| Message ID | 20240228063408.7006-1-duoming@zju.edu.cn (mailing list archive) |
|---|---|
| State | Changes Requested |
| Delegated to: | Kalle Valo |
| Headers | show |
| Series | [v2] wifi: brcm80211: handle pmk_op allocation failure | expand |
On 2/28/2024 7:34 AM, Duoming Zhou wrote: > The kzalloc() in brcmf_pmksa_v3_op() will return null if the > physical memory has run out. As a result, if we dereference > the null value, the null pointer dereference bug will happen. > > Return -ENOMEM from brcmf_pmksa_v3_op() if kzalloc() fails > for pmk_op. > > Fixes: a96202acaea4 ("wifi: brcmfmac: cfg80211: Add support for PMKID_V3 operations") Thanks! Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com> > Signed-off-by: Duoming Zhou <duoming@zju.edu.cn> > --- > Changes in v2: > - Drop the new label and just return -ENOMEM. > > drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | 3 +++ > 1 file changed, 3 insertions(+)
On February 27, 2024 10:34:08 PM PST, Duoming Zhou <duoming@zju.edu.cn> wrote: >The kzalloc() in brcmf_pmksa_v3_op() will return null if the >physical memory has run out. As a result, if we dereference >the null value, the null pointer dereference bug will happen. > >Return -ENOMEM from brcmf_pmksa_v3_op() if kzalloc() fails >for pmk_op. > >Fixes: a96202acaea4 ("wifi: brcmfmac: cfg80211: Add support for PMKID_V3 operations") >Signed-off-by: Duoming Zhou <duoming@zju.edu.cn> >--- >Changes in v2: > - Drop the new label and just return -ENOMEM. > > drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | 3 +++ > 1 file changed, 3 insertions(+) > >diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c >index 28d6a30cc01..7af6d6448b9 100644 >--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c >+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c >@@ -4322,6 +4322,9 @@ brcmf_pmksa_v3_op(struct brcmf_if *ifp, struct cfg80211_pmksa *pmksa, > int ret; > > pmk_op = kzalloc(sizeof(*pmk_op), GFP_KERNEL); >+ if (!pmk_op) >+ ret = -ENOMEM; This doesn't fix anything. It doesn't stop the execution path; it'll continue and immediately dereference the NULL pmk_op in the next line... >+ > pmk_op->version = cpu_to_le16(BRCMF_PMKSA_VER_3); > > if (!pmksa) {
On February 28, 2024 3:48:18 PM Kees Cook <kees@kernel.org> wrote: > On February 27, 2024 10:34:08 PM PST, Duoming Zhou <duoming@zju.edu.cn> wrote: >> The kzalloc() in brcmf_pmksa_v3_op() will return null if the >> physical memory has run out. As a result, if we dereference >> the null value, the null pointer dereference bug will happen. >> >> Return -ENOMEM from brcmf_pmksa_v3_op() if kzalloc() fails >> for pmk_op. >> >> Fixes: a96202acaea4 ("wifi: brcmfmac: cfg80211: Add support for PMKID_V3 >> operations") >> Signed-off-by: Duoming Zhou <duoming@zju.edu.cn> >> --- >> Changes in v2: >> - Drop the new label and just return -ENOMEM. >> >> drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | 3 +++ >> 1 file changed, 3 insertions(+) >> >> diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c >> b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c >> index 28d6a30cc01..7af6d6448b9 100644 >> --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c >> +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c >> @@ -4322,6 +4322,9 @@ brcmf_pmksa_v3_op(struct brcmf_if *ifp, struct >> cfg80211_pmksa *pmksa, >> int ret; >> >> pmk_op = kzalloc(sizeof(*pmk_op), GFP_KERNEL); >> + if (!pmk_op) >> + ret = -ENOMEM; > > This doesn't fix anything. It doesn't stop the execution path; it'll > continue and immediately dereference the NULL pmk_op in the next line... Crap. Do I look bad :-( Thanks for catching my blunder. I was seeing what I wanted to see I guess. Regards, Arend > >> + >> pmk_op->version = cpu_to_le16(BRCMF_PMKSA_VER_3); >> >> if (!pmksa) { > > -- > Kees Cook
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c index 28d6a30cc01..7af6d6448b9 100644 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c @@ -4322,6 +4322,9 @@ brcmf_pmksa_v3_op(struct brcmf_if *ifp, struct cfg80211_pmksa *pmksa, int ret; pmk_op = kzalloc(sizeof(*pmk_op), GFP_KERNEL); + if (!pmk_op) + ret = -ENOMEM; + pmk_op->version = cpu_to_le16(BRCMF_PMKSA_VER_3); if (!pmksa) {
The kzalloc() in brcmf_pmksa_v3_op() will return null if the physical memory has run out. As a result, if we dereference the null value, the null pointer dereference bug will happen. Return -ENOMEM from brcmf_pmksa_v3_op() if kzalloc() fails for pmk_op. Fixes: a96202acaea4 ("wifi: brcmfmac: cfg80211: Add support for PMKID_V3 operations") Signed-off-by: Duoming Zhou <duoming@zju.edu.cn> --- Changes in v2: - Drop the new label and just return -ENOMEM. drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | 3 +++ 1 file changed, 3 insertions(+)