Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Date:   Mon, 20 Jun 2022 12:55:00 +0300
From:   Dan Carpenter <dan.carpenter@oracle.com>
To:     Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Cc:     Kees Cook <keescook@chromium.org>,
        Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
        Fabio Aiuto <fabioaiuto83@gmail.com>,
        Hans de Goede <hdegoede@redhat.com>,
        linux-staging@lists.linux.dev,
        Michael Straube <straube.linux@gmail.com>,
        Arnd Bergmann <arnd@arndb.de>, linux-kernel@vger.kernel.org,
        linux-hardening@vger.kernel.org
Subject: Re: [PATCH] staging: rtl8723bs: Allocate full pwep structure
Message-ID: <20220620095500.GI16517@kadam>
References: <20220608215512.1070847-1-keescook@chromium.org>
 <38d31460-f3e0-1260-05c5-406a05d9fb37@wanadoo.fr>
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <38d31460-f3e0-1260-05c5-406a05d9fb37@wanadoo.fr>
User-Agent: Mutt/1.9.4 (2018-02-28)
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?a+gn0NYgRkyrroBjnseMG+uiTH09Xsx0TFSG7HzBr5MyBwbGBW3XlOmJAaAl?=
 =?us-ascii?Q?W1oN3G2ESlepa+svOqmk4CbJP2ddECkYno2N6cDkhTBr3hgheencdm0b5QLo?=
 =?us-ascii?Q?MxtvCk9U5RMYvALcPzzDd+D8wsEzUdfWBo26C2VfVzfg4EgmaPvIyC7bCVCO?=
 =?us-ascii?Q?VdahnOz8IGgEyv6XPPUXn3f2MbQqdy0CM0zSZRHs2kHzORwAUb52yYD/6ZuD?=
 =?us-ascii?Q?qP5FK/3vcdPcBqoXwldFWMIC8ff5mKtxbHub6T3POQKr2unH6UZKKceSSiNi?=
 =?us-ascii?Q?Kv16kdZOraTzKqbnCPXgsIcphVIC+Az4sXAf4vWMdcZ/sQv3+EAelp/cS0gC?=
 =?us-ascii?Q?2uJCluJtjWldNFdYYQbe5Hvnfkp9Es7VTk4lCm5JQQCPipEoi5ERXVb8msVo?=
 =?us-ascii?Q?BixWbEtqsde96VUhjdEdjgrzglo7OZXjUdJ8nNDUQYN2OTcM0iQVOKZEBQnf?=
 =?us-ascii?Q?QcyIHwEEmil5iHS6DgM4M17kuGh6i7Ra7oWDnvfua2gbX+g109ZoEiVWkhzf?=
 =?us-ascii?Q?tDWalGeZGFcGOgz2g/vym4KKu2TwhStJbD+VQMBBVJw2GXVNgTHSXuBGFv+C?=
 =?us-ascii?Q?nieZ39n6Ma8rit2cMY59T3t6evVJfd7BOlGM+VcuZy5vJqQkZoClREa5hBKW?=
 =?us-ascii?Q?QTthoswrbHYVbBqN9JXxFdYYFHUizuQ/jowSihGRY/ayd3Ce3B5oaNpKbWEh?=
 =?us-ascii?Q?ytPNpjoYoTtRVCMwdojJtPr/fRqASdBa9o/n9XqE73Eo4w93qHsYT/k+FNAi?=
 =?us-ascii?Q?Ww2L7dRO9uB9rVOTtdhLwaUuYoH2sprTMQej5Zx4TIFzqMQerrmF7d9KiyBb?=
 =?us-ascii?Q?lwrbZeDQ17v31/pZpD/xSLjgbCVsiyLZio+5NP7XtI8jCr/LZIszzI9NwNDp?=
 =?us-ascii?Q?60uLHAcH7eXZrHfsuvu1SB3hBAURVGRDE4YyEbWTg8ZQuK6efPSJaYkjfA0x?=
 =?us-ascii?Q?3JNTPGd/6zfvymZEl3ZwGZ49Sd8EvUTVVk+y8XGRItGvX4VQ0JZxx2cwe2oK?=
 =?us-ascii?Q?LjVKzuyxtdN/DUoI9j3VtsSM8HfyyN87cPaa3O57QnVt75UeCZeyOkN1YJWA?=
 =?us-ascii?Q?jNcrFF15WYv7bJ5iqjzn7ZxGRPnfRqUICu8G6egc8aua8zfqAQsKTuaKsvWL?=
 =?us-ascii?Q?BVEUtswiwkvECDdVFXeTwTt1BGVuIq1MQFVIH5KAichUjc01AhM5q+JFzkHG?=
 =?us-ascii?Q?OOEe+BOiheVrff9LmN+J5qYML0p6FKdJTCUtxhHkgV12i9mtd6l+ZncOsGlU?=
 =?us-ascii?Q?uGJiGUI2e2abggzUZBAPKwGqNJ30zm65CbPJunkROs6XLkR5BmFFezoSCNnu?=
 =?us-ascii?Q?Fm/Anoq4EYhGwJhlL+jR3VGAuTUISwipPEBvzgP5R2ca3cy2IaWFA0RsS2DV?=
 =?us-ascii?Q?f2sh2faHivIIaOihe0aXX7gAP6mG0HL70VIjmE91P1YqlJMdCexHXfRWduU3?=
 =?us-ascii?Q?tgAL09mdoZTWKFcFC5HgJNWARtSlQVrp/yKzdwqqJof5WhjTJX4EOauOdnVy?=
 =?us-ascii?Q?LPejojsgPd9sxxFNgSbOqHz+i81nB8QaI1SaKpAxgN2oV4W4RPnjZvEvuNHj?=
 =?us-ascii?Q?AgJYELqqayZgsyyUbo0GPq8FZ7W5Y44AWltZMrRZSWIeS7NdCVIefbeExBLc?=
 =?us-ascii?Q?iPOjOp0PIuaAGvWrf6J8aEtliEQBntlH467Sso0vFTERyigxfzP0r7CJBYGv?=
 =?us-ascii?Q?+XOHYkrV86MWsLmGd0IafOh0efW5ojBvQB2OmfAVex0+EBMBD/5ND2hZcB8t?=
 =?us-ascii?Q?tYyPwb6JmbtkvTXW2auB+RiQkbbCjjw=3D?=
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-Network-Message-Id: cdfcba86-34ad-4cbe-ed32-08da52a2fccb
X-MS-Exchange-CrossTenant-AuthSource: MWHPR1001MB2365.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 20 Jun 2022 09:55:20.9967
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: j9HQOhXZEl2fPLo+N/ieamWAp+Cb/+69kx6HaKx+2padEHwrUZiy30Z8GaLtxHEVkHP2+gbviqSEAR2EAIs9hnL+Armcs8aJFB8zhbKqgMc=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: DS7PR10MB5248
X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:6.0.517,18.0.883
 definitions=2022-06-20_04:2022-06-17,2022-06-20 signatures=0
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 suspectscore=0 mlxlogscore=999
 malwarescore=0 adultscore=0 phishscore=0 bulkscore=0 mlxscore=0
 spamscore=0 classifier=spam adjust=0 reason=mlx scancount=1
 engine=8.12.0-2204290000 definitions=main-2206200046
X-Proofpoint-ORIG-GUID: e2m7zHGvwzuWS04f3v8cvVaw9dzrv0GM
X-Proofpoint-GUID: e2m7zHGvwzuWS04f3v8cvVaw9dzrv0GM
X-Spam-Status: No, score=-2.8 required=5.0 tests=BAYES_00,DKIM_SIGNED,
        DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_LOW,
        RCVD_IN_MSPIKE_H2,SPF_HELO_NONE,SPF_NONE,T_SCC_BODY_TEXT_LINE
        autolearn=ham autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

On Sat, Jun 18, 2022 at 09:51:36AM +0200, Christophe JAILLET wrote:
> > diff --git a/drivers/staging/rtl8723bs/os_dep/ioctl_linux.c b/drivers/staging/rtl8723bs/os_dep/ioctl_linux.c
> > index ece97e37ac91..30374a820496 100644
> > --- a/drivers/staging/rtl8723bs/os_dep/ioctl_linux.c
> > +++ b/drivers/staging/rtl8723bs/os_dep/ioctl_linux.c
> > @@ -90,7 +90,8 @@ static int wpa_set_encryption(struct net_device *dev, struct ieee_param *param,
> >   		if (wep_key_len > 0) {
> >   			wep_key_len = wep_key_len <= 5 ? 5 : 13;
> >   			wep_total_len = wep_key_len + FIELD_OFFSET(struct ndis_802_11_wep, key_material);
> > -			pwep = kzalloc(wep_total_len, GFP_KERNEL);
> > +			/* Allocate a full structure to avoid potentially running off the end. */
> > +			pwep = kzalloc(sizeof(*pwep), GFP_KERNEL);
> >   			if (!pwep) {
> >   				ret = -ENOMEM;
> >   				goto exit;
> > @@ -582,7 +583,8 @@ static int rtw_set_encryption(struct net_device *dev, struct ieee_param *param,
> >   		if (wep_key_len > 0) {
> >   			wep_key_len = wep_key_len <= 5 ? 5 : 13;
> >   			wep_total_len = wep_key_len + FIELD_OFFSET(struct ndis_802_11_wep, key_material);
> > -			pwep = kzalloc(wep_total_len, GFP_KERNEL);
> > +			/* Allocate a full structure to avoid potentially running off the end. */
> > +			pwep = kzalloc(sizeof(*pwep), GFP_KERNEL);
> >   			if (!pwep)
> 
> Hi,
> 
> while at it (and un-related tyo your patch), I think that 'ret' should also
> be updated here, otherwise we return 0.
> 

Too late.  Smatch does catch that bug btw.

drivers/staging/r8188eu/os_dep/ioctl_linux.c:409 wpa_set_encryption() warn: missing error code here? 'kzalloc()' failed. 'ret' = '0'

regards,
dan carpenter