From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 3C1E54EDCD0; Tue, 13 Oct 2026 12:48:37 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1791895718; cv=none; b=ZdrNIcfO2GLX5NIMgpinMOhF7YVx9Me8WJfgVWBeRlCniX+SrzpC+IbDan+eNT3tCj7QaSQB7L8ZUwWu4RV49k+WISGZq5xnyLlVgrGDsQatzZOp6CiFn1noIrES2DeDI+Ddw+rGNw9AE32Pc/bhAtxrksgfI1rwTPiR7uy/S6Q= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1791895718; c=relaxed/simple; bh=gfmy5o9j0Cv+uSnGFOcGsC8k2Xo+HKoaOjNN6BxUX7M=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=M/Sa2WEo0UZy1LB8J34ugxPHVaGJqW7JGb9PYneFWRcYXL/EfkmhpYsYrUZ2XufSto1X5D2e2VjvpXhfhXH4H51ky63wMZxFuCNXOSGerns4qRJgoyMqQ4GxnugnuhLwiZ19b4+PhJVJ3s1M62ak/eo0tr0oINx05Jfz8mVYI+o= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=TWQ7FH/1; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="TWQ7FH/1" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 8FD9A1F0089A; Tue, 13 Oct 2026 12:48:36 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1791895717; bh=0fBoXtTzu9eoGKy3sr1ufViLQEYAG1nhjdcZIqAZIGI=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=TWQ7FH/13BdeNNVZkaduyNnaw4ynqMAaRRRJ3Ns2zOJVNTnIvJ2jkXjZtaoAn6pj+ zB4GKaMKrOUNi0eP/0OY0UkZ0JR9vwfICbnqauaCQDnWQG5oHR4nrFO8rXHaoBTu2x 8I3ny5IyAahEJpbVMXF/KL713VExmnfAkmiyWKBY= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Tamizh Chelvam Raja , Johannes Berg , Sasha Levin Subject: [PATCH 6.12 325/497] wifi: mac80211: Add sta pointer sanity check in ieee80211_8023_xmit() Date: Tue, 13 Oct 2026 13:38:12 +0200 Message-ID: <20261013112915.617501043@linuxfoundation.org> X-Mailer: git-send-email 2.56.0 In-Reply-To: <20261013112907.864180619@linuxfoundation.org> References: <20261013112907.864180619@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.12-stable review patch. If anyone has any objections, please let me know. ------------------ From: Tamizh Chelvam Raja [ Upstream commit 303f11fda2fa4c6f7aa86b8fa54aaee5e1ef181b ] Currently ieee80211_8023_xmit() accesses the sta pointer without any sanity check, assuming that only unicast packets for an authorized station are processed. But the sta pointer could become NULL when a framework to support 802.3 offload for the multicast packets is added in the follow-up patches. Add the valid sta pointer sanity check to avoid the invalid pointer access. This aligns with some of the subordinate functions called by ieee80211_8023_xmit() that already NULL-check 'sta' such as ieee80211_select_queue() and ieee80211_aggr_check(). Signed-off-by: Tamizh Chelvam Raja Link: https://patch.msgid.link/20260604162403.1563729-2-tamizh.raja@oss.qualcomm.com Signed-off-by: Johannes Berg Stable-dep-of: 4febc02cd02f ("wifi: mac80211: set info->band for 802.3 encap offload frames") Signed-off-by: Sasha Levin --- net/mac80211/tx.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c index e07bf5ba9b7a7..8ea17ac862451 100644 --- a/net/mac80211/tx.c +++ b/net/mac80211/tx.c @@ -4657,7 +4657,7 @@ static void ieee80211_8023_xmit(struct ieee80211_sub_if_data *sdata, { struct ieee80211_tx_info *info; struct ieee80211_local *local = sdata->local; - struct tid_ampdu_tx *tid_tx; + struct tid_ampdu_tx *tid_tx = NULL; struct sk_buff *seg, *next; unsigned int skbs = 0, len = 0; u16 queue; @@ -4677,7 +4677,9 @@ static void ieee80211_8023_xmit(struct ieee80211_sub_if_data *sdata, ieee80211_aggr_check(sdata, sta, skb); tid = skb->priority & IEEE80211_QOS_CTL_TAG1D_MASK; - tid_tx = rcu_dereference(sta->ampdu_mlme.tid_tx[tid]); + + if (sta) + tid_tx = rcu_dereference(sta->ampdu_mlme.tid_tx[tid]); if (tid_tx) { if (!test_bit(HT_AGG_STATE_OPERATIONAL, &tid_tx->state)) { /* fall back to non-offload slow path */ @@ -4726,8 +4728,11 @@ static void ieee80211_8023_xmit(struct ieee80211_sub_if_data *sdata, } dev_sw_netstats_tx_add(dev, skbs, len); - sta->deflink.tx_stats.packets[queue] += skbs; - sta->deflink.tx_stats.bytes[queue] += len; + + if (sta) { + sta->deflink.tx_stats.packets[queue] += skbs; + sta->deflink.tx_stats.bytes[queue] += len; + } ieee80211_tpt_led_trig_tx(local, len); -- 2.53.0