Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
Date:   Wed, 11 Aug 2021 10:33:11 +0300
From:   Dan Carpenter <dan.carpenter@oracle.com>
To:     Tuo Li <islituo@gmail.com>
Cc:     gregkh@linuxfoundation.org, will+git@drnd.me,
        davidsondfgl@gmail.com, zhaoxiao@uniontech.com,
        linux-staging@lists.linux.dev, linux-kernel@vger.kernel.org,
        "baijiaju1990@gmail.com" <baijiaju1990@gmail.com>
Subject: Re: [BUG] staging: rtl8192e: possible null-pointer dereference in
 rtllib_wx_set_encode()
Message-ID: <20210811073311.GT22532@kadam>
References: <a86f508c-84b0-3523-2a8e-6710e35e5bb3@gmail.com>
Content-Type: text/plain; charset=iso-8859-1
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
In-Reply-To: <a86f508c-84b0-3523-2a8e-6710e35e5bb3@gmail.com>
User-Agent: Mutt/1.9.4 (2018-02-28)
MIME-Version: 1.0
X-MS-Exchange-MessageSentRepresentingType: 1
Received: from kadam (102.222.70.252) by JNXP275CA0040.ZAFP275.PROD.OUTLOOK.COM (2603:1086:0:18::28) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4415.15 via Frontend Transport; Wed, 11 Aug 2021 07:33:26 +0000
X-MS-PublicTrafficType: Email
X-MS-Office365-Filtering-Correlation-Id: f1acfe90-b8d8-43d4-d7e8-08d95c9a52d1
X-MS-TrafficTypeDiagnostic: CO1PR10MB4754:
X-MS-Exchange-Transport-Forked: True
X-Microsoft-Antispam-PRVS: <CO1PR10MB4754E4CD753518AAE614FB478EF89@CO1PR10MB4754.namprd10.prod.outlook.com>
X-MS-Oob-TLC-OOBClassifiers: OLM:7219;
X-MS-Exchange-SenderADCheck: 1
X-MS-Exchange-AntiSpam-Relay: 0
X-Microsoft-Antispam: BCL:0;
X-Microsoft-Antispam-Message-Info: YYlTKKPyBH2/rccvirPhtBhcS9SnuKh9SwrSYT6lXjgIwdqU6pvh6fXPgWblMFMg5EcE5ZAqLKpOqyP7nzPZdN/YjwC2x9TvI81tqtJC4TAUapHf0lYdAl4gXcIp2WW3BCWcvyDgMdYDwWygK0ncLnaVnODnh5Nv58fBaW6VJRE8IEIEmUTW47lCiAtUgOY3U+vz0IrXyKRFvgxr2UhQx5h7skjBLUPuPXE2hdIy1a6an354cGooxuFpz8IaQbeltDX19BbJsWoD6UzwCXcalBEXB6jA6wGQTjVag9ejXKtZP5Yj3xy0Dr87LfCClFXgX0iEul/fO+wIZlu5JHTYy+8DzHqIBbxtsiCR9n++GUAkzvsutWobkx7evivEA/5B+9rk2KSkUcjFuuhXQwWwAkpaeQgvWOCUO3t+StH8/PwVWsFtKrTiQrGQF7B3HYSLusa50hS2XO7NsLGaje/AeEZl4joCBXDFg8XqB38insLiUJ7fUDoZPkc8jhuohoLOPMuzrByyoA+GagAZ8yl9WAKrYuOfbVLVJbDhLN2DakEs+MFvL/FjkkuCYDXzH0Zq1y+j96J6Kd0YkgUeSqWP/FTWe4Gc3y1xaX0A7mwkHX2lJKgqkhAexVcaSwToMgn30loR3pbzWgAzUApZgLIwFTaQRqVUFnWiz2cb6JOtX55yNdPcwBW3ylJHZDW1T6fhD/IsFhAfHK/2kNdHaJP0VA==
X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:MWHPR1001MB2365.namprd10.prod.outlook.com;PTR:;CAT:NONE;SFS:(396003)(39860400002)(136003)(346002)(376002)(366004)(33716001)(6916009)(956004)(66946007)(38100700002)(6666004)(478600001)(66556008)(9686003)(55016002)(186003)(4326008)(38350700002)(1076003)(8936002)(44832011)(5660300002)(66476007)(8676002)(33656002)(9576002)(26005)(316002)(2906002)(52116002)(6496006)(86362001);DIR:OUT;SFP:1101;
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?iso-8859-1?Q?hSZuxj1x1dSQcwD5AESi+1VWtrfrMz9MZLr8izhYOj1zQex4Qh8d9yzXqq?=
 =?iso-8859-1?Q?/GEzLx4T6CagCF2qEc6tMPurL1bmCdf79ue6ONHHWLeXp0cRzEV1jWKqKw?=
 =?iso-8859-1?Q?M2vEKXXGxlMwdFiBB8p0J2rbBQPgXHJRVI3eHiMa4tAV/HIYjlz9rt1myI?=
 =?iso-8859-1?Q?525fDDiZ0pyTOatjDdm+oJlIsddxEtlbAXkmaahbv/GtSN9B1bVioKJ8mE?=
 =?iso-8859-1?Q?BXKx7gKA8duZuZHH/vXs5HbYfGCRetsP3MGY7PjMQGhT7mjxfI6rVCTKNI?=
 =?iso-8859-1?Q?008rdJx0dwGFF0V9f6zJ2UtNns1js4McJPI+60U0GbrHgY1cPUu8tPq3+9?=
 =?iso-8859-1?Q?2ySRl+dTPu6/212IZITSeaEp2ayuFh6OT+evHyFBc8AxNBMVvJJheVeFtg?=
 =?iso-8859-1?Q?EegZ7rABWz/x+X3ACyjR2MULmN7zGXBHUgsGVEwBNOWLbWnDMxfPzdfdBA?=
 =?iso-8859-1?Q?Jg9ulYN5RMSXsk1Y3oCr+DbbH7ElZS5rXxP6xuerz/wnOQAlIJCljIquvZ?=
 =?iso-8859-1?Q?Wl7qUdken771y68JbW+12yqEA0f83tYBoJRWXeHSEH7/w0Zd9wCUmmJpje?=
 =?iso-8859-1?Q?vSkGk+r9FMRA7qA/VKXXdjn/DRUKPmTpBB/A2ih+WEn6AgZjvhk4JYlsGB?=
 =?iso-8859-1?Q?Wkd2jG1Wxdm2Suky3vNc9Kc1FPlJllCLBus58ub92nqHUHcOiasB4mgV2E?=
 =?iso-8859-1?Q?UMH6phRUh7+cEbRnSD+f/WN/cxdEiQZsUkma2yZgLYzGLqpP1Gq5qXqGqL?=
 =?iso-8859-1?Q?IZ/6XNHB2CokTA3oYuoxjjUL7eaXjDt5PLg+wyREEjXltHb2w1m77+VeHI?=
 =?iso-8859-1?Q?+nLYgIJChvrbXj5vjd4RV71oElNQrR4qUxzM2SejEeJ6GESck8Lh8B9QTe?=
 =?iso-8859-1?Q?eKN6J9P8mqfqihXgn9tLqszenNWLLsemXq92Xrs+nl9NqPw7PhEetsVqO6?=
 =?iso-8859-1?Q?bnKhXliRtTB/ghWhh+cIlsMBPeln+tP9XAGWKX0IG3x/gh/YV48g/oDBDl?=
 =?iso-8859-1?Q?v5NlUR0gy+Xo71XuT8N5Z1BXz/iJioNoXP7Cg4Fy7/I44U5HfutDmxgaQ6?=
 =?iso-8859-1?Q?C6c0I4GBDflwLQJSIvXMQgrleBLXzLmzGsQfHskSFqb0e4injn0xl4OURo?=
 =?iso-8859-1?Q?gNMtqGD0e++D3LJfGxSitpj2HwEfpZBlzsp1tYj4h7g6lxtPIvHX50KrM5?=
 =?iso-8859-1?Q?8YxA1b8Vpbg/1JjMas2lxe7USFe1D5hiEveN1fWzDG5ltzpvEDmGymlo5C?=
 =?iso-8859-1?Q?7PhXE5LejI6DH0NT5klCr339gO5Qe1d1BQyu00hEwpKIs2yEJcvZSkuvZ6?=
 =?iso-8859-1?Q?yQFtcQCYTT+Z6FNDqjONPvmAK+Pqr2VLNroy0UpRsw/ksyYzOREWZ/EyeZ?=
 =?iso-8859-1?Q?wtc2QkB7+G?=
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-Network-Message-Id: f1acfe90-b8d8-43d4-d7e8-08d95c9a52d1
X-MS-Exchange-CrossTenant-AuthSource: MWHPR1001MB2365.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 11 Aug 2021 07:33:33.8376
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: VJ8iimwzyZnhFwTc2m9k6AgPoLq4vhVdT8irdybN/8kyc+nxzUdAY8ETXAlvSmTJFyXvjpUshBvM7K8tW1RhFZbYndKloZUGPMsOhcxURs0=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: CO1PR10MB4754
X-Proofpoint-Virus-Version: vendor=nai engine=6200 definitions=10072 signatures=668682
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 bulkscore=0 suspectscore=0 mlxscore=0
 phishscore=0 spamscore=0 mlxlogscore=903 malwarescore=0 adultscore=0
 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2107140000
 definitions=main-2108110048
X-Proofpoint-GUID: 9c0PMfCeKyi1XfzGjeJRZVimI5MLpADK
X-Proofpoint-ORIG-GUID: 9c0PMfCeKyi1XfzGjeJRZVimI5MLpADK
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

On Wed, Aug 11, 2021 at 11:33:57AM +0800, Tuo Li wrote:
> Hello,
> 
> Our static analysis tool finds a possible null-pointer dereference in
> rtllib_wx.c in Linux 5.14.0-rc3:
> 
> The variable (*crypt)->ops is checked in:
> 342:??? if (*crypt && (*crypt)->ops && strcmp((*crypt)->ops->name, "R-WEP")
> != 0)
> 
> This indicates that it can be NULL. If so, null-pointer dereferences will
> occur:
> 389:??? (*crypt)->ops->set_key()
> 400:??? len = (*crypt)->ops->get_key()
> 
> I am not quite sure whether this possible null-pointer dereference is real
> and how to fix it if it is real.
> Any feedback would be appreciated, thanks!
> 
> Reported-by: TOTE Robot <oslab@tsinghua.edu.cn>

I don't *think* the check is required.

The data in ieee->crypt_info.crypt[idx] is set in rtllib_wx_set_encode()
and rtllib_wx_set_encode_ext() when we do "*crypt = new_crypt;".  (The
line is the same in both functions).  And in both cases ->ops is
non-NULL.

So probably the check should be removed.

On the other hand, I don't know the code very well and it's possible I
missed something.

regards,
dan carpenter