Message ID | 20220218163045.3370662-1-trix@redhat.com |
---|---|
State | New |
Headers | show |
Series | nl80211: check return of nla_parse_nested | expand |
On Fri, 2022-02-18 at 08:30 -0800, trix@redhat.com wrote: > From: Tom Rix <trix@redhat.com> > > Clang static analysis reports this representative problem > nl80211.c:15426:6: warning: Branch condition evaluates > to a garbage value > if (!tb[NL80211_SAR_ATTR_TYPE] || > ^~~~~~~~~~~~~~~~~~~~~~~~~~ > > tb is set when nla_parse_nested() is successful. > So check. Well, it's a bit annoying that we cannot express/check this, but we already validated that it's going to succeed, through the nested policy: static const struct nla_policy nl80211_policy[NUM_NL80211_ATTR] = { [...] [NL80211_ATTR_SAR_SPEC] = NLA_POLICY_NESTED(sar_policy), Thus, it cannot actually fail. I suppose in this case checking for errors doesn't make the code that much worse, but there's isn't really much point. Maybe a comment would be useful? johannes
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c index 7543c73a3f1d..c1532c8eb657 100644 --- a/net/wireless/nl80211.c +++ b/net/wireless/nl80211.c @@ -15419,9 +15419,11 @@ static int nl80211_set_sar_specs(struct sk_buff *skb, struct genl_info *info) if (!info->attrs[NL80211_ATTR_SAR_SPEC]) return -EINVAL; - nla_parse_nested(tb, NL80211_SAR_ATTR_MAX, - info->attrs[NL80211_ATTR_SAR_SPEC], - NULL, NULL); + err = nla_parse_nested(tb, NL80211_SAR_ATTR_MAX, + info->attrs[NL80211_ATTR_SAR_SPEC], + NULL, NULL); + if (err) + return err; if (!tb[NL80211_SAR_ATTR_TYPE] || !tb[NL80211_SAR_ATTR_SPECS]) return -EINVAL; @@ -15444,8 +15446,10 @@ static int nl80211_set_sar_specs(struct sk_buff *skb, struct genl_info *info) sar_spec->type = type; specs = 0; nla_for_each_nested(spec_list, tb[NL80211_SAR_ATTR_SPECS], rem) { - nla_parse_nested(spec, NL80211_SAR_ATTR_SPECS_MAX, - spec_list, NULL, NULL); + err = nla_parse_nested(spec, NL80211_SAR_ATTR_SPECS_MAX, + spec_list, NULL, NULL); + if (err) + goto error; switch (type) { case NL80211_SAR_TYPE_POWER: