Re: [kbuild-all] [wireless-next:master 316/316] drivers/net/wireless/rsi/rsi_91x_debugfs.c:296 rsi_init_dbgfs() error: potential null dereference 'dev_dbgfs'. (kzalloc returns null)

Re: [kbuild-all] [wireless-next:master 316/316] drivers/net/wireless/rsi/rsi_91x_debugfs.c:296 rsi_init_dbgfs() error: potential null dereference 'dev_dbgfs'. (kzalloc returns null)

[Dan Carpenter]

On Thu, Mar 27, 2014 at 06:45:07PM +0300, Dan Carpenter wrote:
> > drivers/net/wireless/rsi/rsi_91x_usb.c:289 rsi_usb_write_register_multiple() warn: '__min2' 4096 can't fit into 255 'transfer'

The code for this one is:

	transfer = min_t(int, count, 4096);

It's complaining because "tranfers" is u8, but the cast to int always
makes me worry negative values.  In this case, count is not user
controlled so it's safe.  But that's a common security problem you
should be aware of.  It's better to cast it to an unsigned value.

regards,
dan carpenter

Re: [kbuild-all] [wireless-next:master 316/316] drivers/net/wireless/rsi/rsi_91x_debugfs.c:296 rsi_init_dbgfs() error: potential null dereference 'dev_dbgfs'. (kzalloc returns null)

[Dan Carpenter]

On Fri, Mar 28, 2014 at 07:51:25AM +0530, Fariya wrote:
> Hi Dan,
> 
> Do I need to re-send the whole of the driver again? Considering the driver
> is a part of wireless-next, shall I check-out the wireless-next git repo
> and create a patch for the mentioned fixes and send it across?

The latter.  Do it on top of wireles-next.

> 
> > *The code for this one is:         transfer = min_t(int, count, 4096); It's
> > complaining because "tranfers" is u8, but the cast to int always makes me
> > worry negative values.  In this case, count is not user controlled so it's
> > safe.  But that's a common security problem you should be aware of.  It's
> > better to cast it to an unsigned value.*
> 
> >Shall I typecast the return value of min_t to u8?

No.  That would do a truncate to 8 bits before the compare.  Cast it to
u32 first.

regards,
dan carpenter