[bug report] iwlwifi: mei: add the driver to allow cooperation with CSME

[bug report] iwlwifi: mei: add the driver to allow cooperation with CSME

[Dan Carpenter]

Hello Emmanuel Grumbach,

The patch 2da4366f9e2c: "iwlwifi: mei: add the driver to allow
cooperation with CSME" from Nov 12, 2021, leads to the following
Smatch static checker warning:

	drivers/net/wireless/intel/iwlwifi/mei/main.c:632 iwl_mei_handle_csme_filters()
	error: potential null dereference 'new_filters'.  (kzalloc returns null)

drivers/net/wireless/intel/iwlwifi/mei/main.c
    618 static void iwl_mei_handle_csme_filters(struct mei_cl_device *cldev,
    619                                         const struct iwl_sap_csme_filters *filters)
    620 {
    621         struct iwl_mei *mei = mei_cldev_get_drvdata(iwl_mei_global_cldev);
    622         struct iwl_mei_filters *new_filters;
    623         struct iwl_mei_filters *old_filters;
    624 
    625         old_filters =
    626                 rcu_dereference_protected(mei->filters,
    627                                           lockdep_is_held(&iwl_mei_mutex));
    628 
    629         new_filters = kzalloc(sizeof(*new_filters), GFP_KERNEL);
                ^^^^^^^^^^^^^^^^^^^^^
No check for NULL on this allocation.

    630 
    631         /* Copy the OOB filters */
--> 632         new_filters->filters = filters->filters;
    633 
    634         rcu_assign_pointer(mei->filters, new_filters);
    635 
    636         if (old_filters)
    637                 kfree_rcu(old_filters, rcu_head);
    638 }

regards,
dan carpenter

[bug report] iwlwifi: mei: add the driver to allow cooperation with CSME

[Dan Carpenter]

Hello Emmanuel Grumbach,

The patch 2da4366f9e2c: "iwlwifi: mei: add the driver to allow
cooperation with CSME" from Nov 12, 2021, leads to the following
Smatch static checker warning:

	drivers/net/wireless/intel/iwlwifi/mei/net.c:199 iwl_mei_rx_filter_ipv4()
	warn: taking sizeof binop

drivers/net/wireless/intel/iwlwifi/mei/net.c
    188 static bool iwl_mei_rx_filter_ipv4(struct sk_buff *skb,
    189                                    const struct iwl_sap_oob_filters *filters,
    190                                    rx_handler_result_t *rx_handler_res)
    191 {
    192         const struct iwl_sap_ipv4_filter *filt = &filters->ipv4_filter;
    193         const struct iphdr *iphdr;
    194         unsigned int iphdrlen;
    195         bool match;
    196 
    197         if (!pskb_may_pull(skb, skb_network_offset(skb) + sizeof(*iphdr)) ||
    198             !pskb_may_pull(skb, skb_network_offset(skb) +
--> 199                            sizeof(ip_hdrlen(skb) - sizeof(*iphdr))))

Probably this should be: ip_hdrlen(skb) - sizeof(*iphdr)?

    200                 return false;
    201 
    202         iphdrlen = ip_hdrlen(skb);

regards,
dan carpenter

RE: [bug report] iwlwifi: mei: add the driver to allow cooperation with CSME

[Grumbach, Emmanuel]

> Hello Emmanuel Grumbach,
> 
> The patch 2da4366f9e2c: "iwlwifi: mei: add the driver to allow cooperation
> with CSME" from Nov 12, 2021, leads to the following Smatch static checker
> warning:
> 
> 	drivers/net/wireless/intel/iwlwifi/mei/net.c:199
> iwl_mei_rx_filter_ipv4()
> 	warn: taking sizeof binop
> 
> drivers/net/wireless/intel/iwlwifi/mei/net.c
>     188 static bool iwl_mei_rx_filter_ipv4(struct sk_buff *skb,
>     189                                    const struct iwl_sap_oob_filters *filters,
>     190                                    rx_handler_result_t *rx_handler_res)
>     191 {
>     192         const struct iwl_sap_ipv4_filter *filt = &filters->ipv4_filter;
>     193         const struct iphdr *iphdr;
>     194         unsigned int iphdrlen;
>     195         bool match;
>     196
>     197         if (!pskb_may_pull(skb, skb_network_offset(skb) + sizeof(*iphdr))
> ||
>     198             !pskb_may_pull(skb, skb_network_offset(skb) +
> --> 199                            sizeof(ip_hdrlen(skb) - sizeof(*iphdr))))
> 
> Probably this should be: ip_hdrlen(skb) - sizeof(*iphdr)?

Ouch....
Thanks!