From patchwork Tue Apr 18 14:29:18 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Nikita Zhandarovich X-Patchwork-Id: 675000 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 34CCBC6FD18 for ; Tue, 18 Apr 2023 14:29:30 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231550AbjDRO33 (ORCPT ); Tue, 18 Apr 2023 10:29:29 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:37192 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231499AbjDRO30 (ORCPT ); Tue, 18 Apr 2023 10:29:26 -0400 Received: from exchange.fintech.ru (exchange.fintech.ru [195.54.195.159]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id D8946DD; Tue, 18 Apr 2023 07:29:24 -0700 (PDT) Received: from Ex16-01.fintech.ru (10.0.10.18) by exchange.fintech.ru (195.54.195.159) with Microsoft SMTP Server (TLS) id 14.3.498.0; Tue, 18 Apr 2023 17:29:23 +0300 Received: from localhost (10.0.253.138) by Ex16-01.fintech.ru (10.0.10.18) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2242.4; Tue, 18 Apr 2023 17:29:22 +0300 From: Nikita Zhandarovich To: Larry Finger CC: Nikita Zhandarovich , Kalle Valo , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , "John W. Linville" , , , , , , Natalia Petrova Subject: [PATCH v2] b43legacy: Add checking for null for ssb_get_devtypedata(dev) Date: Tue, 18 Apr 2023 07:29:18 -0700 Message-ID: <20230418142918.70510-1-n.zhandarovich@fintech.ru> X-Mailer: git-send-email 2.25.1 MIME-Version: 1.0 X-Originating-IP: [10.0.253.138] X-ClientProxiedBy: Ex16-02.fintech.ru (10.0.10.19) To Ex16-01.fintech.ru (10.0.10.18) Precedence: bulk List-ID: X-Mailing-List: linux-wireless@vger.kernel.org Since second call of ssb_get_devtypedata() may fail as well as the first one, the NULL return value in 'wl' will be later dereferenced in calls to b43legacy_one_core_attach() and schedule_work(). Instead of merely warning about this failure with B43legacy_WARN_ON(), properly return with error to avoid any further NULL pointer dereferences. Found by Linux Verification Center (linuxtesting.org) with static analysis tool SVACE. Fixes: 75388acd0cd8 ("[B43LEGACY]: add mac80211-based driver for legacy BCM43xx devices") Co-developed-by: Natalia Petrova Signed-off-by: Nikita Zhandarovich Reviewed-by: Larry Finger --- v2: fix issues with overlooked null-ptr-dereferences pointed out by Simon Horman Link: https://lore.kernel.org/all/Y+eb9mZntfe6rO3v@corigine.com/ drivers/net/wireless/broadcom/b43legacy/main.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/drivers/net/wireless/broadcom/b43legacy/main.c b/drivers/net/wireless/broadcom/b43legacy/main.c index 760136638a95..5a706dd0b1a4 100644 --- a/drivers/net/wireless/broadcom/b43legacy/main.c +++ b/drivers/net/wireless/broadcom/b43legacy/main.c @@ -3857,7 +3857,11 @@ static int b43legacy_probe(struct ssb_device *dev, if (err) goto out; wl = ssb_get_devtypedata(dev); - B43legacy_WARN_ON(!wl); + if (!wl) { + B43legacy_WARN_ON(!wl); + err = -ENODEV; + goto out; + } } err = b43legacy_one_core_attach(dev, wl); if (err)