Re: [iwlwifi-next:next 13/93] drivers/net/wireless/intel/iwlwifi/mld/tx.c:571 iwl_mld_fill_tx_cmd() warn: variable dereferenced before check 'mld_sta' (see line 565)

[Dan Carpenter <error27@gmail.com>]

On Mon, May 18, 2026 at 05:11:00AM +0000, Korenblit, Miriam Rachel wrote:
> 
> 
> > -----Original Message-----
> > From: Dan Carpenter <error27@gmail.com>
> > Sent: Monday, May 18, 2026 8:03 AM
> > To: oe-kbuild@lists.linux.dev; Korenblit, Miriam Rachel
> > <miriam.rachel.korenblit@intel.com>
> > Cc: lkp <lkp@intel.com>; oe-kbuild-all@lists.linux.dev; Berg, Johannes
> > <johannes.berg@intel.com>
> > Subject: [iwlwifi-next:next 13/93] drivers/net/wireless/intel/iwlwifi/mld/tx.c:571
> > iwl_mld_fill_tx_cmd() warn: variable dereferenced before check 'mld_sta' (see
> > line 565)
> > 
> > tree:   https://git.kernel.org/pub/scm/linux/kernel/git/iwlwifi/iwlwifi-next.git
> > next
> > head:   ce2b645bb3099ef4d96759335271e25875202ce9
> > commit: d751c944055aedf33a6cab9b1cadaab65d7bc8dd [13/93] wifi: iwlwifi:
> > mld: use host rate for NAN management frames
> > config: i386-randconfig-141-20260517 (https://download.01.org/0day-
> > ci/archive/20260517/202605171045.6jPun4QF-lkp@intel.com/config)
> > compiler: clang version 20.1.8 (https://github.com/llvm/llvm-project
> > 87f0227cb60147a26a1eeb4fb06e3b505e9c7261)
> > smatch: v0.5.0-9185-gbcc58b9c
> > 
> > If you fix the issue in a separate patch/commit (i.e. not just a new version of the
> > same patch/commit), kindly add following tags
> > | Reported-by: kernel test robot <lkp@intel.com>
> > | Reported-by: Dan Carpenter <error27@gmail.com>
> > | Closes: https://lore.kernel.org/r/202605171045.6jPun4QF-lkp@intel.com/
> > 
> > smatch warnings:
> > drivers/net/wireless/intel/iwlwifi/mld/tx.c:571 iwl_mld_fill_tx_cmd() warn:
> > variable dereferenced before check 'mld_sta' (see line 565)
> > 
> > vim +/mld_sta +571 drivers/net/wireless/intel/iwlwifi/mld/tx.c
> > 
> > d1e879ec600f9b3 Miri Korenblit 2025-02-16  538  static void
> > d1e879ec600f9b3 Miri Korenblit 2025-02-16  539  iwl_mld_fill_tx_cmd(struct
> > iwl_mld *mld, struct sk_buff *skb,
> > d1e879ec600f9b3 Miri Korenblit 2025-02-16  540  		    struct
> > iwl_device_tx_cmd *dev_tx_cmd,
> > d1e879ec600f9b3 Miri Korenblit 2025-02-16  541  		    struct
> > ieee80211_sta *sta)
> > d1e879ec600f9b3 Miri Korenblit 2025-02-16  542  {
> > d1e879ec600f9b3 Miri Korenblit 2025-02-16  543  	struct
> > ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
> > d1e879ec600f9b3 Miri Korenblit 2025-02-16  544  	struct ieee80211_hdr
> > *hdr = (void *)skb->data;
> > d1e879ec600f9b3 Miri Korenblit 2025-02-16  545  	struct iwl_mld_sta
> > *mld_sta = sta ? iwl_mld_sta_from_mac80211(sta) :
> > d1e879ec600f9b3 Miri Korenblit 2025-02-16  546
> > 		    NULL;
> > 1c97c73cdab0afc Miri Korenblit 2025-05-11  547  	struct iwl_tx_cmd
> > *tx_cmd;
> > d1e879ec600f9b3 Miri Korenblit 2025-02-16  548  	bool amsdu =
> > ieee80211_is_data_qos(hdr->frame_control) &&
> > d1e879ec600f9b3 Miri Korenblit 2025-02-16  549
> > (*ieee80211_get_qos_ctl(hdr) &
> > d1e879ec600f9b3 Miri Korenblit 2025-02-16  550
> > IEEE80211_QOS_CTL_A_MSDU_PRESENT);
> > dabc88cb3b78c0d Johannes Berg  2025-05-05  551  	__le32 rate_n_flags =
> > 0;
> > d1e879ec600f9b3 Miri Korenblit 2025-02-16  552  	u16 flags = 0;
> > d1e879ec600f9b3 Miri Korenblit 2025-02-16  553
> > d1e879ec600f9b3 Miri Korenblit 2025-02-16  554  	dev_tx_cmd->hdr.cmd
> > = TX_CMD;
> > d1e879ec600f9b3 Miri Korenblit 2025-02-16  555
> > d1e879ec600f9b3 Miri Korenblit 2025-02-16  556  	if (!info-
> > >control.hw_key)
> > d1e879ec600f9b3 Miri Korenblit 2025-02-16  557  		flags |=
> > IWL_TX_FLAGS_ENCRYPT_DIS;
> > d1e879ec600f9b3 Miri Korenblit 2025-02-16  558
> > d1e879ec600f9b3 Miri Korenblit 2025-02-16  559  	/* For data and mgmt
> > packets rate info comes from the fw.
> > d751c944055aedf Miri Korenblit 2026-05-10  560  	 * Only set
> > rate/antenna for:
> > d751c944055aedf Miri Korenblit 2026-05-10  561  	 * - injected frames
> > with fixed rate,
> > d751c944055aedf Miri Korenblit 2026-05-10  562  	 * - when no sta is
> > given.
> > d751c944055aedf Miri Korenblit 2026-05-10  563  	 * - frames that are
> > sent to an NMI sta, which is only used for management.
> > d1e879ec600f9b3 Miri Korenblit 2025-02-16  564  	 */
> > d751c944055aedf Miri Korenblit 2026-05-10 @565  	if (unlikely(!sta ||
> > mld_sta->vif->type == NL80211_IFTYPE_NAN ||
> >                                                                              ^^^^^^^^^^^^^^^^^^ Dereference
> 
> 
> This is not a real issue because (sta != NULL) -> (mld_sta != NULL)
> 

You could delete the other NULL check then.  The checker just wants
it to be consistent.

regards,
dan carpenter