All of lore.kernel.org
 help / color / mirror / Atom feed
From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Ilan Peer <ilan.peer@intel.com>,
	Gregory Greenman <gregory.greenman@intel.com>,
	Johannes Berg <johannes.berg@intel.com>,
	Sasha Levin <sashal@kernel.org>,
	johannes@sipsolutions.net, kvalo@kernel.org,
	linux-wireless@vger.kernel.org
Subject: [PATCH AUTOSEL 6.4 13/26] wifi: mac80211_hwsim: Fix possible NULL dereference
Date: Sun,  9 Jul 2023 11:12:42 -0400	[thread overview]
Message-ID: <20230709151255.512931-13-sashal@kernel.org> (raw)
In-Reply-To: <20230709151255.512931-1-sashal@kernel.org>

From: Ilan Peer <ilan.peer@intel.com>

[ Upstream commit 0cc80943ef518a1c51a1111e9346d1daf11dd545 ]

In a call to mac80211_hwsim_select_tx_link() the sta pointer might
be NULL, thus need to check that it is not NULL before accessing it.

Signed-off-by: Ilan Peer <ilan.peer@intel.com>
Signed-off-by: Gregory Greenman <gregory.greenman@intel.com>
Link: https://lore.kernel.org/r/20230604120651.f4d889fc98c4.Iae85f527ed245a37637a874bb8b8c83d79812512@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/virtual/mac80211_hwsim.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/net/wireless/virtual/mac80211_hwsim.c b/drivers/net/wireless/virtual/mac80211_hwsim.c
index 89c7a1420381d..ed5af63025979 100644
--- a/drivers/net/wireless/virtual/mac80211_hwsim.c
+++ b/drivers/net/wireless/virtual/mac80211_hwsim.c
@@ -4,7 +4,7 @@
  * Copyright (c) 2008, Jouni Malinen <j@w1.fi>
  * Copyright (c) 2011, Javier Lopez <jlopex@gmail.com>
  * Copyright (c) 2016 - 2017 Intel Deutschland GmbH
- * Copyright (C) 2018 - 2022 Intel Corporation
+ * Copyright (C) 2018 - 2023 Intel Corporation
  */
 
 /*
@@ -1864,7 +1864,7 @@ mac80211_hwsim_select_tx_link(struct mac80211_hwsim_data *data,
 
 	WARN_ON(is_multicast_ether_addr(hdr->addr1));
 
-	if (WARN_ON_ONCE(!sta->valid_links))
+	if (WARN_ON_ONCE(!sta || !sta->valid_links))
 		return &vif->bss_conf;
 
 	for (i = 0; i < ARRAY_SIZE(vif->link_conf); i++) {
-- 
2.39.2


  parent reply	other threads:[~2023-07-09 15:13 UTC|newest]

Thread overview: 38+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2023-07-09 15:12 [PATCH AUTOSEL 6.4 01/26] wifi: ath11k: fix registration of 6Ghz-only phy without the full channel range Sasha Levin
2023-07-09 15:12 ` Sasha Levin
2023-07-09 15:12 ` [PATCH AUTOSEL 6.4 02/26] bpf: Print a warning only if writing to unprivileged_bpf_disabled Sasha Levin
2023-07-09 15:12 ` [PATCH AUTOSEL 6.4 03/26] wifi: rtw89: 8851be: add 8851BE PCI entry and fill PCI capabilities Sasha Levin
2023-07-10  0:25   ` Ping-Ke Shih
2023-07-20 19:11     ` Sasha Levin
2023-07-09 15:12 ` [PATCH AUTOSEL 6.4 04/26] spi: s3c64xx: change polling mode to optional Sasha Levin
2023-07-09 15:12   ` Sasha Levin
2023-07-09 21:14   ` Mark Brown
2023-07-09 21:14     ` Mark Brown
2023-07-20 19:11     ` Sasha Levin
2023-07-20 19:11       ` Sasha Levin
2023-07-09 15:12 ` [PATCH AUTOSEL 6.4 05/26] bpf: Address KCSAN report on bpf_lru_list Sasha Levin
2023-07-09 15:12 ` [PATCH AUTOSEL 6.4 06/26] spi: cadence-quadspi: Add compatible for AMD Pensando Elba SoC Sasha Levin
2023-07-09 15:12 ` [PATCH AUTOSEL 6.4 07/26] bpf: drop unnecessary user-triggerable WARN_ONCE in verifierl log Sasha Levin
2023-07-09 15:12 ` [PATCH AUTOSEL 6.4 08/26] bpf: tcp: Avoid taking fast sock lock in iterator Sasha Levin
2023-07-09 15:12 ` [PATCH AUTOSEL 6.4 09/26] wifi: rtw88: sdio: Check the HISR RX_REQUEST bit in rtw_sdio_rx_isr() Sasha Levin
2023-07-09 15:12 ` [PATCH AUTOSEL 6.4 10/26] bpf: Silence a warning in btf_type_id_size() Sasha Levin
2023-07-09 15:12 ` [PATCH AUTOSEL 6.4 11/26] devlink: make health report on unregistered instance warn just once Sasha Levin
2023-07-09 15:12 ` [PATCH AUTOSEL 6.4 12/26] wifi: ath11k: add support default regdb while searching board-2.bin for WCN6855 Sasha Levin
2023-07-09 15:12   ` Sasha Levin
2023-07-09 15:12 ` Sasha Levin [this message]
2023-07-09 15:12 ` [PATCH AUTOSEL 6.4 14/26] spi: dw: Add compatible for Intel Mount Evans SoC Sasha Levin
2023-07-09 15:12 ` [PATCH AUTOSEL 6.4 15/26] wifi: ath12k: Avoid NULL pointer access during management transmit cleanup Sasha Levin
2023-07-09 15:12   ` Sasha Levin
2023-07-09 15:12 ` [PATCH AUTOSEL 6.4 16/26] wifi: ath11k: fix memory leak in WMI firmware stats Sasha Levin
2023-07-09 15:12   ` Sasha Levin
2023-07-09 15:12 ` [PATCH AUTOSEL 6.4 17/26] wifi: iwlwifi: mvm: fix potential array out of bounds access Sasha Levin
2023-07-09 15:12 ` [PATCH AUTOSEL 6.4 18/26] net: ethernet: litex: add support for 64 bit stats Sasha Levin
2023-07-09 15:12 ` [PATCH AUTOSEL 6.4 19/26] devlink: report devlink_port_type_warn source device Sasha Levin
2023-07-09 15:12 ` [PATCH AUTOSEL 6.4 20/26] wifi: iwlwifi: mvm: Add NULL check before dereferencing the pointer Sasha Levin
2023-07-09 15:12 ` [PATCH AUTOSEL 6.4 21/26] wifi: wext-core: Fix -Wstringop-overflow warning in ioctl_standard_iw_point() Sasha Levin
2023-07-09 15:12 ` [PATCH AUTOSEL 6.4 22/26] wifi: iwlwifi: Add support for new PCI Id Sasha Levin
2023-07-09 15:12 ` [PATCH AUTOSEL 6.4 23/26] wifi: iwlwifi: mvm: avoid baid size integer overflow Sasha Levin
2023-07-09 15:12 ` [PATCH AUTOSEL 6.4 24/26] wifi: iwlwifi: pcie: add device id 51F1 for killer 1675 Sasha Levin
2023-07-09 15:12 ` [Intel-wired-lan] [PATCH AUTOSEL 6.4 25/26] igb: Fix igb_down hung on surprise removal Sasha Levin
2023-07-09 15:12   ` Sasha Levin
2023-07-09 15:12 ` [PATCH AUTOSEL 6.4 26/26] net: hns3: fix strncpy() not using dest-buf length as length issue Sasha Levin

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20230709151255.512931-13-sashal@kernel.org \
    --to=sashal@kernel.org \
    --cc=gregory.greenman@intel.com \
    --cc=ilan.peer@intel.com \
    --cc=johannes.berg@intel.com \
    --cc=johannes@sipsolutions.net \
    --cc=kvalo@kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-wireless@vger.kernel.org \
    --cc=stable@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.