Re: [PATCH] staging: rtl: fix possible NULL pointer dereference

[Larry Finger]

On 01/11/2017 08:53 AM, Arnd Bergmann wrote:
> gcc-7 detects that wlanhdr_to_ethhdr() in two drivers calls memcpy() with
> a destination argument that an earlier function call may have set to NULL:
>
> staging/rtl8188eu/core/rtw_recv.c: In function 'wlanhdr_to_ethhdr':
> staging/rtl8188eu/core/rtw_recv.c:1318:2: warning: argument 1 null where non-null expected [-Wnonnull]
> staging/rtl8712/rtl871x_recv.c: In function 'r8712_wlanhdr_to_ethhdr':
> staging/rtl8712/rtl871x_recv.c:649:2: warning: argument 1 null where non-null expected [-Wnonnull]
>
> I'm fixing this by adding a NULL pointer check and returning failure
> from the function, which is hopefully already handled properly.
>
> This seems to date back to when the drivers were originally added,
> so backporting the fix to stable seems appropriate. There are other
> related realtek drivers in the kernel, but none of them contain a
> function with a similar name or produce this warning.

Aced-by: Larry Finger <Larry.Finger@xxxxxxxxxxxx>

Arnd,

Please let me now if gcc-7 shows any warnings for the code in 
drivers/net/wireless/realtek/rtlwifi/. My distro supplies gcc-4.8, and it wouod 
be a lot of work to implement gcc-7.

Larry

> Cc: stable@xxxxxxxxxxxxxxx
> Fixes: 1cc18a22b96b ("staging: r8188eu: Add files for new driver - part 5")
> Fixes: 2865d42c78a9 ("staging: r8712u: Add the new driver to the mainline kernel")
> Signed-off-by: Arnd Bergmann <arnd@xxxxxxxx>
> ---
>  drivers/staging/rtl8188eu/core/rtw_recv.c | 2 ++
>  drivers/staging/rtl8712/rtl871x_recv.c    | 7 ++++++-
>  2 files changed, 8 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/staging/rtl8188eu/core/rtw_recv.c b/drivers/staging/rtl8188eu/core/rtw_recv.c
> index 1bc7b97bf2ad..f2021fed704c 100644
> --- a/drivers/staging/rtl8188eu/core/rtw_recv.c
> +++ b/drivers/staging/rtl8188eu/core/rtw_recv.c
> @@ -1313,6 +1313,8 @@ static int wlanhdr_to_ethhdr(struct recv_frame *precvframe)
>  	pattrib->eth_type = eth_type;
>
>  	ptr = recvframe_pull(precvframe, (rmv_len-sizeof(struct ethhdr) + (bsnaphdr ? 2 : 0)));
> +	if (!ptr)
> +		return _FAIL;
>
>  	memcpy(ptr, pattrib->dst, ETH_ALEN);
>  	memcpy(ptr+ETH_ALEN, pattrib->src, ETH_ALEN);
> diff --git a/drivers/staging/rtl8712/rtl871x_recv.c b/drivers/staging/rtl8712/rtl871x_recv.c
> index 4388ddf02b2c..147b75beea73 100644
> --- a/drivers/staging/rtl8712/rtl871x_recv.c
> +++ b/drivers/staging/rtl8712/rtl871x_recv.c
> @@ -640,11 +640,16 @@ sint r8712_wlanhdr_to_ethhdr(union recv_frame *precvframe)
>  		/* append rx status for mp test packets */
>  		ptr = recvframe_pull(precvframe, (rmv_len -
>  		      sizeof(struct ethhdr) + 2) - 24);
> +		if (!ptr)
> +			return _FAIL;
>  		memcpy(ptr, get_rxmem(precvframe), 24);
>  		ptr += 24;
> -	} else
> +	} else {
>  		ptr = recvframe_pull(precvframe, (rmv_len -
>  		      sizeof(struct ethhdr) + (bsnaphdr ? 2 : 0)));
> +		if (!ptr)
> +			return _FAIL;
> +	}
>
>  	memcpy(ptr, pattrib->dst, ETH_ALEN);
>  	memcpy(ptr + ETH_ALEN, pattrib->src, ETH_ALEN);