staging/rtl8188eu/core/rtw_xmit.c
> @@ -776,7 +776,7 @@ s32 rtw_make_wlanhdr(struct adapter *padapter, u8 *hdr, struct pkt_attrib *pattr
> memcpy(pwlanhdr->addr2, get_bssid(pmlmepriv), ETH_ALEN);
> memcpy(pwlanhdr->addr3, pattrib->src, ETH_ALEN);
>
> - if (psta->qos_option)
> + if (psta && psta->qos_option)
> qos_option = true;
> } else if (check_fwstate(pmlmepriv, WIFI_ADHOC_STATE) ||
> check_fwstate(pmlmepriv, WIFI_ADHOC_MASTER_STATE)) {
> @@ -784,7 +784,7 @@ s32 rtw_make_wlanhdr(struct adapter *padapter, u8 *hdr, struct pkt_attrib *pattr
> memcpy(pwlanhdr->addr2, pattrib->src, ETH_ALEN);
> memcpy(pwlanhdr->addr3, get_bssid(pmlmepriv), ETH_ALEN);
>
> - if (psta->qos_option)
> + if (psta && psta->qos_option)
> qos_option = true;
> } else {
> RT_TRACE(_module_rtl871x_xmit_c_, _drv_err_, ("fw_state:%x is not allowed to xmit frame\n", get_fwstate(pmlmepriv)));
>

Acked-by: Larry Finger <[email protected]>

Thanks,

Larry