| Message ID | 20241003180959.12158-1-zichenxie0106@gmail.com (mailing list archive) |
|---|---|
| State | New |
| Headers | show |
| Series | [v5] wifi: mt76: Fix NULL Dereference caused by mt76_connac_get_he_phy_cap() | expand |
> mt76_connac_get_he_phy_cap() may return a NULL pointer, > leading to NULL Pointer Dereference. … multiple questionable accesses? How do you think about to use the term “null pointer dereference” for the final commit message (including the summary phrase)? Were any static source code analysis tools involved in the detection of presented change possibilities? … > --- > drivers/net/wireless/mediatek/mt76/mt7915/mcu.c | 5 +++++ … Did you overlook to add patch version descriptions behind the marker line? https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/Documentation/process/submitting-patches.rst?h=v6.12-rc1#n723 Regards, Markus
On 03/10/2024 20:09, Gax-c wrote: > From: Zichen Xie <zichenxie0106@gmail.com> > > mt76_connac_get_he_phy_cap() may return a NULL pointer, > leading to NULL Pointer Dereference. > Add a NULL check for the returned pointer. > > Fixes: a5c372f77aa7 ("wifi: mt76: mt7925: extend mt7925_mcu_bss_he_tlv for per-link BSS") > Fixes: e6d557a78b60 ("mt76: mt7915: rely on mt76_connac_get_phy utilities") > Fixes: 98686cd21624 ("wifi: mt76: mt7996: add driver for MediaTek Wi-Fi 7 (802.11be) devices") > Signed-off-by: Zichen Xie <zichenxie0106@gmail.com> > --- > drivers/net/wireless/mediatek/mt76/mt7915/mcu.c | 5 +++++ > drivers/net/wireless/mediatek/mt76/mt7925/mcu.c | 2 ++ > drivers/net/wireless/mediatek/mt76/mt7996/mcu.c | 2 ++ > 3 files changed, 9 insertions(+) > > diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c > index 87d0dd040001..762be3a37228 100644 > --- a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c > +++ b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c > @@ -551,6 +551,8 @@ mt7915_mcu_bss_he_tlv(struct sk_buff *skb, struct ieee80211_vif *vif, > struct tlv *tlv; > > cap = mt76_connac_get_he_phy_cap(phy->mt76, vif); > + if (!cap) > + return; > > tlv = mt76_connac_mcu_add_tlv(skb, BSS_INFO_HE_BASIC, sizeof(*he)); > > @@ -1145,6 +1147,9 @@ mt7915_mcu_sta_bfer_he(struct ieee80211_sta *sta, struct ieee80211_vif *vif, > u8 nss_mcs = mt7915_mcu_get_sta_nss(mcs_map); > u8 snd_dim, sts; > > + if (!vc) > + return; > + That will already blow up at line: const struct ieee80211_he_cap_elem *ve = &vc->he_cap_elem; This needs some more code changes. Regards, Matthias > bf->tx_mode = MT_PHY_TYPE_HE_SU; > > mt7915_mcu_sta_sounding_rate(bf); > diff --git a/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c > index 748ea6adbc6b..55e4cda2f20f 100644 > --- a/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c > +++ b/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c > @@ -2508,6 +2508,8 @@ mt7925_mcu_bss_he_tlv(struct sk_buff *skb, struct ieee80211_bss_conf *link_conf, > struct tlv *tlv; > > cap = mt76_connac_get_he_phy_cap(phy->mt76, link_conf->vif); > + if (!cap) > + return; > > tlv = mt76_connac_mcu_add_tlv(skb, UNI_BSS_INFO_HE_BASIC, sizeof(*he)); > > diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c > index 6c445a9dbc03..55bb2d0e67e5 100644 > --- a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c > +++ b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c > @@ -798,6 +798,8 @@ mt7996_mcu_bss_he_tlv(struct sk_buff *skb, struct ieee80211_vif *vif, > struct tlv *tlv; > > cap = mt76_connac_get_he_phy_cap(phy->mt76, vif); > + if (!cap) > + return; > > tlv = mt7996_mcu_add_uni_tlv(skb, UNI_BSS_INFO_HE_BASIC, sizeof(*he)); >
IMHO, using operator "&" for a NULL dereferenced pointer won't cause a crash. 've' will only be assigned to a invalid address. So we can put off the NULL check after 'const struct ieee80211_he_cap_elem *ve = &vc->he_cap_elem;' Best Regards, Zichen On Mon, Oct 7, 2024 at 9:23 AM Matthias Brugger <matthias.bgg@gmail.com> wrote: > > > > On 03/10/2024 20:09, Gax-c wrote: > > From: Zichen Xie <zichenxie0106@gmail.com> > > > > mt76_connac_get_he_phy_cap() may return a NULL pointer, > > leading to NULL Pointer Dereference. > > Add a NULL check for the returned pointer. > > > > Fixes: a5c372f77aa7 ("wifi: mt76: mt7925: extend mt7925_mcu_bss_he_tlv for per-link BSS") > > Fixes: e6d557a78b60 ("mt76: mt7915: rely on mt76_connac_get_phy utilities") > > Fixes: 98686cd21624 ("wifi: mt76: mt7996: add driver for MediaTek Wi-Fi 7 (802.11be) devices") > > Signed-off-by: Zichen Xie <zichenxie0106@gmail.com> > > --- > > drivers/net/wireless/mediatek/mt76/mt7915/mcu.c | 5 +++++ > > drivers/net/wireless/mediatek/mt76/mt7925/mcu.c | 2 ++ > > drivers/net/wireless/mediatek/mt76/mt7996/mcu.c | 2 ++ > > 3 files changed, 9 insertions(+) > > > > diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c > > index 87d0dd040001..762be3a37228 100644 > > --- a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c > > +++ b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c > > @@ -551,6 +551,8 @@ mt7915_mcu_bss_he_tlv(struct sk_buff *skb, struct ieee80211_vif *vif, > > struct tlv *tlv; > > > > cap = mt76_connac_get_he_phy_cap(phy->mt76, vif); > > + if (!cap) > > + return; > > > > tlv = mt76_connac_mcu_add_tlv(skb, BSS_INFO_HE_BASIC, sizeof(*he)); > > > > @@ -1145,6 +1147,9 @@ mt7915_mcu_sta_bfer_he(struct ieee80211_sta *sta, struct ieee80211_vif *vif, > > u8 nss_mcs = mt7915_mcu_get_sta_nss(mcs_map); > > u8 snd_dim, sts; > > > > + if (!vc) > > + return; > > + > > That will already blow up at line: > const struct ieee80211_he_cap_elem *ve = &vc->he_cap_elem; > > This needs some more code changes. > > Regards, > Matthias > > > bf->tx_mode = MT_PHY_TYPE_HE_SU; > > > > mt7915_mcu_sta_sounding_rate(bf); > > diff --git a/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c > > index 748ea6adbc6b..55e4cda2f20f 100644 > > --- a/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c > > +++ b/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c > > @@ -2508,6 +2508,8 @@ mt7925_mcu_bss_he_tlv(struct sk_buff *skb, struct ieee80211_bss_conf *link_conf, > > struct tlv *tlv; > > > > cap = mt76_connac_get_he_phy_cap(phy->mt76, link_conf->vif); > > + if (!cap) > > + return; > > > > tlv = mt76_connac_mcu_add_tlv(skb, UNI_BSS_INFO_HE_BASIC, sizeof(*he)); > > > > diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c > > index 6c445a9dbc03..55bb2d0e67e5 100644 > > --- a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c > > +++ b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c > > @@ -798,6 +798,8 @@ mt7996_mcu_bss_he_tlv(struct sk_buff *skb, struct ieee80211_vif *vif, > > struct tlv *tlv; > > > > cap = mt76_connac_get_he_phy_cap(phy->mt76, vif); > > + if (!cap) > > + return; > > > > tlv = mt7996_mcu_add_uni_tlv(skb, UNI_BSS_INFO_HE_BASIC, sizeof(*he)); > >
On 07/10/2024 17:36, Zichen Xie wrote: > IMHO, using operator "&" for a NULL dereferenced pointer won't cause a > crash. 've' will only be assigned to a invalid address. > Please don't top post. > So we can put off the NULL check after > 'const struct ieee80211_he_cap_elem *ve = &vc->he_cap_elem;' > You are right, nevertheless for better code readability I'd still advise to change the code so that vc is checked for NULL before any use of struct vc. Regards, Matthias > Best Regards, > Zichen > > On Mon, Oct 7, 2024 at 9:23 AM Matthias Brugger <matthias.bgg@gmail.com> wrote: >> >> >> >> On 03/10/2024 20:09, Gax-c wrote: >>> From: Zichen Xie <zichenxie0106@gmail.com> >>> >>> mt76_connac_get_he_phy_cap() may return a NULL pointer, >>> leading to NULL Pointer Dereference. >>> Add a NULL check for the returned pointer. >>> >>> Fixes: a5c372f77aa7 ("wifi: mt76: mt7925: extend mt7925_mcu_bss_he_tlv for per-link BSS") >>> Fixes: e6d557a78b60 ("mt76: mt7915: rely on mt76_connac_get_phy utilities") >>> Fixes: 98686cd21624 ("wifi: mt76: mt7996: add driver for MediaTek Wi-Fi 7 (802.11be) devices") >>> Signed-off-by: Zichen Xie <zichenxie0106@gmail.com> >>> --- >>> drivers/net/wireless/mediatek/mt76/mt7915/mcu.c | 5 +++++ >>> drivers/net/wireless/mediatek/mt76/mt7925/mcu.c | 2 ++ >>> drivers/net/wireless/mediatek/mt76/mt7996/mcu.c | 2 ++ >>> 3 files changed, 9 insertions(+) >>> >>> diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c >>> index 87d0dd040001..762be3a37228 100644 >>> --- a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c >>> +++ b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c >>> @@ -551,6 +551,8 @@ mt7915_mcu_bss_he_tlv(struct sk_buff *skb, struct ieee80211_vif *vif, >>> struct tlv *tlv; >>> >>> cap = mt76_connac_get_he_phy_cap(phy->mt76, vif); >>> + if (!cap) >>> + return; >>> >>> tlv = mt76_connac_mcu_add_tlv(skb, BSS_INFO_HE_BASIC, sizeof(*he)); >>> >>> @@ -1145,6 +1147,9 @@ mt7915_mcu_sta_bfer_he(struct ieee80211_sta *sta, struct ieee80211_vif *vif, >>> u8 nss_mcs = mt7915_mcu_get_sta_nss(mcs_map); >>> u8 snd_dim, sts; >>> >>> + if (!vc) >>> + return; >>> + >> >> That will already blow up at line: >> const struct ieee80211_he_cap_elem *ve = &vc->he_cap_elem; >> >> This needs some more code changes. >> >> Regards, >> Matthias >> >>> bf->tx_mode = MT_PHY_TYPE_HE_SU; >>> >>> mt7915_mcu_sta_sounding_rate(bf); >>> diff --git a/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c >>> index 748ea6adbc6b..55e4cda2f20f 100644 >>> --- a/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c >>> +++ b/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c >>> @@ -2508,6 +2508,8 @@ mt7925_mcu_bss_he_tlv(struct sk_buff *skb, struct ieee80211_bss_conf *link_conf, >>> struct tlv *tlv; >>> >>> cap = mt76_connac_get_he_phy_cap(phy->mt76, link_conf->vif); >>> + if (!cap) >>> + return; >>> >>> tlv = mt76_connac_mcu_add_tlv(skb, UNI_BSS_INFO_HE_BASIC, sizeof(*he)); >>> >>> diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c >>> index 6c445a9dbc03..55bb2d0e67e5 100644 >>> --- a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c >>> +++ b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c >>> @@ -798,6 +798,8 @@ mt7996_mcu_bss_he_tlv(struct sk_buff *skb, struct ieee80211_vif *vif, >>> struct tlv *tlv; >>> >>> cap = mt76_connac_get_he_phy_cap(phy->mt76, vif); >>> + if (!cap) >>> + return; >>> >>> tlv = mt7996_mcu_add_uni_tlv(skb, UNI_BSS_INFO_HE_BASIC, sizeof(*he)); >>>
On 2024/10/7 14:13, Matthias Brugger wrote: > > > On 07/10/2024 17:36, Zichen Xie wrote: >> IMHO, using operator "&" for a NULL dereferenced pointer won't cause a >> crash. 've' will only be assigned to a invalid address. >> > > Please don't top post. > >> So we can put off the NULL check after >> 'const struct ieee80211_he_cap_elem *ve = &vc->he_cap_elem;' >> > > You are right, nevertheless for better code readability I'd still > advise to change the code so that vc is checked for NULL before any > use of struct vc. The code snippets here does the same thing like me. https://elixir.bootlin.com/linux/v6.12-rc2/source/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c#L1547 Should I also repair it for readability? > > Regards, > Matthias > >> Best Regards, >> Zichen >> >> On Mon, Oct 7, 2024 at 9:23 AM Matthias Brugger >> <matthias.bgg@gmail.com> wrote: >>> >>> >>> >>> On 03/10/2024 20:09, Gax-c wrote: >>>> From: Zichen Xie <zichenxie0106@gmail.com> >>>> >>>> mt76_connac_get_he_phy_cap() may return a NULL pointer, >>>> leading to NULL Pointer Dereference. >>>> Add a NULL check for the returned pointer. >>>> >>>> Fixes: a5c372f77aa7 ("wifi: mt76: mt7925: extend >>>> mt7925_mcu_bss_he_tlv for per-link BSS") >>>> Fixes: e6d557a78b60 ("mt76: mt7915: rely on mt76_connac_get_phy >>>> utilities") >>>> Fixes: 98686cd21624 ("wifi: mt76: mt7996: add driver for MediaTek >>>> Wi-Fi 7 (802.11be) devices") >>>> Signed-off-by: Zichen Xie <zichenxie0106@gmail.com> >>>> --- >>>> drivers/net/wireless/mediatek/mt76/mt7915/mcu.c | 5 +++++ >>>> drivers/net/wireless/mediatek/mt76/mt7925/mcu.c | 2 ++ >>>> drivers/net/wireless/mediatek/mt76/mt7996/mcu.c | 2 ++ >>>> 3 files changed, 9 insertions(+) >>>> >>>> diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c >>>> b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c >>>> index 87d0dd040001..762be3a37228 100644 >>>> --- a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c >>>> +++ b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c >>>> @@ -551,6 +551,8 @@ mt7915_mcu_bss_he_tlv(struct sk_buff *skb, >>>> struct ieee80211_vif *vif, >>>> struct tlv *tlv; >>>> >>>> cap = mt76_connac_get_he_phy_cap(phy->mt76, vif); >>>> + if (!cap) >>>> + return; >>>> >>>> tlv = mt76_connac_mcu_add_tlv(skb, BSS_INFO_HE_BASIC, >>>> sizeof(*he)); >>>> >>>> @@ -1145,6 +1147,9 @@ mt7915_mcu_sta_bfer_he(struct ieee80211_sta >>>> *sta, struct ieee80211_vif *vif, >>>> u8 nss_mcs = mt7915_mcu_get_sta_nss(mcs_map); >>>> u8 snd_dim, sts; >>>> >>>> + if (!vc) >>>> + return; >>>> + >>> >>> That will already blow up at line: >>> const struct ieee80211_he_cap_elem *ve = &vc->he_cap_elem; >>> >>> This needs some more code changes. >>> >>> Regards, >>> Matthias >>> >>>> bf->tx_mode = MT_PHY_TYPE_HE_SU; >>>> >>>> mt7915_mcu_sta_sounding_rate(bf); >>>> diff --git a/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c >>>> b/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c >>>> index 748ea6adbc6b..55e4cda2f20f 100644 >>>> --- a/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c >>>> +++ b/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c >>>> @@ -2508,6 +2508,8 @@ mt7925_mcu_bss_he_tlv(struct sk_buff *skb, >>>> struct ieee80211_bss_conf *link_conf, >>>> struct tlv *tlv; >>>> >>>> cap = mt76_connac_get_he_phy_cap(phy->mt76, link_conf->vif); >>>> + if (!cap) >>>> + return; >>>> >>>> tlv = mt76_connac_mcu_add_tlv(skb, UNI_BSS_INFO_HE_BASIC, >>>> sizeof(*he)); >>>> >>>> diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c >>>> b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c >>>> index 6c445a9dbc03..55bb2d0e67e5 100644 >>>> --- a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c >>>> +++ b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c >>>> @@ -798,6 +798,8 @@ mt7996_mcu_bss_he_tlv(struct sk_buff *skb, >>>> struct ieee80211_vif *vif, >>>> struct tlv *tlv; >>>> >>>> cap = mt76_connac_get_he_phy_cap(phy->mt76, vif); >>>> + if (!cap) >>>> + return; >>>> >>>> tlv = mt7996_mcu_add_uni_tlv(skb, UNI_BSS_INFO_HE_BASIC, >>>> sizeof(*he)); >>>>
diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c index 87d0dd040001..762be3a37228 100644 --- a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c +++ b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c @@ -551,6 +551,8 @@ mt7915_mcu_bss_he_tlv(struct sk_buff *skb, struct ieee80211_vif *vif, struct tlv *tlv; cap = mt76_connac_get_he_phy_cap(phy->mt76, vif); + if (!cap) + return; tlv = mt76_connac_mcu_add_tlv(skb, BSS_INFO_HE_BASIC, sizeof(*he)); @@ -1145,6 +1147,9 @@ mt7915_mcu_sta_bfer_he(struct ieee80211_sta *sta, struct ieee80211_vif *vif, u8 nss_mcs = mt7915_mcu_get_sta_nss(mcs_map); u8 snd_dim, sts; + if (!vc) + return; + bf->tx_mode = MT_PHY_TYPE_HE_SU; mt7915_mcu_sta_sounding_rate(bf); diff --git a/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c index 748ea6adbc6b..55e4cda2f20f 100644 --- a/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c +++ b/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c @@ -2508,6 +2508,8 @@ mt7925_mcu_bss_he_tlv(struct sk_buff *skb, struct ieee80211_bss_conf *link_conf, struct tlv *tlv; cap = mt76_connac_get_he_phy_cap(phy->mt76, link_conf->vif); + if (!cap) + return; tlv = mt76_connac_mcu_add_tlv(skb, UNI_BSS_INFO_HE_BASIC, sizeof(*he)); diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c index 6c445a9dbc03..55bb2d0e67e5 100644 --- a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c +++ b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c @@ -798,6 +798,8 @@ mt7996_mcu_bss_he_tlv(struct sk_buff *skb, struct ieee80211_vif *vif, struct tlv *tlv; cap = mt76_connac_get_he_phy_cap(phy->mt76, vif); + if (!cap) + return; tlv = mt7996_mcu_add_uni_tlv(skb, UNI_BSS_INFO_HE_BASIC, sizeof(*he));