Re: [PATCH 082/190] Revert "rsi: Fix NULL pointer dereference in kmalloc"

[Greg Kroah-Hartman]

On Wed, Apr 21, 2021 at 02:59:17PM +0200, Greg Kroah-Hartman wrote:
> This reverts commit d5414c2355b20ea8201156d2e874265f1cb0d775.
> 
> Commits from @umn.edu addresses have been found to be submitted in "bad
> faith" to try to test the kernel community's ability to review "known
> malicious" changes.  The result of these submissions can be found in a
> paper published at the 42nd IEEE Symposium on Security and Privacy
> entitled, "Open Source Insecurity: Stealthily Introducing
> Vulnerabilities via Hypocrite Commits" written by Qiushi Wu (University
> of Minnesota) and Kangjie Lu (University of Minnesota).
> 
> Because of this, all submissions from this group must be reverted from
> the kernel tree and will need to be re-reviewed again to determine if
> they actually are a valid fix.  Until that work is complete, remove this
> change to ensure that no problems are being introduced into the
> codebase.
> 
> Cc: Aditya Pakki <pakki001@xxxxxxx>
> Cc: Kalle Valo <kvalo@xxxxxxxxxxxxxx>
> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
> ---
>  drivers/net/wireless/rsi/rsi_91x_mac80211.c | 30 +++++++++------------
>  1 file changed, 12 insertions(+), 18 deletions(-)
> 
> diff --git a/drivers/net/wireless/rsi/rsi_91x_mac80211.c b/drivers/net/wireless/rsi/rsi_91x_mac80211.c
> index 16025300cddb..714d4d53236c 100644
> --- a/drivers/net/wireless/rsi/rsi_91x_mac80211.c
> +++ b/drivers/net/wireless/rsi/rsi_91x_mac80211.c
> @@ -188,27 +188,27 @@ bool rsi_is_cipher_wep(struct rsi_common *common)
>   * @adapter: Pointer to the adapter structure.
>   * @band: Operating band to be set.
>   *
> - * Return: int - 0 on success, negative error on failure.
> + * Return: None.
>   */
> -static int rsi_register_rates_channels(struct rsi_hw *adapter, int band)
> +static void rsi_register_rates_channels(struct rsi_hw *adapter, int band)
>  {
>  	struct ieee80211_supported_band *sbands = &adapter->sbands[band];
>  	void *channels = NULL;
>  
>  	if (band == NL80211_BAND_2GHZ) {
> -		channels = kmemdup(rsi_2ghz_channels, sizeof(rsi_2ghz_channels),
> -				   GFP_KERNEL);
> -		if (!channels)
> -			return -ENOMEM;
> +		channels = kmalloc(sizeof(rsi_2ghz_channels), GFP_KERNEL);
> +		memcpy(channels,
> +		       rsi_2ghz_channels,
> +		       sizeof(rsi_2ghz_channels));
>  		sbands->band = NL80211_BAND_2GHZ;
>  		sbands->n_channels = ARRAY_SIZE(rsi_2ghz_channels);
>  		sbands->bitrates = rsi_rates;
>  		sbands->n_bitrates = ARRAY_SIZE(rsi_rates);
>  	} else {
> -		channels = kmemdup(rsi_5ghz_channels, sizeof(rsi_5ghz_channels),
> -				   GFP_KERNEL);
> -		if (!channels)
> -			return -ENOMEM;
> +		channels = kmalloc(sizeof(rsi_5ghz_channels), GFP_KERNEL);
> +		memcpy(channels,
> +		       rsi_5ghz_channels,
> +		       sizeof(rsi_5ghz_channels));
>  		sbands->band = NL80211_BAND_5GHZ;
>  		sbands->n_channels = ARRAY_SIZE(rsi_5ghz_channels);
>  		sbands->bitrates = &rsi_rates[4];
> @@ -227,7 +227,6 @@ static int rsi_register_rates_channels(struct rsi_hw *adapter, int band)
>  	sbands->ht_cap.mcs.rx_mask[0] = 0xff;
>  	sbands->ht_cap.mcs.tx_params = IEEE80211_HT_MCS_TX_DEFINED;
>  	/* sbands->ht_cap.mcs.rx_highest = 0x82; */
> -	return 0;
>  }
>  
>  static int rsi_mac80211_hw_scan_start(struct ieee80211_hw *hw,
> @@ -2067,16 +2066,11 @@ int rsi_mac80211_attach(struct rsi_common *common)
>  	wiphy->available_antennas_rx = 1;
>  	wiphy->available_antennas_tx = 1;
>  
> -	status = rsi_register_rates_channels(adapter, NL80211_BAND_2GHZ);
> -	if (status)
> -		return status;
> +	rsi_register_rates_channels(adapter, NL80211_BAND_2GHZ);
>  	wiphy->bands[NL80211_BAND_2GHZ] =
>  		&adapter->sbands[NL80211_BAND_2GHZ];
>  	if (common->num_supp_bands > 1) {
> -		status = rsi_register_rates_channels(adapter,
> -						     NL80211_BAND_5GHZ);
> -		if (status)
> -			return status;
> +		rsi_register_rates_channels(adapter, NL80211_BAND_5GHZ);
>  		wiphy->bands[NL80211_BAND_5GHZ] =
>  			&adapter->sbands[NL80211_BAND_5GHZ];
>  	}
> -- 
> 2.31.1
> 

This looks correct, will drop the revert.

greg k-h