| Message ID | 20190729095652.1976-1-baijiaju1990@gmail.com |
|---|---|
| State | Awaiting Upstream |
| Delegated to: | David Miller |
| Headers | show |
| Series | brcm80211: Avoid possible null-pointer dereferences in wlc_phy_radio_init_2056() | expand |
Jia-Ju Bai <baijiaju1990@gmail.com> wrote: > In wlc_phy_radio_init_2056(), regs_SYN_2056_ptr, regs_TX_2056_ptr and > regs_RX_2056_ptr may be not assigned, and thus they are still NULL. > Then, they are used on lines 20042-20050: > wlc_phy_init_radio_regs(pi, regs_SYN_2056_ptr, (u16) RADIO_2056_SYN); > wlc_phy_init_radio_regs(pi, regs_TX_2056_ptr, (u16) RADIO_2056_TX0); > wlc_phy_init_radio_regs(pi, regs_TX_2056_ptr, (u16) RADIO_2056_TX1); > wlc_phy_init_radio_regs(pi, regs_RX_2056_ptr, (u16) RADIO_2056_RX0); > wlc_phy_init_radio_regs(pi, regs_RX_2056_ptr, (u16) RADIO_2056_RX1); > > Thus, possible null-pointer dereferences may occur. > > To avoid these bugs, when these variables are not assigned, > wlc_phy_radio_init_2056() directly returns. > > Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com> Patch applied to wireless-drivers-next.git, thanks. b80df89f3909 brcm80211: Avoid possible null-pointer dereferences in wlc_phy_radio_init_2056()
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_n.c b/drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_n.c index 07f61d6155ea..0c57d48f47b1 100644 --- a/drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_n.c +++ b/drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_n.c @@ -20035,7 +20035,7 @@ static void wlc_phy_radio_init_2056(struct brcms_phy *pi) break; default: - break; + return; } }
In wlc_phy_radio_init_2056(), regs_SYN_2056_ptr, regs_TX_2056_ptr and regs_RX_2056_ptr may be not assigned, and thus they are still NULL. Then, they are used on lines 20042-20050: wlc_phy_init_radio_regs(pi, regs_SYN_2056_ptr, (u16) RADIO_2056_SYN); wlc_phy_init_radio_regs(pi, regs_TX_2056_ptr, (u16) RADIO_2056_TX0); wlc_phy_init_radio_regs(pi, regs_TX_2056_ptr, (u16) RADIO_2056_TX1); wlc_phy_init_radio_regs(pi, regs_RX_2056_ptr, (u16) RADIO_2056_RX0); wlc_phy_init_radio_regs(pi, regs_RX_2056_ptr, (u16) RADIO_2056_RX1); Thus, possible null-pointer dereferences may occur. To avoid these bugs, when these variables are not assigned, wlc_phy_radio_init_2056() directly returns. Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com> --- drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_n.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)