Commit 6e017006 authored by Arnd Bergmann's avatar Arnd Bergmann Committed by Greg Kroah-Hartman

staging: rtl: fix possible NULL pointer dereference

gcc-7 detects that wlanhdr_to_ethhdr() in two drivers calls memcpy() with
a destination argument that an earlier function call may have set to NULL:

staging/rtl8188eu/core/rtw_recv.c: In function 'wlanhdr_to_ethhdr':
staging/rtl8188eu/core/rtw_recv.c:1318:2: warning: argument 1 null where non-null expected [-Wnonnull]
staging/rtl8712/rtl871x_recv.c: In function 'r8712_wlanhdr_to_ethhdr':
staging/rtl8712/rtl871x_recv.c:649:2: warning: argument 1 null where non-null expected [-Wnonnull]

I'm fixing this by adding a NULL pointer check and returning failure
from the function, which is hopefully already handled properly.

This seems to date back to when the drivers were originally added,
so backporting the fix to stable seems appropriate. There are other
related realtek drivers in the kernel, but none of them contain a
function with a similar name or produce this warning.

Cc: stable@vger.kernel.org
Fixes: 1cc18a22 ("staging: r8188eu: Add files for new driver - part 5")
Fixes: 2865d42c ("staging: r8712u: Add the new driver to the mainline kernel")
Signed-off-by: default avatarArnd Bergmann <arnd@arndb.de>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 20fecf37
...@@ -1313,6 +1313,8 @@ static int wlanhdr_to_ethhdr(struct recv_frame *precvframe) ...@@ -1313,6 +1313,8 @@ static int wlanhdr_to_ethhdr(struct recv_frame *precvframe)
pattrib->eth_type = eth_type; pattrib->eth_type = eth_type;
ptr = recvframe_pull(precvframe, (rmv_len-sizeof(struct ethhdr) + (bsnaphdr ? 2 : 0))); ptr = recvframe_pull(precvframe, (rmv_len-sizeof(struct ethhdr) + (bsnaphdr ? 2 : 0)));
if (!ptr)
return _FAIL;
memcpy(ptr, pattrib->dst, ETH_ALEN); memcpy(ptr, pattrib->dst, ETH_ALEN);
memcpy(ptr+ETH_ALEN, pattrib->src, ETH_ALEN); memcpy(ptr+ETH_ALEN, pattrib->src, ETH_ALEN);
......
...@@ -640,11 +640,16 @@ sint r8712_wlanhdr_to_ethhdr(union recv_frame *precvframe) ...@@ -640,11 +640,16 @@ sint r8712_wlanhdr_to_ethhdr(union recv_frame *precvframe)
/* append rx status for mp test packets */ /* append rx status for mp test packets */
ptr = recvframe_pull(precvframe, (rmv_len - ptr = recvframe_pull(precvframe, (rmv_len -
sizeof(struct ethhdr) + 2) - 24); sizeof(struct ethhdr) + 2) - 24);
if (!ptr)
return _FAIL;
memcpy(ptr, get_rxmem(precvframe), 24); memcpy(ptr, get_rxmem(precvframe), 24);
ptr += 24; ptr += 24;
} else } else {
ptr = recvframe_pull(precvframe, (rmv_len - ptr = recvframe_pull(precvframe, (rmv_len -
sizeof(struct ethhdr) + (bsnaphdr ? 2 : 0))); sizeof(struct ethhdr) + (bsnaphdr ? 2 : 0)));
if (!ptr)
return _FAIL;
}
memcpy(ptr, pattrib->dst, ETH_ALEN); memcpy(ptr, pattrib->dst, ETH_ALEN);
memcpy(ptr + ETH_ALEN, pattrib->src, ETH_ALEN); memcpy(ptr + ETH_ALEN, pattrib->src, ETH_ALEN);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment