Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
Subject: Re: [PATCH v3 3/6] staging: r8188eu: add error handling of rtw_read8
To:     Dan Carpenter <dan.carpenter@oracle.com>
Cc:     Larry.Finger@lwfinger.net, phil@philpotter.co.uk,
        gregkh@linuxfoundation.org, straube.linux@gmail.com,
        fmdefrancesco@gmail.com, linux-staging@lists.linux.dev,
        linux-kernel@vger.kernel.org
References: <cover.1629789580.git.paskripkin@gmail.com>
 <c59d5d850bf9aab208704182c83086609289cb9c.1629789580.git.paskripkin@gmail.com>
 <20210827090706.GA12231@kadam>
From:   Pavel Skripkin <paskripkin@gmail.com>
Message-ID: <84e04d0e-8a07-aedd-117a-6b6337b865c7@gmail.com>
Date:   Fri, 27 Aug 2021 12:16:25 +0300
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101
 Thunderbird/78.13.0
MIME-Version: 1.0
In-Reply-To: <20210827090706.GA12231@kadam>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Language: en-US
Content-Transfer-Encoding: 7bit
Precedence: bulk

On 8/27/21 12:07 PM, Dan Carpenter wrote:
> On Tue, Aug 24, 2021 at 10:27:27AM +0300, Pavel Skripkin wrote:
>> @@ -83,7 +83,12 @@ int proc_get_read_reg(char *page, char **start,
>>  
>>  	switch (proc_get_read_len) {
>>  	case 1:
>> -		len += snprintf(page + len, count - len, "rtw_read8(0x%x)=0x%x\n", proc_get_read_addr, rtw_read8(padapter, proc_get_read_addr));
>> +		error = rtw_read8(padapter, proc_get_read_addr, (u8 *) &tmp);
>> +		if (error)
>> +			return len;
>> +
>> +		len += snprintf(page + len, count - len, "rtw_read8(0x%x)=0x%x\n",
>> +				proc_get_read_addr, (u8) tmp);
>>  		break;
> 
> Oh my goodness...  :P
> 
> If you look at what proc_get_read_addr is, it turns out it's a 32bit
> address which is controlled by the user in proc_set_read_reg().  LOL!
> Just a giant security hole.
> 
> My advise is just delete this dead code.  No one is using it so how
> necessary can it be?


Yep, it's dead code as was already mentioned. My plan is to convert all 
this code to sysfs. One thing I am wondering about should I include 
these changes into this series?...


With regards,
Pavel Skripkin