From: Dan Carpenter <error27@gmail.com>
To: quic_kvalo@quicinc.com
Cc: ath12k@lists.infradead.org
Subject: [bug report] wifi: ath12k: missing kmalloc checks
Date: Thu, 16 Feb 2023 16:59:53 +0300 [thread overview]
Message-ID: <Y+422WFdVPaDJuCe@kili> (raw)
Hello Kalle Valo,
The patch d889913205cf: "wifi: ath12k: driver for Qualcomm Wi-Fi 7
devices" from Nov 28, 2022, leads to the following Smatch static
checker warning:
drivers/net/wireless/ath/ath12k/mac.c:2792 ath12k_mac_op_hw_scan()
warn: 'arg.extraie.ptr' was never checked for NULL
drivers/net/wireless/ath/ath12k/mac.c
2716 static int ath12k_mac_op_hw_scan(struct ieee80211_hw *hw,
2717 struct ieee80211_vif *vif,
2718 struct ieee80211_scan_request *hw_req)
2719 {
2720 struct ath12k *ar = hw->priv;
2721 struct ath12k_vif *arvif = ath12k_vif_to_arvif(vif);
2722 struct cfg80211_scan_request *req = &hw_req->req;
2723 struct ath12k_wmi_scan_req_arg arg = {};
2724 int ret;
2725 int i;
2726
2727 mutex_lock(&ar->conf_mutex);
2728
2729 spin_lock_bh(&ar->data_lock);
2730 switch (ar->scan.state) {
2731 case ATH12K_SCAN_IDLE:
2732 reinit_completion(&ar->scan.started);
2733 reinit_completion(&ar->scan.completed);
2734 ar->scan.state = ATH12K_SCAN_STARTING;
2735 ar->scan.is_roc = false;
2736 ar->scan.vdev_id = arvif->vdev_id;
2737 ret = 0;
2738 break;
2739 case ATH12K_SCAN_STARTING:
2740 case ATH12K_SCAN_RUNNING:
2741 case ATH12K_SCAN_ABORTING:
2742 ret = -EBUSY;
2743 break;
2744 }
2745 spin_unlock_bh(&ar->data_lock);
2746
2747 if (ret)
2748 goto exit;
2749
2750 ath12k_wmi_start_scan_init(ar, &arg);
2751 arg.vdev_id = arvif->vdev_id;
2752 arg.scan_id = ATH12K_SCAN_ID;
2753
2754 if (req->ie_len) {
2755 arg.extraie.len = req->ie_len;
2756 arg.extraie.ptr = kzalloc(req->ie_len, GFP_KERNEL);
kzalloc() can fails.
2757 memcpy(arg.extraie.ptr, req->ie, req->ie_len);
Crash here.
2758 }
2759
regards,
dan carpenter
--
ath12k mailing list
ath12k@lists.infradead.org
https://lists.infradead.org/mailman/listinfo/ath12k
reply other threads:[~2023-02-16 14:00 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=Y+422WFdVPaDJuCe@kili \
--to=error27@gmail.com \
--cc=ath12k@lists.infradead.org \
--cc=quic_kvalo@quicinc.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox