Received-SPF: pass (google.com: best guess record for domain of linux-wireless-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
MIME-Version: 1.0
References: <20191105090442.8378-1-yhchuang@realtek.com>
In-Reply-To: <20191105090442.8378-1-yhchuang@realtek.com>
From:   Brian Norris <briannorris@chromium.org>
Date:   Wed, 6 Nov 2019 13:33:02 -0800
Message-ID: <CA+ASDXNrsoqQ2wAg3L5S7yW2-5bVFY_Z06_0vqjz184HzQunGg@mail.gmail.com>
Subject: Re: [PATCH] rtw88: fix potential NULL pointer access for firmware
To:     Tony Chuang <yhchuang@realtek.com>
Cc:     Kalle Valo <kvalo@codeaurora.org>,
        Dan Carpenter <dan.carpenter@oracle.com>,
        linux-wireless <linux-wireless@vger.kernel.org>
Content-Type: text/plain; charset="UTF-8"
Sender: linux-wireless-owner@vger.kernel.org
Precedence: bulk

On Tue, Nov 5, 2019 at 1:06 AM <yhchuang@realtek.com> wrote:
...
> Fixes: 5195b90426409 ("rtw88: avoid FW info flood")
...
> --- a/drivers/net/wireless/realtek/rtw88/main.c
> +++ b/drivers/net/wireless/realtek/rtw88/main.c
> @@ -1024,8 +1024,10 @@ static void rtw_load_firmware_cb(const struct firmware *firmware, void *context)
>         struct rtw_fw_state *fw = &rtwdev->fw;
>         const struct rtw_fw_hdr *fw_hdr;
>
> -       if (!firmware)
> +       if (!firmware || !firmware->data) {
>                 rtw_err(rtwdev, "failed to request firmware\n");

I think you still wanted 'complete_all()' here, otherwise your waiters
will hang forever. (They correctly check whether the firmware is NULL,
so that's not a problem there.)

I'll send a follow-up to the follow-up :)

Brian

> +               return;
> +       }