* re: iwlwifi: mvm: new BT Coex API
@ 2013-11-01 10:27 Dan Carpenter
2013-11-02 19:35 ` Grumbach, Emmanuel
0 siblings, 1 reply; 2+ messages in thread
From: Dan Carpenter @ 2013-11-01 10:27 UTC (permalink / raw)
To: emmanuel.grumbach; +Cc: linux-wireless
Hello Emmanuel Grumbach,
This is a semi-automatic email about new static checker warnings.
The patch dac94da8dba3: "iwlwifi: mvm: new BT Coex API" from Jun 18,
2013, leads to the following Smatch complaint:
drivers/net/wireless/iwlwifi/mvm/bt-coex.c:754 iwl_mvm_bt_coex_notif_handle()
error: we previously assumed 'data.primary' could be null (see line 709)
drivers/net/wireless/iwlwifi/mvm/bt-coex.c
708
709 if (data.primary) {
^^^^^^^^^^^^
Patch introcudes a NULL check.
710 struct ieee80211_chanctx_conf *chan = data.primary;
711 if (WARN_ON(!chan->def.chan)) {
712 rcu_read_unlock();
713 return;
714 }
715
716 if (chan->def.width < NL80211_CHAN_WIDTH_40) {
717 ci_bw_idx = 0;
718 cmd.co_run_bw_primary = 0;
719 } else {
720 cmd.co_run_bw_primary = 1;
721 if (chan->def.center_freq1 >
722 chan->def.chan->center_freq)
723 ci_bw_idx = 2;
724 else
725 ci_bw_idx = 1;
726 }
727
728 cmd.bt_primary_ci =
729 iwl_ci_mask[chan->def.chan->hw_value][ci_bw_idx];
730 cmd.primary_ch_phy_id = *((u16 *)data.primary->drv_priv);
731 }
732
733 if (data.secondary) {
734 struct ieee80211_chanctx_conf *chan = data.secondary;
735 if (WARN_ON(!data.secondary->def.chan)) {
736 rcu_read_unlock();
737 return;
738 }
739
740 if (chan->def.width < NL80211_CHAN_WIDTH_40) {
741 ci_bw_idx = 0;
742 cmd.co_run_bw_secondary = 0;
743 } else {
744 cmd.co_run_bw_secondary = 1;
745 if (chan->def.center_freq1 >
746 chan->def.chan->center_freq)
747 ci_bw_idx = 2;
748 else
749 ci_bw_idx = 1;
750 }
751
752 cmd.bt_secondary_ci =
753 iwl_ci_mask[chan->def.chan->hw_value][ci_bw_idx];
754 cmd.secondary_ch_phy_id = *((u16 *)data.primary->drv_priv);
^^^^^^^^^^^^^^^^^^^^^^
Patch introduces unchecked dereference.
755 }
756
It's possible that a non-null data.secondary implies data.primary is
non-null. If so please disregard this one-time email.
regards,
dan carpenter
^ permalink raw reply [flat|nested] 2+ messages in thread
* RE: iwlwifi: mvm: new BT Coex API
2013-11-01 10:27 iwlwifi: mvm: new BT Coex API Dan Carpenter
@ 2013-11-02 19:35 ` Grumbach, Emmanuel
0 siblings, 0 replies; 2+ messages in thread
From: Grumbach, Emmanuel @ 2013-11-02 19:35 UTC (permalink / raw)
To: Dan Carpenter; +Cc: linux-wireless@vger.kernel.org
>
> Hello Emmanuel Grumbach,
>
> This is a semi-automatic email about new static checker warnings.
>
> The patch dac94da8dba3: "iwlwifi: mvm: new BT Coex API" from Jun 18, 2013,
> leads to the following Smatch complaint:
>
> drivers/net/wireless/iwlwifi/mvm/bt-coex.c:754
> iwl_mvm_bt_coex_notif_handle()
> error: we previously assumed 'data.primary' could be null (see line
> 709)
>
> drivers/net/wireless/iwlwifi/mvm/bt-coex.c
> 708
> 709 if (data.primary) {
> ^^^^^^^^^^^^
> Patch introcudes a NULL check.
>
> 710 struct ieee80211_chanctx_conf *chan = data.primary;
> 711 if (WARN_ON(!chan->def.chan)) {
> 712 rcu_read_unlock();
> 713 return;
> 714 }
> 715
> 716 if (chan->def.width < NL80211_CHAN_WIDTH_40) {
> 717 ci_bw_idx = 0;
> 718 cmd.co_run_bw_primary = 0;
> 719 } else {
> 720 cmd.co_run_bw_primary = 1;
> 721 if (chan->def.center_freq1 >
> 722 chan->def.chan->center_freq)
> 723 ci_bw_idx = 2;
> 724 else
> 725 ci_bw_idx = 1;
> 726 }
> 727
> 728 cmd.bt_primary_ci =
> 729 iwl_ci_mask[chan->def.chan-
> >hw_value][ci_bw_idx];
> 730 cmd.primary_ch_phy_id = *((u16 *)data.primary-
> >drv_priv);
> 731 }
> 732
> 733 if (data.secondary) {
> 734 struct ieee80211_chanctx_conf *chan =
> data.secondary;
> 735 if (WARN_ON(!data.secondary->def.chan)) {
> 736 rcu_read_unlock();
> 737 return;
> 738 }
> 739
> 740 if (chan->def.width < NL80211_CHAN_WIDTH_40) {
> 741 ci_bw_idx = 0;
> 742 cmd.co_run_bw_secondary = 0;
> 743 } else {
> 744 cmd.co_run_bw_secondary = 1;
> 745 if (chan->def.center_freq1 >
> 746 chan->def.chan->center_freq)
> 747 ci_bw_idx = 2;
> 748 else
> 749 ci_bw_idx = 1;
> 750 }
> 751
> 752 cmd.bt_secondary_ci =
> 753 iwl_ci_mask[chan->def.chan-
> >hw_value][ci_bw_idx];
> 754 cmd.secondary_ch_phy_id = *((u16 *)data.primary-
> >drv_priv);
> ^^^^^^^^^^^^^^^^^^^^^^ Patch introduces
> unchecked dereference.
>
> 755 }
> 756
>
I noticed too and fixed it already:
https://git.kernel.org/cgit/linux/kernel/git/iwlwifi/iwlwifi-next.git/commit/?id=c92f06a1dea1e444213d860a20023f72c134e20a
thanks!
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2013-11-02 19:35 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2013-11-01 10:27 iwlwifi: mvm: new BT Coex API Dan Carpenter
2013-11-02 19:35 ` Grumbach, Emmanuel
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox