staging: rtl8188eu: fix possible null dereference (22824194) · Commits · 戴 / test

Inside a nested 'else' block at the beginning of this function is a call that assigns 'psta' to the return value of 'rtw_get_stainfo()'. If 'rtw_get_stainfo()' returns NULL and the flow of control reaches the 'else if' where 'psta' is dereferenced, then we will dereference a NULL pointer. Fix this by checking if 'psta' is not NULL before reading its 'psta->qos_option' data member. Addresses-Coverity: ("Dereference null return value") Signed-off-by:

Connor Kuehl <connor.kuehl@canonical.com> Acked-by:

Larry Finger <Larry.Finger@lwfinger.net> Link: https://lore.kernel.org/r/20190926150317.5894-1-connor.kuehl@canonical.com Signed-off-by:

Greg Kroah-Hartman <gregkh@linuxfoundation.org>

drivers/staging/rtl8188eu/core/rtw_xmit.c

+2 −2

Original line number	Diff line number	Diff line
		@@ -776,7 +776,7 @@ s32 rtw_make_wlanhdr(struct adapter padapter, u8 hdr, struct pkt_attrib *pattr
		memcpy(pwlanhdr->addr2, get_bssid(pmlmepriv), ETH_ALEN);
		memcpy(pwlanhdr->addr3, pattrib->src, ETH_ALEN);

		if (psta->qos_option)
		if (psta && psta->qos_option)
		qos_option = true;
		} else if (check_fwstate(pmlmepriv, WIFI_ADHOC_STATE) \|\|
		check_fwstate(pmlmepriv, WIFI_ADHOC_MASTER_STATE)) {
		@@ -784,7 +784,7 @@ s32 rtw_make_wlanhdr(struct adapter padapter, u8 hdr, struct pkt_attrib *pattr
		memcpy(pwlanhdr->addr2, pattrib->src, ETH_ALEN);
		memcpy(pwlanhdr->addr3, get_bssid(pmlmepriv), ETH_ALEN);

		if (psta->qos_option)
		if (psta && psta->qos_option)
		qos_option = true;
		} else {
		RT_TRACE(_module_rtl871x_xmit_c_, _drv_err_, ("fw_state:%x is not allowed to xmit frame\n", get_fwstate(pmlmepriv)));

Admin message