Received-SPF: pass (google.com: domain of linux-wireless-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
Date:   Fri, 21 Jan 2022 12:30:12 +0100
Message-ID: <s5h7dattjgb.wl-tiwai@suse.de>
From:   Takashi Iwai <tiwai@suse.de>
To:     Johannes Berg <johannes@sipsolutions.net>
Cc:     Takashi Iwai <tiwai@suse.de>,
        Luca Coelho <luciano.coelho@intel.com>,
        Oliver Neukum <oneukum@suse.de>,
        linux-wireless@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: Re: [PATCH] iwlwifi: mvm: Fix potential NULL dereference for sta
In-Reply-To: <2d33846961e5d5fed80b94696c27be60ecbb11c8.camel@sipsolutions.net>
References: <20220121111418.9144-1-tiwai@suse.de>
        <2d33846961e5d5fed80b94696c27be60ecbb11c8.camel@sipsolutions.net>
User-Agent: Wanderlust/2.15.9 (Almost Unreal) SEMI/1.14.6 (Maruoka)
 FLIM/1.14.9 (=?UTF-8?B?R29qxY0=?=) APEL/10.8 Emacs/25.3
 (x86_64-suse-linux-gnu) MULE/6.0 (HANACHIRUSATO)
MIME-Version: 1.0 (generated by SEMI 1.14.6 - "Maruoka")
Content-Type: text/plain; charset=US-ASCII
Precedence: bulk

On Fri, 21 Jan 2022 12:22:05 +0100,
Johannes Berg wrote:
> 
> On Fri, 2022-01-21 at 12:14 +0100, Takashi Iwai wrote:
> > The recent fix for NULL sta in iwl_mvm_get_tx_rate() may still hit a
> > potential NULL dereference, as iwl_mvm_sta_from_mac80211() is called
> > unconditionally (although this doesn't seem happening, practically
> > seen, thanks to the compiler optimization).
> > 
> 
> No objection to the patch, but I think the description isn't quite
> right?
> 
> static inline struct iwl_mvm_sta *
> iwl_mvm_sta_from_mac80211(struct ieee80211_sta *sta)
> {
>         return (void *)sta->drv_priv;
> }
> 
> looks like a dereference, but I _think_
> 
> struct ieee80211_sta {
> 	[...]
> 
>         /* must be last */
>         u8 drv_priv[] __aligned(sizeof(void *));
> };
> 
> 
> means it's just an address calculation, i.e. the same as if we had
> 
> 	return (void *)((u8 *)sta + offsetof(typeof(*sta), drv_priv));
> 
> no?

Yeah, indeed, that won't access the member.

> I guess technically it's still UB doing calculations on a NULL pointer,
> but practically that's going to work.
> 
> Anyway, no objections :)

OK, I'll submit v2 with rephrasing for avoid confusion.


Takashi