From: kernel test robot <lkp@intel.com>
To: oe-kbuild@lists.linux.dev
Cc: lkp@intel.com, Dan Carpenter <error27@gmail.com>
Subject: [iwlwifi-next:next 13/93] drivers/net/wireless/intel/iwlwifi/mld/tx.c:571 iwl_mld_fill_tx_cmd() warn: variable dereferenced before check 'mld_sta' (see line 565)
Date: Sun, 17 May 2026 10:25:42 +0800 [thread overview]
Message-ID: <202605171045.6jPun4QF-lkp@intel.com> (raw)
BCC: lkp@intel.com
CC: oe-kbuild-all@lists.linux.dev
TO: Miri Korenblit <miriam.rachel.korenblit@intel.com>
CC: Johannes Berg <johannes.berg@intel.com>
tree: https://git.kernel.org/pub/scm/linux/kernel/git/iwlwifi/iwlwifi-next.git next
head: ce2b645bb3099ef4d96759335271e25875202ce9
commit: d751c944055aedf33a6cab9b1cadaab65d7bc8dd [13/93] wifi: iwlwifi: mld: use host rate for NAN management frames
:::::: branch date: 7 hours ago
:::::: commit date: 5 days ago
config: i386-randconfig-141-20260517 (https://download.01.org/0day-ci/archive/20260517/202605171045.6jPun4QF-lkp@intel.com/config)
compiler: clang version 20.1.8 (https://github.com/llvm/llvm-project 87f0227cb60147a26a1eeb4fb06e3b505e9c7261)
smatch: v0.5.0-9185-gbcc58b9c
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Reported-by: Dan Carpenter <error27@gmail.com>
| Closes: https://lore.kernel.org/r/202605171045.6jPun4QF-lkp@intel.com/
smatch warnings:
drivers/net/wireless/intel/iwlwifi/mld/tx.c:571 iwl_mld_fill_tx_cmd() warn: variable dereferenced before check 'mld_sta' (see line 565)
vim +/mld_sta +571 drivers/net/wireless/intel/iwlwifi/mld/tx.c
d1e879ec600f9b3 Miri Korenblit 2025-02-16 537
d1e879ec600f9b3 Miri Korenblit 2025-02-16 538 static void
d1e879ec600f9b3 Miri Korenblit 2025-02-16 539 iwl_mld_fill_tx_cmd(struct iwl_mld *mld, struct sk_buff *skb,
d1e879ec600f9b3 Miri Korenblit 2025-02-16 540 struct iwl_device_tx_cmd *dev_tx_cmd,
d1e879ec600f9b3 Miri Korenblit 2025-02-16 541 struct ieee80211_sta *sta)
d1e879ec600f9b3 Miri Korenblit 2025-02-16 542 {
d1e879ec600f9b3 Miri Korenblit 2025-02-16 543 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
d1e879ec600f9b3 Miri Korenblit 2025-02-16 544 struct ieee80211_hdr *hdr = (void *)skb->data;
d1e879ec600f9b3 Miri Korenblit 2025-02-16 545 struct iwl_mld_sta *mld_sta = sta ? iwl_mld_sta_from_mac80211(sta) :
d1e879ec600f9b3 Miri Korenblit 2025-02-16 546 NULL;
1c97c73cdab0afc Miri Korenblit 2025-05-11 547 struct iwl_tx_cmd *tx_cmd;
d1e879ec600f9b3 Miri Korenblit 2025-02-16 548 bool amsdu = ieee80211_is_data_qos(hdr->frame_control) &&
d1e879ec600f9b3 Miri Korenblit 2025-02-16 549 (*ieee80211_get_qos_ctl(hdr) &
d1e879ec600f9b3 Miri Korenblit 2025-02-16 550 IEEE80211_QOS_CTL_A_MSDU_PRESENT);
dabc88cb3b78c0d Johannes Berg 2025-05-05 551 __le32 rate_n_flags = 0;
d1e879ec600f9b3 Miri Korenblit 2025-02-16 552 u16 flags = 0;
d1e879ec600f9b3 Miri Korenblit 2025-02-16 553
d1e879ec600f9b3 Miri Korenblit 2025-02-16 554 dev_tx_cmd->hdr.cmd = TX_CMD;
d1e879ec600f9b3 Miri Korenblit 2025-02-16 555
d1e879ec600f9b3 Miri Korenblit 2025-02-16 556 if (!info->control.hw_key)
d1e879ec600f9b3 Miri Korenblit 2025-02-16 557 flags |= IWL_TX_FLAGS_ENCRYPT_DIS;
d1e879ec600f9b3 Miri Korenblit 2025-02-16 558
d1e879ec600f9b3 Miri Korenblit 2025-02-16 559 /* For data and mgmt packets rate info comes from the fw.
d751c944055aedf Miri Korenblit 2026-05-10 560 * Only set rate/antenna for:
d751c944055aedf Miri Korenblit 2026-05-10 561 * - injected frames with fixed rate,
d751c944055aedf Miri Korenblit 2026-05-10 562 * - when no sta is given.
d751c944055aedf Miri Korenblit 2026-05-10 563 * - frames that are sent to an NMI sta, which is only used for management.
d1e879ec600f9b3 Miri Korenblit 2025-02-16 564 */
d751c944055aedf Miri Korenblit 2026-05-10 @565 if (unlikely(!sta || mld_sta->vif->type == NL80211_IFTYPE_NAN ||
d1e879ec600f9b3 Miri Korenblit 2025-02-16 566 info->control.flags & IEEE80211_TX_CTRL_RATE_INJECT)) {
d1e879ec600f9b3 Miri Korenblit 2025-02-16 567 flags |= IWL_TX_FLAGS_CMD_RATE;
d1e879ec600f9b3 Miri Korenblit 2025-02-16 568 rate_n_flags = iwl_mld_get_tx_rate_n_flags(mld, info, sta,
d1e879ec600f9b3 Miri Korenblit 2025-02-16 569 hdr->frame_control);
d1e879ec600f9b3 Miri Korenblit 2025-02-16 570 } else if (!ieee80211_is_data(hdr->frame_control) ||
d1e879ec600f9b3 Miri Korenblit 2025-02-16 @571 (mld_sta &&
d1e879ec600f9b3 Miri Korenblit 2025-02-16 572 mld_sta->sta_state < IEEE80211_STA_AUTHORIZED)) {
d1e879ec600f9b3 Miri Korenblit 2025-02-16 573 /* These are important frames */
d1e879ec600f9b3 Miri Korenblit 2025-02-16 574 flags |= IWL_TX_FLAGS_HIGH_PRI;
d1e879ec600f9b3 Miri Korenblit 2025-02-16 575 }
d1e879ec600f9b3 Miri Korenblit 2025-02-16 576
d1e879ec600f9b3 Miri Korenblit 2025-02-16 577 tx_cmd = (void *)dev_tx_cmd->payload;
d1e879ec600f9b3 Miri Korenblit 2025-02-16 578
d1e879ec600f9b3 Miri Korenblit 2025-02-16 579 iwl_mld_fill_tx_cmd_hdr(tx_cmd, skb, amsdu);
d1e879ec600f9b3 Miri Korenblit 2025-02-16 580
d1e879ec600f9b3 Miri Korenblit 2025-02-16 581 tx_cmd->offload_assist = iwl_mld_get_offload_assist(skb, amsdu);
d1e879ec600f9b3 Miri Korenblit 2025-02-16 582
d1e879ec600f9b3 Miri Korenblit 2025-02-16 583 /* Total # bytes to be transmitted */
d1e879ec600f9b3 Miri Korenblit 2025-02-16 584 tx_cmd->len = cpu_to_le16((u16)skb->len);
d1e879ec600f9b3 Miri Korenblit 2025-02-16 585
d1e879ec600f9b3 Miri Korenblit 2025-02-16 586 tx_cmd->flags = cpu_to_le16(flags);
d1e879ec600f9b3 Miri Korenblit 2025-02-16 587
dabc88cb3b78c0d Johannes Berg 2025-05-05 588 tx_cmd->rate_n_flags = rate_n_flags;
d1e879ec600f9b3 Miri Korenblit 2025-02-16 589 }
d1e879ec600f9b3 Miri Korenblit 2025-02-16 590
:::::: The code at line 571 was first introduced by commit
:::::: d1e879ec600f9b3bdd253167533959facfefb17b wifi: iwlwifi: add iwlmld sub-driver
:::::: TO: Miri Korenblit <miriam.rachel.korenblit@intel.com>
:::::: CC: Johannes Berg <johannes.berg@intel.com>
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
WARNING: multiple messages have this Message-ID (diff)
From: Dan Carpenter <error27@gmail.com>
To: oe-kbuild@lists.linux.dev,
Miri Korenblit <miriam.rachel.korenblit@intel.com>
Cc: lkp@intel.com, oe-kbuild-all@lists.linux.dev,
Johannes Berg <johannes.berg@intel.com>
Subject: [iwlwifi-next:next 13/93] drivers/net/wireless/intel/iwlwifi/mld/tx.c:571 iwl_mld_fill_tx_cmd() warn: variable dereferenced before check 'mld_sta' (see line 565)
Date: Mon, 18 May 2026 08:03:27 +0300 [thread overview]
Message-ID: <202605171045.6jPun4QF-lkp@intel.com> (raw)
Message-ID: <20260518050327.ANKjevERaqW7Xc9I8ZuGFklusqMlV1y9R6E6oK2QIZo@z> (raw)
tree: https://git.kernel.org/pub/scm/linux/kernel/git/iwlwifi/iwlwifi-next.git next
head: ce2b645bb3099ef4d96759335271e25875202ce9
commit: d751c944055aedf33a6cab9b1cadaab65d7bc8dd [13/93] wifi: iwlwifi: mld: use host rate for NAN management frames
config: i386-randconfig-141-20260517 (https://download.01.org/0day-ci/archive/20260517/202605171045.6jPun4QF-lkp@intel.com/config)
compiler: clang version 20.1.8 (https://github.com/llvm/llvm-project 87f0227cb60147a26a1eeb4fb06e3b505e9c7261)
smatch: v0.5.0-9185-gbcc58b9c
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Reported-by: Dan Carpenter <error27@gmail.com>
| Closes: https://lore.kernel.org/r/202605171045.6jPun4QF-lkp@intel.com/
smatch warnings:
drivers/net/wireless/intel/iwlwifi/mld/tx.c:571 iwl_mld_fill_tx_cmd() warn: variable dereferenced before check 'mld_sta' (see line 565)
vim +/mld_sta +571 drivers/net/wireless/intel/iwlwifi/mld/tx.c
d1e879ec600f9b3 Miri Korenblit 2025-02-16 538 static void
d1e879ec600f9b3 Miri Korenblit 2025-02-16 539 iwl_mld_fill_tx_cmd(struct iwl_mld *mld, struct sk_buff *skb,
d1e879ec600f9b3 Miri Korenblit 2025-02-16 540 struct iwl_device_tx_cmd *dev_tx_cmd,
d1e879ec600f9b3 Miri Korenblit 2025-02-16 541 struct ieee80211_sta *sta)
d1e879ec600f9b3 Miri Korenblit 2025-02-16 542 {
d1e879ec600f9b3 Miri Korenblit 2025-02-16 543 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
d1e879ec600f9b3 Miri Korenblit 2025-02-16 544 struct ieee80211_hdr *hdr = (void *)skb->data;
d1e879ec600f9b3 Miri Korenblit 2025-02-16 545 struct iwl_mld_sta *mld_sta = sta ? iwl_mld_sta_from_mac80211(sta) :
d1e879ec600f9b3 Miri Korenblit 2025-02-16 546 NULL;
1c97c73cdab0afc Miri Korenblit 2025-05-11 547 struct iwl_tx_cmd *tx_cmd;
d1e879ec600f9b3 Miri Korenblit 2025-02-16 548 bool amsdu = ieee80211_is_data_qos(hdr->frame_control) &&
d1e879ec600f9b3 Miri Korenblit 2025-02-16 549 (*ieee80211_get_qos_ctl(hdr) &
d1e879ec600f9b3 Miri Korenblit 2025-02-16 550 IEEE80211_QOS_CTL_A_MSDU_PRESENT);
dabc88cb3b78c0d Johannes Berg 2025-05-05 551 __le32 rate_n_flags = 0;
d1e879ec600f9b3 Miri Korenblit 2025-02-16 552 u16 flags = 0;
d1e879ec600f9b3 Miri Korenblit 2025-02-16 553
d1e879ec600f9b3 Miri Korenblit 2025-02-16 554 dev_tx_cmd->hdr.cmd = TX_CMD;
d1e879ec600f9b3 Miri Korenblit 2025-02-16 555
d1e879ec600f9b3 Miri Korenblit 2025-02-16 556 if (!info->control.hw_key)
d1e879ec600f9b3 Miri Korenblit 2025-02-16 557 flags |= IWL_TX_FLAGS_ENCRYPT_DIS;
d1e879ec600f9b3 Miri Korenblit 2025-02-16 558
d1e879ec600f9b3 Miri Korenblit 2025-02-16 559 /* For data and mgmt packets rate info comes from the fw.
d751c944055aedf Miri Korenblit 2026-05-10 560 * Only set rate/antenna for:
d751c944055aedf Miri Korenblit 2026-05-10 561 * - injected frames with fixed rate,
d751c944055aedf Miri Korenblit 2026-05-10 562 * - when no sta is given.
d751c944055aedf Miri Korenblit 2026-05-10 563 * - frames that are sent to an NMI sta, which is only used for management.
d1e879ec600f9b3 Miri Korenblit 2025-02-16 564 */
d751c944055aedf Miri Korenblit 2026-05-10 @565 if (unlikely(!sta || mld_sta->vif->type == NL80211_IFTYPE_NAN ||
^^^^^^^^^^^^^^^^^^
Dereference
d1e879ec600f9b3 Miri Korenblit 2025-02-16 566 info->control.flags & IEEE80211_TX_CTRL_RATE_INJECT)) {
d1e879ec600f9b3 Miri Korenblit 2025-02-16 567 flags |= IWL_TX_FLAGS_CMD_RATE;
d1e879ec600f9b3 Miri Korenblit 2025-02-16 568 rate_n_flags = iwl_mld_get_tx_rate_n_flags(mld, info, sta,
d1e879ec600f9b3 Miri Korenblit 2025-02-16 569 hdr->frame_control);
d1e879ec600f9b3 Miri Korenblit 2025-02-16 570 } else if (!ieee80211_is_data(hdr->frame_control) ||
d1e879ec600f9b3 Miri Korenblit 2025-02-16 @571 (mld_sta &&
^^^^^^^
Checked too late.
d1e879ec600f9b3 Miri Korenblit 2025-02-16 572 mld_sta->sta_state < IEEE80211_STA_AUTHORIZED)) {
d1e879ec600f9b3 Miri Korenblit 2025-02-16 573 /* These are important frames */
d1e879ec600f9b3 Miri Korenblit 2025-02-16 574 flags |= IWL_TX_FLAGS_HIGH_PRI;
d1e879ec600f9b3 Miri Korenblit 2025-02-16 575 }
d1e879ec600f9b3 Miri Korenblit 2025-02-16 576
d1e879ec600f9b3 Miri Korenblit 2025-02-16 577 tx_cmd = (void *)dev_tx_cmd->payload;
d1e879ec600f9b3 Miri Korenblit 2025-02-16 578
d1e879ec600f9b3 Miri Korenblit 2025-02-16 579 iwl_mld_fill_tx_cmd_hdr(tx_cmd, skb, amsdu);
d1e879ec600f9b3 Miri Korenblit 2025-02-16 580
d1e879ec600f9b3 Miri Korenblit 2025-02-16 581 tx_cmd->offload_assist = iwl_mld_get_offload_assist(skb, amsdu);
d1e879ec600f9b3 Miri Korenblit 2025-02-16 582
d1e879ec600f9b3 Miri Korenblit 2025-02-16 583 /* Total # bytes to be transmitted */
d1e879ec600f9b3 Miri Korenblit 2025-02-16 584 tx_cmd->len = cpu_to_le16((u16)skb->len);
d1e879ec600f9b3 Miri Korenblit 2025-02-16 585
d1e879ec600f9b3 Miri Korenblit 2025-02-16 586 tx_cmd->flags = cpu_to_le16(flags);
d1e879ec600f9b3 Miri Korenblit 2025-02-16 587
dabc88cb3b78c0d Johannes Berg 2025-05-05 588 tx_cmd->rate_n_flags = rate_n_flags;
d1e879ec600f9b3 Miri Korenblit 2025-02-16 589 }
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
next reply other threads:[~2026-05-17 2:26 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-05-17 2:25 kernel test robot [this message]
2026-05-18 5:03 ` [iwlwifi-next:next 13/93] drivers/net/wireless/intel/iwlwifi/mld/tx.c:571 iwl_mld_fill_tx_cmd() warn: variable dereferenced before check 'mld_sta' (see line 565) Dan Carpenter
2026-05-18 5:11 ` Korenblit, Miriam Rachel
2026-05-18 5:14 ` Dan Carpenter
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=202605171045.6jPun4QF-lkp@intel.com \
--to=lkp@intel.com \
--cc=error27@gmail.com \
--cc=oe-kbuild@lists.linux.dev \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.