lkml.org 
[lkml]   [2020]   [Apr]   [6]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Date
    SubjectRe: [PATCH] iwlwifi: actually check allocated conf_tlv pointer
    On Mon, Apr 6, 2020 at 4:11 PM Kalle Valo <kvalo@codeaurora.org> wrote:
    >
    > Chris Rorvick <chris@rorvick.com> wrote:
    >
    > > Commit 71bc0334a637 ("iwlwifi: check allocated pointer when allocating
    > > conf_tlvs") attempted to fix a typoe introduced by commit 17b809c9b22e
    > > ("iwlwifi: dbg: move debug data to a struct") but does not implement the
    > > check correctly.
    > >
    > > This can happen in OOM situations and, when it does, we will potentially try to
    > > dereference a NULL pointer.
    > >
    > > Tweeted-by: @grsecurity
    > > Signed-off-by: Chris Rorvick <chris@rorvick.com>
    >
    > Fails to build, please rebase on top of wireless-drivers.
    >
    > drivers/net/wireless/intel/iwlwifi/iwl-drv.c: In function 'iwl_req_fw_callback':
    > drivers/net/wireless/intel/iwlwifi/iwl-drv.c:1470:16: error: 'struct iwl_fw' has no member named 'dbg_conf_tlv'
    > if (!drv->fw.dbg_conf_tlv[i])
    > ^
    > make[5]: *** [drivers/net/wireless/intel/iwlwifi/iwl-drv.o] Error 1
    > make[5]: *** Waiting for unfinished jobs....
    > make[4]: *** [drivers/net/wireless/intel/iwlwifi] Error 2
    > make[3]: *** [drivers/net/wireless/intel] Error 2
    > make[2]: *** [drivers/net/wireless] Error 2
    > make[1]: *** [drivers/net] Error 2
    > make[1]: *** Waiting for unfinished jobs....
    > make: *** [drivers] Error 2
    >

    Should be:

    $ git diff
    diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-drv.c
    b/drivers/net/wireless/intel/iwlwifi/iwl-drv.c
    index 0481796f75bc..c24350222133 100644
    --- a/drivers/net/wireless/intel/iwlwifi/iwl-drv.c
    +++ b/drivers/net/wireless/intel/iwlwifi/iwl-drv.c
    @@ -1467,7 +1467,7 @@ static void iwl_req_fw_callback(const struct
    firmware *ucode_raw, void *context)
    kmemdup(pieces->dbg_conf_tlv[i],
    pieces->dbg_conf_tlv_len[i],
    GFP_KERNEL);
    - if (!pieces->dbg_conf_tlv[i])
    + if (!drv->fw.dbg.conf_tlv[i])
    goto out_free_fw;
    }
    }
    "fw.dbg.conf" with a dot not underscore.

    - Sedat -



    > Patch set to Changes Requested.
    >
    > --
    > https://patchwork.kernel.org/patch/11470125/
    >
    > https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches

    \
     
     \ /
      Last update: 2020-04-06 21:54    [W:4.817 / U:0.920 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site