Skip to contentSkip to conversation

qtnfmac: fix NULL pointer dereference

PATCH In review Gustavo A. R. Silva 3 participants 5 messages Jun 1, 2018 – Jun 18, 2018

Subsystems (4)
Networking Network drivers Kernel janitors Quantenna qtnfmac wireless driver
lore
Share & tools
lore

Gustavo A. R. Silva

author
#0 lore raw

PATCH 1/1 qtnfmac: fix NULL pointer dereference

In case *vif* is NULL at 655: if (!vif), the execution path jumps to label out, where *vif* is dereferenced at 679:

if (vif->sta_state = QTNF_STA_CONNECTING)

Fix this by immediately returning when *vif* is NULL instead of jumping to label out.

Addresses-Coverity-ID: 1469567 ("Dereference after null check")

Fixes 480daa9cb62c ("qtnfmac: fix invalid STA state on EAPOL failure")
Signed-off-by Gustavo A. R. Silva <[email protected]>
---
 drivers/net/wireless/quantenna/qtnfmac/cfg80211.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/net/wireless/quantenna/qtnfmac/cfg80211.c +1 -2
index 220e2b7..ae0ca80 100644
@@ -654,8 +654,7 @@ qtnf_disconnect(struct wiphy *wiphy, struct net_device *dev,
 	vif = qtnf_mac_get_base_vif(mac);
 	if (!vif) {
 		pr_err("MAC%u: primary VIF is not configured\n", mac->macid);
-		ret = -EFAULT;
-		goto out;
+		return -EFAULT;
 	}
 
 	if (vif->wdev.iftype != NL80211_IFTYPE_STATION) {
Signature · 1 line
2.7.4
Reviewed-by on v1 1/1
#1 lore raw

Hello Gustavo,

Quoted 5 lines
drivers/net/wireless/quantenna/qtnfmac/cfg80211.c +0 -0
index 220e2b7..ae0ca80 100644

drivers/net/wireless/quantenna/qtnfmac/cfg80211.c qtnf_disconnect(struct wiphy *wiphy, struct net_device *dev, · line 660

Quoted 9 lines
drivers/net/wireless/quantenna/qtnfmac/cfg80211.c +1 -2
@@ -654,8 +654,7 @@ qtnf_disconnect(struct wiphy *wiphy, struct net_device *dev,
        vif = qtnf_mac_get_base_vif(mac);
        if (!vif) {
                pr_err("MAC%u: primary VIF is not configured\n", mac->macid);
-               ret = -EFAULT;
-               goto out;
+               return -EFAULT;
        }
 
        if (vif->wdev.iftype != NL80211_IFTYPE_STATION) {

That was my fault. Thanks for the fix!

Reviewed-by Sergey Matyukevich <[email protected]>

Regards,
Sergey

author
#2 lore raw

Hi Sergey,

Quoted 15 lines · Sergey Matyukevich

Hello Gustavo,

Quoted 13 lines
drivers/net/wireless/quantenna/qtnfmac/cfg80211.c +1 -2
index 220e2b7..ae0ca80 100644
@@ -654,8 +654,7 @@ qtnf_disconnect(struct wiphy *wiphy, struct net_device *dev,
         vif = qtnf_mac_get_base_vif(mac);
         if (!vif) {
                 pr_err("MAC%u: primary VIF is not configured\n", mac->macid);
-               ret = -EFAULT;
-               goto out;
+               return -EFAULT;
         }
Quoted 4 lines

drivers/net/wireless/quantenna/qtnfmac/cfg80211.c qtnf_disconnect(struct wiphy *wiphy, struct net_device *dev, · line 660

Quoted 1 line
drivers/net/wireless/quantenna/qtnfmac/cfg80211.c +0 -0
         if (vif->wdev.iftype != NL80211_IFTYPE_STATION) {

That was my fault. Thanks for the fix!

Glad to help. :)

Quoted 2 lines
Reviewed-by Sergey Matyukevich <[email protected]>

Thanks
--
Gustavo

#3 lore raw
In reply to Gustavo A. R. Silva
Quoted 11 lines · Gustavo A. R. Silva

In case *vif* is NULL at 655: if (!vif), the execution path jumps to label out, where *vif* is dereferenced at 679:

if (vif->sta_state = QTNF_STA_CONNECTING)

Fix this by immediately returning when *vif* is NULL instead of jumping to label out.

Addresses-Coverity-ID: 1469567 ("Dereference after null check")

Fixes 480daa9cb62c ("qtnfmac: fix invalid STA state on EAPOL failure")
Signed-off-by Gustavo A. R. Silva <[email protected]>

As commit 480daa9cb62c was recently applied to wireless-drivers-next I'll queue this to 4.18.

Signature · 1 line
Kalle Valo
#4 lore raw
In reply to Gustavo A. R. Silva
Quoted 5 lines · Gustavo A. R. Silva

In case *vif* is NULL at 655: if (!vif), the execution path jumps to label out, where *vif* is dereferenced at 679:

if (vif->sta_state = QTNF_STA_CONNECTING)

Quoted 7 lines

Fix this by immediately returning when *vif* is NULL instead of jumping to label out.

Addresses-Coverity-ID: 1469567 ("Dereference after null check")

Fixes 480daa9cb62c ("qtnfmac: fix invalid STA state on EAPOL failure")
Signed-off-by Gustavo A. R. Silva <[email protected]>
Reviewed-by Sergey Matyukevich <[email protected]>

Patch applied to wireless-drivers.git, thanks.

c1e3f64f8738 qtnfmac: fix NULL pointer dereference

Signature · 3 lines
https://patchwork.kernel.org/patch/10443507/

https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches