| Message ID | 20191001120823.29853-1-efremov@linux.com (mailing list archive) |
|---|---|
| State | Accepted |
| Commit | 2c840676be8ffc624bf9bb4490d944fd13c02d71 |
| Delegated to: | Kalle Valo |
| Headers | show |
| Series | wil6210: check len before memcpy() calls | expand |
Denis Efremov <efremov@linux.com> wrote: > memcpy() in wmi_set_ie() and wmi_update_ft_ies() is called with > src == NULL and len == 0. This is an undefined behavior. Fix it > by checking "ie_len > 0" before the memcpy() calls. > > As suggested by GCC documentation: > "The pointers passed to memmove (and similar functions in <string.h>) > must be non-null even when nbytes==0, so GCC can use that information > to remove the check after the memmove call." [1] > > [1] https://gcc.gnu.org/gcc-4.9/porting_to.html > > Cc: Maya Erez <merez@codeaurora.org> > Cc: Kalle Valo <kvalo@codeaurora.org> > Cc: "David S. Miller" <davem@davemloft.net> > Cc: stable@vger.kernel.org > Signed-off-by: Denis Efremov <efremov@linux.com> > Signed-off-by: Kalle Valo <kvalo@codeaurora.org> Patch applied to ath-next branch of ath.git, thanks. 2c840676be8f wil6210: check len before memcpy() calls
diff --git a/drivers/net/wireless/ath/wil6210/wmi.c b/drivers/net/wireless/ath/wil6210/wmi.c index 153b84447e40..41389c1eb252 100644 --- a/drivers/net/wireless/ath/wil6210/wmi.c +++ b/drivers/net/wireless/ath/wil6210/wmi.c @@ -2505,7 +2505,8 @@ int wmi_set_ie(struct wil6210_vif *vif, u8 type, u16 ie_len, const void *ie) cmd->mgmt_frm_type = type; /* BUG: FW API define ieLen as u8. Will fix FW */ cmd->ie_len = cpu_to_le16(ie_len); - memcpy(cmd->ie_info, ie, ie_len); + if (ie_len) + memcpy(cmd->ie_info, ie, ie_len); rc = wmi_send(wil, WMI_SET_APPIE_CMDID, vif->mid, cmd, len); kfree(cmd); out: @@ -2541,7 +2542,8 @@ int wmi_update_ft_ies(struct wil6210_vif *vif, u16 ie_len, const void *ie) } cmd->ie_len = cpu_to_le16(ie_len); - memcpy(cmd->ie_info, ie, ie_len); + if (ie_len) + memcpy(cmd->ie_info, ie, ie_len); rc = wmi_send(wil, WMI_UPDATE_FT_IES_CMDID, vif->mid, cmd, len); kfree(cmd);
memcpy() in wmi_set_ie() and wmi_update_ft_ies() is called with src == NULL and len == 0. This is an undefined behavior. Fix it by checking "ie_len > 0" before the memcpy() calls. As suggested by GCC documentation: "The pointers passed to memmove (and similar functions in <string.h>) must be non-null even when nbytes==0, so GCC can use that information to remove the check after the memmove call." [1] [1] https://gcc.gnu.org/gcc-4.9/porting_to.html Cc: Maya Erez <merez@codeaurora.org> Cc: Kalle Valo <kvalo@codeaurora.org> Cc: "David S. Miller" <davem@davemloft.net> Cc: stable@vger.kernel.org Signed-off-by: Denis Efremov <efremov@linux.com> --- drivers/net/wireless/ath/wil6210/wmi.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)