2015-07-27 19:30:20

by John W. Linville

[permalink] [raw]
Subject: [PATCH] ath10k: remove NULL ptr deref in variable init of ath10k_monitor_vdev_start

In ath10k_monitor_vdev_start, chandef is initialized to NULL and then
channel is immediately thereafter initialized to chandef->chan (i.e.
NULL->chan). This appears to be some sort of cut-n-paste error, since
the same assignment is done later (i.e. after chandef has been properly
assigned to a non-NULL value). So, let's just remove this "brown paper
bag" typo/thinko... :-)

Coverity CID #1309505

Signed-off-by: John W. Linville <[email protected]>
---
drivers/net/wireless/ath/ath10k/mac.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c
index c9a7d5b5dffc..2823222dea92 100644
--- a/drivers/net/wireless/ath/ath10k/mac.c
+++ b/drivers/net/wireless/ath/ath10k/mac.c
@@ -836,7 +836,7 @@ static inline int ath10k_vdev_setup_sync(struct ath10k *ar)
static int ath10k_monitor_vdev_start(struct ath10k *ar, int vdev_id)
{
struct cfg80211_chan_def *chandef = NULL;
- struct ieee80211_channel *channel = chandef->chan;
+ struct ieee80211_channel *channel;
struct wmi_vdev_start_request_arg arg = {};
int ret = 0;

--
2.4.3



2015-07-28 16:23:37

by Kalle Valo

[permalink] [raw]
Subject: Re: [PATCH] ath10k: remove NULL ptr deref in variable init of ath10k_monitor_vdev_start

"John W. Linville" <[email protected]> writes:

> On Tue, Jul 28, 2015 at 10:41:11AM +0530, Vasanthakumar Thiagarajan wrote:
>> On Tuesday 28 July 2015 12:52 AM, John W. Linville wrote:
>> >In ath10k_monitor_vdev_start, chandef is initialized to NULL and then
>> >channel is immediately thereafter initialized to chandef->chan (i.e.
>> >NULL->chan). This appears to be some sort of cut-n-paste error, since
>> >the same assignment is done later (i.e. after chandef has been properly
>> >assigned to a non-NULL value). So, let's just remove this "brown paper
>> >bag" typo/thinko... :-)
>> >
>> >Coverity CID #1309505
>> >
>> >Signed-off-by: John W. Linville <[email protected]>

[...]

>> There is a similar change integrated recently,
>> https://github.com/kvalo/ath/commit/19be9e9a7ac7e6050eab426283d2a87593cf6e82
>
> OK. I don't see much point in the NULL assignment for channel, but the main
> point is to avoide the chandef->chan part.

Yeah, that was an oversight in my review. Want to send a patch to fix
that? :)

--
Kalle Valo

2015-07-28 14:45:17

by John W. Linville

[permalink] [raw]
Subject: Re: [PATCH] ath10k: remove NULL ptr deref in variable init of ath10k_monitor_vdev_start

On Tue, Jul 28, 2015 at 10:41:11AM +0530, Vasanthakumar Thiagarajan wrote:
> On Tuesday 28 July 2015 12:52 AM, John W. Linville wrote:
> >In ath10k_monitor_vdev_start, chandef is initialized to NULL and then
> >channel is immediately thereafter initialized to chandef->chan (i.e.
> >NULL->chan). This appears to be some sort of cut-n-paste error, since
> >the same assignment is done later (i.e. after chandef has been properly
> >assigned to a non-NULL value). So, let's just remove this "brown paper
> >bag" typo/thinko... :-)
> >
> >Coverity CID #1309505
> >
> >Signed-off-by: John W. Linville <[email protected]>
> >---
> > drivers/net/wireless/ath/ath10k/mac.c | 2 +-
> > 1 file changed, 1 insertion(+), 1 deletion(-)
> >
> >diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c
> >index c9a7d5b5dffc..2823222dea92 100644
> >--- a/drivers/net/wireless/ath/ath10k/mac.c
> >+++ b/drivers/net/wireless/ath/ath10k/mac.c
> >@@ -836,7 +836,7 @@ static inline int ath10k_vdev_setup_sync(struct ath10k *ar)
> > static int ath10k_monitor_vdev_start(struct ath10k *ar, int vdev_id)
> > {
> > struct cfg80211_chan_def *chandef = NULL;
> >- struct ieee80211_channel *channel = chandef->chan;
> >+ struct ieee80211_channel *channel;
> > struct wmi_vdev_start_request_arg arg = {};
> > int ret = 0;
> >
>
> There is a similar change integrated recently,
> https://github.com/kvalo/ath/commit/19be9e9a7ac7e6050eab426283d2a87593cf6e82

OK. I don't see much point in the NULL assignment for channel, but the main
point is to avoide the chandef->chan part.

John
--
John W. Linville Someday the world will need a hero, and you
[email protected] might be all we have. Be ready.

Subject: Re: [PATCH] ath10k: remove NULL ptr deref in variable init of ath10k_monitor_vdev_start

On Tuesday 28 July 2015 12:52 AM, John W. Linville wrote:
> In ath10k_monitor_vdev_start, chandef is initialized to NULL and then
> channel is immediately thereafter initialized to chandef->chan (i.e.
> NULL->chan). This appears to be some sort of cut-n-paste error, since
> the same assignment is done later (i.e. after chandef has been properly
> assigned to a non-NULL value). So, let's just remove this "brown paper
> bag" typo/thinko... :-)
>
> Coverity CID #1309505
>
> Signed-off-by: John W. Linville <[email protected]>
> ---
> drivers/net/wireless/ath/ath10k/mac.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c
> index c9a7d5b5dffc..2823222dea92 100644
> --- a/drivers/net/wireless/ath/ath10k/mac.c
> +++ b/drivers/net/wireless/ath/ath10k/mac.c
> @@ -836,7 +836,7 @@ static inline int ath10k_vdev_setup_sync(struct ath10k *ar)
> static int ath10k_monitor_vdev_start(struct ath10k *ar, int vdev_id)
> {
> struct cfg80211_chan_def *chandef = NULL;
> - struct ieee80211_channel *channel = chandef->chan;
> + struct ieee80211_channel *channel;
> struct wmi_vdev_start_request_arg arg = {};
> int ret = 0;
>

There is a similar change integrated recently,
https://github.com/kvalo/ath/commit/19be9e9a7ac7e6050eab426283d2a87593cf6e82 .

Vasanth