2023-03-10 12:31:06

by Dan Carpenter

[permalink] [raw]
Subject: [bug report] wifi: brcmfmac: cfg80211: Add support for scan params v2

Hello Hector Martin,

The patch 398ce273d6b1: "wifi: brcmfmac: cfg80211: Add support for
scan params v2" from Feb 14, 2023, leads to the following Smatch
static checker warning:

drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c:1459 brcmf_run_escan() error: potential null dereference 'params_v1'. (kzalloc returns null)
drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c:4319 brcmf_pmksa_v3_op() error: potential null dereference 'pmk_op'. (kzalloc returns null)

drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
1451 params->version = cpu_to_le32(BRCMF_ESCAN_REQ_VERSION_V2);
1452
1453 if (!brcmf_feat_is_enabled(ifp, BRCMF_FEAT_SCAN_V2)) {
1454 struct brcmf_escan_params_le *params_v1;
1455
1456 params_size -= BRCMF_SCAN_PARAMS_V2_FIXED_SIZE;
1457 params_size += BRCMF_SCAN_PARAMS_FIXED_SIZE;
1458 params_v1 = kzalloc(params_size, GFP_KERNEL);

kzalloc() needs a check for failure.

--> 1459 params_v1->version = cpu_to_le32(BRCMF_ESCAN_REQ_VERSION);
1460 brcmf_scan_params_v2_to_v1(&params->params_v2_le, &params_v1->params_le);
1461 kfree(params);
1462 params = params_v1;
1463 }
1464
1465 params->action = cpu_to_le16(WL_ESCAN_ACTION_START);
1466 params->sync_id = cpu_to_le16(0x1234);
1467
1468 err = brcmf_fil_iovar_data_set(ifp, "escan", params, params_size);
1469 if (err) {
1470 if (err == -EBUSY)
1471 brcmf_dbg(INFO, "system busy : escan canceled\n");
1472 else
1473 bphy_err(drvr, "error (%d)\n", err);
1474 }
1475
1476 kfree(params);
1477 exit:
1478 return err;
1479 }

regards,
dan carpenter