Message ID | 20230210111228.370513-1-n.petrova@fintech.ru |
---|---|
State | New |
Headers |
Return-Path: <linux-kernel-owner@vger.kernel.org> Delivered-To: ouuuleilei@gmail.com Received: by 2002:adf:eb09:0:0:0:0:0 with SMTP id s9csp892731wrn; Fri, 10 Feb 2023 03:18:06 -0800 (PST) X-Google-Smtp-Source: AK7set/9dAsteeYuRGd5BV7OC1DR86e0ll+mB/MCLte+yOM/0/449eGsnLb9a0t/y2AtjXlvw9SO X-Received: by 2002:a17:906:f6cd:b0:8a9:8047:a5c with SMTP id jo13-20020a170906f6cd00b008a980470a5cmr14373011ejb.7.1676027885907; Fri, 10 Feb 2023 03:18:05 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1676027885; cv=none; d=google.com; s=arc-20160816; b=plyFHHgX2q6FZ7/B79ynrxNbqNWc1FTAH9rq7/7tAE2gM3Qb9alWURqkFjAgNsRZqf EFIbt8L20Z2ZL7G1kSlz7WfTOmBlA0EIEpRS6YzWdiRb389UwqqhhF4ETejwTBI7iynY Gmc5pobZbiFWuR/rAr/fmisS3NbA1Vs6mSosFLVzcKCIBGp2BBS/jjW6fXxmqdxs/RDD uojvsd5smUB6SCRi4dZ+nlRcxQc6o5jukzf/1Y/YWNvElNPY0VJQ2Z6FTZkHfwkmr0Tz 6Ley6oI5KaP0sBcd7pm1Sz3dbTlALPSNduZFsPAmN3cBK7cxN1tOO3DPY+dQvPLqFPFj dWKA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :message-id:date:subject:cc:to:from; bh=6KKBIhIqg9lrnjruUR3OnvakIMgHqcx8wThGqcsvUbA=; b=VFA+DvCTA/3/X2ROtLuO3fHJDOHGCkmgSahHIayBlodkGQQ2d3m+mkZoSqvFcbpNsN faPCC0dHkBQbV2+VEIVZ3iwHi3ktlD9Lls0Old9gGfdqPs46YUZShx1i51ajEnX2wX8m nQAD6MNbC41y+HE5DxOyHKwUrebXO7+FgQHEv6F7U0t81meyx5dSPQlboltbeCYjDktY UMD2R5BOa9/BqO1BsVWO4cM70krYQuEdbRZKB0ASZoVhDJBVPahQGHl9MS1Ticny4Zlj qUl1wWymxB/0GPMITEv9U+NWQsMeGdRBu/nU56kyq2OBhtjDiFsH+MvRehLF2v7S0TbD AgRg== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id wl14-20020a170907310e00b00877df2d513dsi4566778ejb.609.2023.02.10.03.17.42; Fri, 10 Feb 2023 03:18:05 -0800 (PST) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231897AbjBJLNZ (ORCPT <rfc822;ybw1215001957@gmail.com> + 99 others); Fri, 10 Feb 2023 06:13:25 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:53604 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231954AbjBJLNU (ORCPT <rfc822;linux-kernel@vger.kernel.org>); Fri, 10 Feb 2023 06:13:20 -0500 Received: from exchange.fintech.ru (e10edge.fintech.ru [195.54.195.159]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 8806272DCC; Fri, 10 Feb 2023 03:12:38 -0800 (PST) Received: from Ex16-01.fintech.ru (10.0.10.18) by exchange.fintech.ru (195.54.195.169) with Microsoft SMTP Server (TLS) id 14.3.498.0; Fri, 10 Feb 2023 14:12:31 +0300 Received: from KANASHIN1.fintech.ru (10.0.253.125) by Ex16-01.fintech.ru (10.0.10.18) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2242.4; Fri, 10 Feb 2023 14:12:31 +0300 From: Natalia Petrova <n.petrova@fintech.ru> To: Larry Finger <Larry.Finger@lwfinger.net> CC: Natalia Petrova <n.petrova@fintech.ru>, Kalle Valo <kvalo@kernel.org>, "David S. Miller" <davem@davemloft.net>, Eric Dumazet <edumazet@google.com>, Jakub Kicinski <kuba@kernel.org>, Paolo Abeni <pabeni@redhat.com>, <linux-wireless@vger.kernel.org>, <b43-dev@lists.infradead.org>, <netdev@vger.kernel.org>, <linux-kernel@vger.kernel.org>, <lvc-project@linuxtesting.org> Subject: [PATCH] b43legacy: Add checking for null for ssb_get_devtypedata(dev) Date: Fri, 10 Feb 2023 14:12:28 +0300 Message-ID: <20230210111228.370513-1-n.petrova@fintech.ru> X-Mailer: git-send-email 2.34.1 MIME-Version: 1.0 Content-Transfer-Encoding: 7BIT Content-Type: text/plain; charset=US-ASCII X-Originating-IP: [10.0.253.125] X-ClientProxiedBy: Ex16-01.fintech.ru (10.0.10.18) To Ex16-01.fintech.ru (10.0.10.18) X-Spam-Status: No, score=-1.9 required=5.0 tests=BAYES_00,SPF_HELO_NONE, SPF_PASS autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: <linux-kernel.vger.kernel.org> X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1757442616269258223?= X-GMAIL-MSGID: =?utf-8?q?1757442616269258223?= |
Series |
b43legacy: Add checking for null for ssb_get_devtypedata(dev)
|
|
Commit Message
Natalia Petrova
Feb. 10, 2023, 11:12 a.m. UTC
Function ssb_get_devtypedata(dev) may return null (next call
B43legacy_WARN_ON(!wl) is used for error handling, including null-value).
Therefore, a check is added before calling b43legacy_wireless_exit(),
where the argument containing this value is expected to be dereferenced.
Found by Linux Verification Center (linuxtesting.org) with SVACE
Fixes: 75388acd0cd8 ("[B43LEGACY]: add mac80211-based driver for legacy BCM43xx devices")
Signed-off-by: Natalia Petrova <n.petrova@fintech.ru>
---
drivers/net/wireless/broadcom/b43legacy/main.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
Comments
On 2/10/23 05:12, Natalia Petrova wrote: > Function ssb_get_devtypedata(dev) may return null (next call > B43legacy_WARN_ON(!wl) is used for error handling, including null-value). > Therefore, a check is added before calling b43legacy_wireless_exit(), > where the argument containing this value is expected to be dereferenced. > > Found by Linux Verification Center (linuxtesting.org) with SVACE > > Fixes: 75388acd0cd8 ("[B43LEGACY]: add mac80211-based driver for legacy BCM43xx devices") > Signed-off-by: Natalia Petrova <n.petrova@fintech.ru> > --- > drivers/net/wireless/broadcom/b43legacy/main.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/drivers/net/wireless/broadcom/b43legacy/main.c b/drivers/net/wireless/broadcom/b43legacy/main.c > index 760136638a95..1ae65679d704 100644 > --- a/drivers/net/wireless/broadcom/b43legacy/main.c > +++ b/drivers/net/wireless/broadcom/b43legacy/main.c > @@ -3871,7 +3871,7 @@ static int b43legacy_probe(struct ssb_device *dev, > return err; > > err_wireless_exit: > - if (first) > + if (first && wl) > b43legacy_wireless_exit(dev, wl); > return err; > } Looks good to me. Acked-by: Larry Finger <Larry.Finger@gmail.com> Thanks, Larry
On Fri, Feb 10, 2023 at 02:12:28PM +0300, Natalia Petrova wrote: > Function ssb_get_devtypedata(dev) may return null (next call > B43legacy_WARN_ON(!wl) is used for error handling, including null-value). > Therefore, a check is added before calling b43legacy_wireless_exit(), > where the argument containing this value is expected to be dereferenced. I see that is true, however, in that case are resources leaked due to the ieee80211_free_hw() call in b43legacy_wireless_exit() not being made? Moreover, aren't there also unguarded dereferences of wl: 1. In the call to b43legacy_one_core_attach(), which would branch to err_wireless_exit on failure. 2. In the call to schedule_work() just about the out: label. For the record, and because it seems relevant to give contexxt, b43legacy_probe() looks like this: static int b43legacy_probe(struct ssb_device *dev, const struct ssb_device_id *id) { struct b43legacy_wl *wl; int err; int first = 0; wl = ssb_get_devtypedata(dev); if (!wl) { /* Probing the first core - setup common struct b43legacy_wl */ first = 1; err = b43legacy_wireless_init(dev); if (err) goto out; wl = ssb_get_devtypedata(dev); B43legacy_WARN_ON(!wl); } err = b43legacy_one_core_attach(dev, wl); if (err) goto err_wireless_exit; /* setup and start work to load firmware */ INIT_WORK(&wl->firmware_load, b43legacy_request_firmware); schedule_work(&wl->firmware_load); out: return err; err_wireless_exit: if (first) b43legacy_wireless_exit(dev, wl); return err; } > > Found by Linux Verification Center (linuxtesting.org) with SVACE > > Fixes: 75388acd0cd8 ("[B43LEGACY]: add mac80211-based driver for legacy BCM43xx devices") > Signed-off-by: Natalia Petrova <n.petrova@fintech.ru> > --- > drivers/net/wireless/broadcom/b43legacy/main.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/drivers/net/wireless/broadcom/b43legacy/main.c b/drivers/net/wireless/broadcom/b43legacy/main.c > index 760136638a95..1ae65679d704 100644 > --- a/drivers/net/wireless/broadcom/b43legacy/main.c > +++ b/drivers/net/wireless/broadcom/b43legacy/main.c > @@ -3871,7 +3871,7 @@ static int b43legacy_probe(struct ssb_device *dev, > return err; > > err_wireless_exit: > - if (first) > + if (first && wl) > b43legacy_wireless_exit(dev, wl); > return err; > } > -- > 2.34.1 >
diff --git a/drivers/net/wireless/broadcom/b43legacy/main.c b/drivers/net/wireless/broadcom/b43legacy/main.c index 760136638a95..1ae65679d704 100644 --- a/drivers/net/wireless/broadcom/b43legacy/main.c +++ b/drivers/net/wireless/broadcom/b43legacy/main.c @@ -3871,7 +3871,7 @@ static int b43legacy_probe(struct ssb_device *dev, return err; err_wireless_exit: - if (first) + if (first && wl) b43legacy_wireless_exit(dev, wl); return err; }