* [iwlwifi-next:next 13/93] drivers/net/wireless/intel/iwlwifi/mld/tx.c:571 iwl_mld_fill_tx_cmd() warn: variable dereferenced before check 'mld_sta' (see line 565)
@ 2026-05-18 5:03 ` Dan Carpenter
0 siblings, 0 replies; 4+ messages in thread
From: kernel test robot @ 2026-05-17 2:25 UTC (permalink / raw)
To: oe-kbuild; +Cc: lkp, Dan Carpenter
BCC: lkp@intel.com
CC: oe-kbuild-all@lists.linux.dev
TO: Miri Korenblit <miriam.rachel.korenblit@intel.com>
CC: Johannes Berg <johannes.berg@intel.com>
tree: https://git.kernel.org/pub/scm/linux/kernel/git/iwlwifi/iwlwifi-next.git next
head: ce2b645bb3099ef4d96759335271e25875202ce9
commit: d751c944055aedf33a6cab9b1cadaab65d7bc8dd [13/93] wifi: iwlwifi: mld: use host rate for NAN management frames
:::::: branch date: 7 hours ago
:::::: commit date: 5 days ago
config: i386-randconfig-141-20260517 (https://download.01.org/0day-ci/archive/20260517/202605171045.6jPun4QF-lkp@intel.com/config)
compiler: clang version 20.1.8 (https://github.com/llvm/llvm-project 87f0227cb60147a26a1eeb4fb06e3b505e9c7261)
smatch: v0.5.0-9185-gbcc58b9c
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Reported-by: Dan Carpenter <error27@gmail.com>
| Closes: https://lore.kernel.org/r/202605171045.6jPun4QF-lkp@intel.com/
smatch warnings:
drivers/net/wireless/intel/iwlwifi/mld/tx.c:571 iwl_mld_fill_tx_cmd() warn: variable dereferenced before check 'mld_sta' (see line 565)
vim +/mld_sta +571 drivers/net/wireless/intel/iwlwifi/mld/tx.c
d1e879ec600f9b3 Miri Korenblit 2025-02-16 537
d1e879ec600f9b3 Miri Korenblit 2025-02-16 538 static void
d1e879ec600f9b3 Miri Korenblit 2025-02-16 539 iwl_mld_fill_tx_cmd(struct iwl_mld *mld, struct sk_buff *skb,
d1e879ec600f9b3 Miri Korenblit 2025-02-16 540 struct iwl_device_tx_cmd *dev_tx_cmd,
d1e879ec600f9b3 Miri Korenblit 2025-02-16 541 struct ieee80211_sta *sta)
d1e879ec600f9b3 Miri Korenblit 2025-02-16 542 {
d1e879ec600f9b3 Miri Korenblit 2025-02-16 543 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
d1e879ec600f9b3 Miri Korenblit 2025-02-16 544 struct ieee80211_hdr *hdr = (void *)skb->data;
d1e879ec600f9b3 Miri Korenblit 2025-02-16 545 struct iwl_mld_sta *mld_sta = sta ? iwl_mld_sta_from_mac80211(sta) :
d1e879ec600f9b3 Miri Korenblit 2025-02-16 546 NULL;
1c97c73cdab0afc Miri Korenblit 2025-05-11 547 struct iwl_tx_cmd *tx_cmd;
d1e879ec600f9b3 Miri Korenblit 2025-02-16 548 bool amsdu = ieee80211_is_data_qos(hdr->frame_control) &&
d1e879ec600f9b3 Miri Korenblit 2025-02-16 549 (*ieee80211_get_qos_ctl(hdr) &
d1e879ec600f9b3 Miri Korenblit 2025-02-16 550 IEEE80211_QOS_CTL_A_MSDU_PRESENT);
dabc88cb3b78c0d Johannes Berg 2025-05-05 551 __le32 rate_n_flags = 0;
d1e879ec600f9b3 Miri Korenblit 2025-02-16 552 u16 flags = 0;
d1e879ec600f9b3 Miri Korenblit 2025-02-16 553
d1e879ec600f9b3 Miri Korenblit 2025-02-16 554 dev_tx_cmd->hdr.cmd = TX_CMD;
d1e879ec600f9b3 Miri Korenblit 2025-02-16 555
d1e879ec600f9b3 Miri Korenblit 2025-02-16 556 if (!info->control.hw_key)
d1e879ec600f9b3 Miri Korenblit 2025-02-16 557 flags |= IWL_TX_FLAGS_ENCRYPT_DIS;
d1e879ec600f9b3 Miri Korenblit 2025-02-16 558
d1e879ec600f9b3 Miri Korenblit 2025-02-16 559 /* For data and mgmt packets rate info comes from the fw.
d751c944055aedf Miri Korenblit 2026-05-10 560 * Only set rate/antenna for:
d751c944055aedf Miri Korenblit 2026-05-10 561 * - injected frames with fixed rate,
d751c944055aedf Miri Korenblit 2026-05-10 562 * - when no sta is given.
d751c944055aedf Miri Korenblit 2026-05-10 563 * - frames that are sent to an NMI sta, which is only used for management.
d1e879ec600f9b3 Miri Korenblit 2025-02-16 564 */
d751c944055aedf Miri Korenblit 2026-05-10 @565 if (unlikely(!sta || mld_sta->vif->type == NL80211_IFTYPE_NAN ||
d1e879ec600f9b3 Miri Korenblit 2025-02-16 566 info->control.flags & IEEE80211_TX_CTRL_RATE_INJECT)) {
d1e879ec600f9b3 Miri Korenblit 2025-02-16 567 flags |= IWL_TX_FLAGS_CMD_RATE;
d1e879ec600f9b3 Miri Korenblit 2025-02-16 568 rate_n_flags = iwl_mld_get_tx_rate_n_flags(mld, info, sta,
d1e879ec600f9b3 Miri Korenblit 2025-02-16 569 hdr->frame_control);
d1e879ec600f9b3 Miri Korenblit 2025-02-16 570 } else if (!ieee80211_is_data(hdr->frame_control) ||
d1e879ec600f9b3 Miri Korenblit 2025-02-16 @571 (mld_sta &&
d1e879ec600f9b3 Miri Korenblit 2025-02-16 572 mld_sta->sta_state < IEEE80211_STA_AUTHORIZED)) {
d1e879ec600f9b3 Miri Korenblit 2025-02-16 573 /* These are important frames */
d1e879ec600f9b3 Miri Korenblit 2025-02-16 574 flags |= IWL_TX_FLAGS_HIGH_PRI;
d1e879ec600f9b3 Miri Korenblit 2025-02-16 575 }
d1e879ec600f9b3 Miri Korenblit 2025-02-16 576
d1e879ec600f9b3 Miri Korenblit 2025-02-16 577 tx_cmd = (void *)dev_tx_cmd->payload;
d1e879ec600f9b3 Miri Korenblit 2025-02-16 578
d1e879ec600f9b3 Miri Korenblit 2025-02-16 579 iwl_mld_fill_tx_cmd_hdr(tx_cmd, skb, amsdu);
d1e879ec600f9b3 Miri Korenblit 2025-02-16 580
d1e879ec600f9b3 Miri Korenblit 2025-02-16 581 tx_cmd->offload_assist = iwl_mld_get_offload_assist(skb, amsdu);
d1e879ec600f9b3 Miri Korenblit 2025-02-16 582
d1e879ec600f9b3 Miri Korenblit 2025-02-16 583 /* Total # bytes to be transmitted */
d1e879ec600f9b3 Miri Korenblit 2025-02-16 584 tx_cmd->len = cpu_to_le16((u16)skb->len);
d1e879ec600f9b3 Miri Korenblit 2025-02-16 585
d1e879ec600f9b3 Miri Korenblit 2025-02-16 586 tx_cmd->flags = cpu_to_le16(flags);
d1e879ec600f9b3 Miri Korenblit 2025-02-16 587
dabc88cb3b78c0d Johannes Berg 2025-05-05 588 tx_cmd->rate_n_flags = rate_n_flags;
d1e879ec600f9b3 Miri Korenblit 2025-02-16 589 }
d1e879ec600f9b3 Miri Korenblit 2025-02-16 590
:::::: The code at line 571 was first introduced by commit
:::::: d1e879ec600f9b3bdd253167533959facfefb17b wifi: iwlwifi: add iwlmld sub-driver
:::::: TO: Miri Korenblit <miriam.rachel.korenblit@intel.com>
:::::: CC: Johannes Berg <johannes.berg@intel.com>
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
^ permalink raw reply [flat|nested] 4+ messages in thread* [iwlwifi-next:next 13/93] drivers/net/wireless/intel/iwlwifi/mld/tx.c:571 iwl_mld_fill_tx_cmd() warn: variable dereferenced before check 'mld_sta' (see line 565)
@ 2026-05-18 5:03 ` Dan Carpenter
0 siblings, 0 replies; 4+ messages in thread
From: Dan Carpenter @ 2026-05-18 5:03 UTC (permalink / raw)
To: oe-kbuild, Miri Korenblit; +Cc: lkp, oe-kbuild-all, Johannes Berg
tree: https://git.kernel.org/pub/scm/linux/kernel/git/iwlwifi/iwlwifi-next.git next
head: ce2b645bb3099ef4d96759335271e25875202ce9
commit: d751c944055aedf33a6cab9b1cadaab65d7bc8dd [13/93] wifi: iwlwifi: mld: use host rate for NAN management frames
config: i386-randconfig-141-20260517 (https://download.01.org/0day-ci/archive/20260517/202605171045.6jPun4QF-lkp@intel.com/config)
compiler: clang version 20.1.8 (https://github.com/llvm/llvm-project 87f0227cb60147a26a1eeb4fb06e3b505e9c7261)
smatch: v0.5.0-9185-gbcc58b9c
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Reported-by: Dan Carpenter <error27@gmail.com>
| Closes: https://lore.kernel.org/r/202605171045.6jPun4QF-lkp@intel.com/
smatch warnings:
drivers/net/wireless/intel/iwlwifi/mld/tx.c:571 iwl_mld_fill_tx_cmd() warn: variable dereferenced before check 'mld_sta' (see line 565)
vim +/mld_sta +571 drivers/net/wireless/intel/iwlwifi/mld/tx.c
d1e879ec600f9b3 Miri Korenblit 2025-02-16 538 static void
d1e879ec600f9b3 Miri Korenblit 2025-02-16 539 iwl_mld_fill_tx_cmd(struct iwl_mld *mld, struct sk_buff *skb,
d1e879ec600f9b3 Miri Korenblit 2025-02-16 540 struct iwl_device_tx_cmd *dev_tx_cmd,
d1e879ec600f9b3 Miri Korenblit 2025-02-16 541 struct ieee80211_sta *sta)
d1e879ec600f9b3 Miri Korenblit 2025-02-16 542 {
d1e879ec600f9b3 Miri Korenblit 2025-02-16 543 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
d1e879ec600f9b3 Miri Korenblit 2025-02-16 544 struct ieee80211_hdr *hdr = (void *)skb->data;
d1e879ec600f9b3 Miri Korenblit 2025-02-16 545 struct iwl_mld_sta *mld_sta = sta ? iwl_mld_sta_from_mac80211(sta) :
d1e879ec600f9b3 Miri Korenblit 2025-02-16 546 NULL;
1c97c73cdab0afc Miri Korenblit 2025-05-11 547 struct iwl_tx_cmd *tx_cmd;
d1e879ec600f9b3 Miri Korenblit 2025-02-16 548 bool amsdu = ieee80211_is_data_qos(hdr->frame_control) &&
d1e879ec600f9b3 Miri Korenblit 2025-02-16 549 (*ieee80211_get_qos_ctl(hdr) &
d1e879ec600f9b3 Miri Korenblit 2025-02-16 550 IEEE80211_QOS_CTL_A_MSDU_PRESENT);
dabc88cb3b78c0d Johannes Berg 2025-05-05 551 __le32 rate_n_flags = 0;
d1e879ec600f9b3 Miri Korenblit 2025-02-16 552 u16 flags = 0;
d1e879ec600f9b3 Miri Korenblit 2025-02-16 553
d1e879ec600f9b3 Miri Korenblit 2025-02-16 554 dev_tx_cmd->hdr.cmd = TX_CMD;
d1e879ec600f9b3 Miri Korenblit 2025-02-16 555
d1e879ec600f9b3 Miri Korenblit 2025-02-16 556 if (!info->control.hw_key)
d1e879ec600f9b3 Miri Korenblit 2025-02-16 557 flags |= IWL_TX_FLAGS_ENCRYPT_DIS;
d1e879ec600f9b3 Miri Korenblit 2025-02-16 558
d1e879ec600f9b3 Miri Korenblit 2025-02-16 559 /* For data and mgmt packets rate info comes from the fw.
d751c944055aedf Miri Korenblit 2026-05-10 560 * Only set rate/antenna for:
d751c944055aedf Miri Korenblit 2026-05-10 561 * - injected frames with fixed rate,
d751c944055aedf Miri Korenblit 2026-05-10 562 * - when no sta is given.
d751c944055aedf Miri Korenblit 2026-05-10 563 * - frames that are sent to an NMI sta, which is only used for management.
d1e879ec600f9b3 Miri Korenblit 2025-02-16 564 */
d751c944055aedf Miri Korenblit 2026-05-10 @565 if (unlikely(!sta || mld_sta->vif->type == NL80211_IFTYPE_NAN ||
^^^^^^^^^^^^^^^^^^
Dereference
d1e879ec600f9b3 Miri Korenblit 2025-02-16 566 info->control.flags & IEEE80211_TX_CTRL_RATE_INJECT)) {
d1e879ec600f9b3 Miri Korenblit 2025-02-16 567 flags |= IWL_TX_FLAGS_CMD_RATE;
d1e879ec600f9b3 Miri Korenblit 2025-02-16 568 rate_n_flags = iwl_mld_get_tx_rate_n_flags(mld, info, sta,
d1e879ec600f9b3 Miri Korenblit 2025-02-16 569 hdr->frame_control);
d1e879ec600f9b3 Miri Korenblit 2025-02-16 570 } else if (!ieee80211_is_data(hdr->frame_control) ||
d1e879ec600f9b3 Miri Korenblit 2025-02-16 @571 (mld_sta &&
^^^^^^^
Checked too late.
d1e879ec600f9b3 Miri Korenblit 2025-02-16 572 mld_sta->sta_state < IEEE80211_STA_AUTHORIZED)) {
d1e879ec600f9b3 Miri Korenblit 2025-02-16 573 /* These are important frames */
d1e879ec600f9b3 Miri Korenblit 2025-02-16 574 flags |= IWL_TX_FLAGS_HIGH_PRI;
d1e879ec600f9b3 Miri Korenblit 2025-02-16 575 }
d1e879ec600f9b3 Miri Korenblit 2025-02-16 576
d1e879ec600f9b3 Miri Korenblit 2025-02-16 577 tx_cmd = (void *)dev_tx_cmd->payload;
d1e879ec600f9b3 Miri Korenblit 2025-02-16 578
d1e879ec600f9b3 Miri Korenblit 2025-02-16 579 iwl_mld_fill_tx_cmd_hdr(tx_cmd, skb, amsdu);
d1e879ec600f9b3 Miri Korenblit 2025-02-16 580
d1e879ec600f9b3 Miri Korenblit 2025-02-16 581 tx_cmd->offload_assist = iwl_mld_get_offload_assist(skb, amsdu);
d1e879ec600f9b3 Miri Korenblit 2025-02-16 582
d1e879ec600f9b3 Miri Korenblit 2025-02-16 583 /* Total # bytes to be transmitted */
d1e879ec600f9b3 Miri Korenblit 2025-02-16 584 tx_cmd->len = cpu_to_le16((u16)skb->len);
d1e879ec600f9b3 Miri Korenblit 2025-02-16 585
d1e879ec600f9b3 Miri Korenblit 2025-02-16 586 tx_cmd->flags = cpu_to_le16(flags);
d1e879ec600f9b3 Miri Korenblit 2025-02-16 587
dabc88cb3b78c0d Johannes Berg 2025-05-05 588 tx_cmd->rate_n_flags = rate_n_flags;
d1e879ec600f9b3 Miri Korenblit 2025-02-16 589 }
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
^ permalink raw reply [flat|nested] 4+ messages in thread* RE: [iwlwifi-next:next 13/93] drivers/net/wireless/intel/iwlwifi/mld/tx.c:571 iwl_mld_fill_tx_cmd() warn: variable dereferenced before check 'mld_sta' (see line 565)
2026-05-18 5:03 ` Dan Carpenter
(?)
@ 2026-05-18 5:11 ` Korenblit, Miriam Rachel
2026-05-18 5:14 ` Dan Carpenter
-1 siblings, 1 reply; 4+ messages in thread
From: Korenblit, Miriam Rachel @ 2026-05-18 5:11 UTC (permalink / raw)
To: Dan Carpenter, oe-kbuild@lists.linux.dev
Cc: lkp, oe-kbuild-all@lists.linux.dev, Berg, Johannes
> -----Original Message-----
> From: Dan Carpenter <error27@gmail.com>
> Sent: Monday, May 18, 2026 8:03 AM
> To: oe-kbuild@lists.linux.dev; Korenblit, Miriam Rachel
> <miriam.rachel.korenblit@intel.com>
> Cc: lkp <lkp@intel.com>; oe-kbuild-all@lists.linux.dev; Berg, Johannes
> <johannes.berg@intel.com>
> Subject: [iwlwifi-next:next 13/93] drivers/net/wireless/intel/iwlwifi/mld/tx.c:571
> iwl_mld_fill_tx_cmd() warn: variable dereferenced before check 'mld_sta' (see
> line 565)
>
> tree: https://git.kernel.org/pub/scm/linux/kernel/git/iwlwifi/iwlwifi-next.git
> next
> head: ce2b645bb3099ef4d96759335271e25875202ce9
> commit: d751c944055aedf33a6cab9b1cadaab65d7bc8dd [13/93] wifi: iwlwifi:
> mld: use host rate for NAN management frames
> config: i386-randconfig-141-20260517 (https://download.01.org/0day-
> ci/archive/20260517/202605171045.6jPun4QF-lkp@intel.com/config)
> compiler: clang version 20.1.8 (https://github.com/llvm/llvm-project
> 87f0227cb60147a26a1eeb4fb06e3b505e9c7261)
> smatch: v0.5.0-9185-gbcc58b9c
>
> If you fix the issue in a separate patch/commit (i.e. not just a new version of the
> same patch/commit), kindly add following tags
> | Reported-by: kernel test robot <lkp@intel.com>
> | Reported-by: Dan Carpenter <error27@gmail.com>
> | Closes: https://lore.kernel.org/r/202605171045.6jPun4QF-lkp@intel.com/
>
> smatch warnings:
> drivers/net/wireless/intel/iwlwifi/mld/tx.c:571 iwl_mld_fill_tx_cmd() warn:
> variable dereferenced before check 'mld_sta' (see line 565)
>
> vim +/mld_sta +571 drivers/net/wireless/intel/iwlwifi/mld/tx.c
>
> d1e879ec600f9b3 Miri Korenblit 2025-02-16 538 static void
> d1e879ec600f9b3 Miri Korenblit 2025-02-16 539 iwl_mld_fill_tx_cmd(struct
> iwl_mld *mld, struct sk_buff *skb,
> d1e879ec600f9b3 Miri Korenblit 2025-02-16 540 struct
> iwl_device_tx_cmd *dev_tx_cmd,
> d1e879ec600f9b3 Miri Korenblit 2025-02-16 541 struct
> ieee80211_sta *sta)
> d1e879ec600f9b3 Miri Korenblit 2025-02-16 542 {
> d1e879ec600f9b3 Miri Korenblit 2025-02-16 543 struct
> ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
> d1e879ec600f9b3 Miri Korenblit 2025-02-16 544 struct ieee80211_hdr
> *hdr = (void *)skb->data;
> d1e879ec600f9b3 Miri Korenblit 2025-02-16 545 struct iwl_mld_sta
> *mld_sta = sta ? iwl_mld_sta_from_mac80211(sta) :
> d1e879ec600f9b3 Miri Korenblit 2025-02-16 546
> NULL;
> 1c97c73cdab0afc Miri Korenblit 2025-05-11 547 struct iwl_tx_cmd
> *tx_cmd;
> d1e879ec600f9b3 Miri Korenblit 2025-02-16 548 bool amsdu =
> ieee80211_is_data_qos(hdr->frame_control) &&
> d1e879ec600f9b3 Miri Korenblit 2025-02-16 549
> (*ieee80211_get_qos_ctl(hdr) &
> d1e879ec600f9b3 Miri Korenblit 2025-02-16 550
> IEEE80211_QOS_CTL_A_MSDU_PRESENT);
> dabc88cb3b78c0d Johannes Berg 2025-05-05 551 __le32 rate_n_flags =
> 0;
> d1e879ec600f9b3 Miri Korenblit 2025-02-16 552 u16 flags = 0;
> d1e879ec600f9b3 Miri Korenblit 2025-02-16 553
> d1e879ec600f9b3 Miri Korenblit 2025-02-16 554 dev_tx_cmd->hdr.cmd
> = TX_CMD;
> d1e879ec600f9b3 Miri Korenblit 2025-02-16 555
> d1e879ec600f9b3 Miri Korenblit 2025-02-16 556 if (!info-
> >control.hw_key)
> d1e879ec600f9b3 Miri Korenblit 2025-02-16 557 flags |=
> IWL_TX_FLAGS_ENCRYPT_DIS;
> d1e879ec600f9b3 Miri Korenblit 2025-02-16 558
> d1e879ec600f9b3 Miri Korenblit 2025-02-16 559 /* For data and mgmt
> packets rate info comes from the fw.
> d751c944055aedf Miri Korenblit 2026-05-10 560 * Only set
> rate/antenna for:
> d751c944055aedf Miri Korenblit 2026-05-10 561 * - injected frames
> with fixed rate,
> d751c944055aedf Miri Korenblit 2026-05-10 562 * - when no sta is
> given.
> d751c944055aedf Miri Korenblit 2026-05-10 563 * - frames that are
> sent to an NMI sta, which is only used for management.
> d1e879ec600f9b3 Miri Korenblit 2025-02-16 564 */
> d751c944055aedf Miri Korenblit 2026-05-10 @565 if (unlikely(!sta ||
> mld_sta->vif->type == NL80211_IFTYPE_NAN ||
> ^^^^^^^^^^^^^^^^^^ Dereference
This is not a real issue because (sta != NULL) -> (mld_sta != NULL)
>
> d1e879ec600f9b3 Miri Korenblit 2025-02-16 566 info-
> >control.flags & IEEE80211_TX_CTRL_RATE_INJECT)) {
> d1e879ec600f9b3 Miri Korenblit 2025-02-16 567 flags |=
> IWL_TX_FLAGS_CMD_RATE;
> d1e879ec600f9b3 Miri Korenblit 2025-02-16 568 rate_n_flags =
> iwl_mld_get_tx_rate_n_flags(mld, info, sta,
> d1e879ec600f9b3 Miri Korenblit 2025-02-16 569
> hdr->frame_control);
> d1e879ec600f9b3 Miri Korenblit 2025-02-16 570 } else if
> (!ieee80211_is_data(hdr->frame_control) ||
> d1e879ec600f9b3 Miri Korenblit 2025-02-16 @571 (mld_sta &&
> ^^^^^^^ Checked too late.
>
> d1e879ec600f9b3 Miri Korenblit 2025-02-16 572 mld_sta-
> >sta_state < IEEE80211_STA_AUTHORIZED)) {
> d1e879ec600f9b3 Miri Korenblit 2025-02-16 573 /* These are
> important frames */
> d1e879ec600f9b3 Miri Korenblit 2025-02-16 574 flags |=
> IWL_TX_FLAGS_HIGH_PRI;
> d1e879ec600f9b3 Miri Korenblit 2025-02-16 575 }
> d1e879ec600f9b3 Miri Korenblit 2025-02-16 576
> d1e879ec600f9b3 Miri Korenblit 2025-02-16 577 tx_cmd = (void
> *)dev_tx_cmd->payload;
> d1e879ec600f9b3 Miri Korenblit 2025-02-16 578
> d1e879ec600f9b3 Miri Korenblit 2025-02-16 579
> iwl_mld_fill_tx_cmd_hdr(tx_cmd, skb, amsdu);
> d1e879ec600f9b3 Miri Korenblit 2025-02-16 580
> d1e879ec600f9b3 Miri Korenblit 2025-02-16 581 tx_cmd-
> >offload_assist = iwl_mld_get_offload_assist(skb, amsdu);
> d1e879ec600f9b3 Miri Korenblit 2025-02-16 582
> d1e879ec600f9b3 Miri Korenblit 2025-02-16 583 /* Total # bytes to be
> transmitted */
> d1e879ec600f9b3 Miri Korenblit 2025-02-16 584 tx_cmd->len =
> cpu_to_le16((u16)skb->len);
> d1e879ec600f9b3 Miri Korenblit 2025-02-16 585
> d1e879ec600f9b3 Miri Korenblit 2025-02-16 586 tx_cmd->flags =
> cpu_to_le16(flags);
> d1e879ec600f9b3 Miri Korenblit 2025-02-16 587
> dabc88cb3b78c0d Johannes Berg 2025-05-05 588 tx_cmd->rate_n_flags
> = rate_n_flags;
> d1e879ec600f9b3 Miri Korenblit 2025-02-16 589 }
>
> --
> 0-DAY CI Kernel Test Service
> https://github.com/intel/lkp-tests/wiki
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: [iwlwifi-next:next 13/93] drivers/net/wireless/intel/iwlwifi/mld/tx.c:571 iwl_mld_fill_tx_cmd() warn: variable dereferenced before check 'mld_sta' (see line 565)
2026-05-18 5:11 ` Korenblit, Miriam Rachel
@ 2026-05-18 5:14 ` Dan Carpenter
0 siblings, 0 replies; 4+ messages in thread
From: Dan Carpenter @ 2026-05-18 5:14 UTC (permalink / raw)
To: Korenblit, Miriam Rachel
Cc: oe-kbuild@lists.linux.dev, lkp, oe-kbuild-all@lists.linux.dev,
Berg, Johannes
On Mon, May 18, 2026 at 05:11:00AM +0000, Korenblit, Miriam Rachel wrote:
>
>
> > -----Original Message-----
> > From: Dan Carpenter <error27@gmail.com>
> > Sent: Monday, May 18, 2026 8:03 AM
> > To: oe-kbuild@lists.linux.dev; Korenblit, Miriam Rachel
> > <miriam.rachel.korenblit@intel.com>
> > Cc: lkp <lkp@intel.com>; oe-kbuild-all@lists.linux.dev; Berg, Johannes
> > <johannes.berg@intel.com>
> > Subject: [iwlwifi-next:next 13/93] drivers/net/wireless/intel/iwlwifi/mld/tx.c:571
> > iwl_mld_fill_tx_cmd() warn: variable dereferenced before check 'mld_sta' (see
> > line 565)
> >
> > tree: https://git.kernel.org/pub/scm/linux/kernel/git/iwlwifi/iwlwifi-next.git
> > next
> > head: ce2b645bb3099ef4d96759335271e25875202ce9
> > commit: d751c944055aedf33a6cab9b1cadaab65d7bc8dd [13/93] wifi: iwlwifi:
> > mld: use host rate for NAN management frames
> > config: i386-randconfig-141-20260517 (https://download.01.org/0day-
> > ci/archive/20260517/202605171045.6jPun4QF-lkp@intel.com/config)
> > compiler: clang version 20.1.8 (https://github.com/llvm/llvm-project
> > 87f0227cb60147a26a1eeb4fb06e3b505e9c7261)
> > smatch: v0.5.0-9185-gbcc58b9c
> >
> > If you fix the issue in a separate patch/commit (i.e. not just a new version of the
> > same patch/commit), kindly add following tags
> > | Reported-by: kernel test robot <lkp@intel.com>
> > | Reported-by: Dan Carpenter <error27@gmail.com>
> > | Closes: https://lore.kernel.org/r/202605171045.6jPun4QF-lkp@intel.com/
> >
> > smatch warnings:
> > drivers/net/wireless/intel/iwlwifi/mld/tx.c:571 iwl_mld_fill_tx_cmd() warn:
> > variable dereferenced before check 'mld_sta' (see line 565)
> >
> > vim +/mld_sta +571 drivers/net/wireless/intel/iwlwifi/mld/tx.c
> >
> > d1e879ec600f9b3 Miri Korenblit 2025-02-16 538 static void
> > d1e879ec600f9b3 Miri Korenblit 2025-02-16 539 iwl_mld_fill_tx_cmd(struct
> > iwl_mld *mld, struct sk_buff *skb,
> > d1e879ec600f9b3 Miri Korenblit 2025-02-16 540 struct
> > iwl_device_tx_cmd *dev_tx_cmd,
> > d1e879ec600f9b3 Miri Korenblit 2025-02-16 541 struct
> > ieee80211_sta *sta)
> > d1e879ec600f9b3 Miri Korenblit 2025-02-16 542 {
> > d1e879ec600f9b3 Miri Korenblit 2025-02-16 543 struct
> > ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
> > d1e879ec600f9b3 Miri Korenblit 2025-02-16 544 struct ieee80211_hdr
> > *hdr = (void *)skb->data;
> > d1e879ec600f9b3 Miri Korenblit 2025-02-16 545 struct iwl_mld_sta
> > *mld_sta = sta ? iwl_mld_sta_from_mac80211(sta) :
> > d1e879ec600f9b3 Miri Korenblit 2025-02-16 546
> > NULL;
> > 1c97c73cdab0afc Miri Korenblit 2025-05-11 547 struct iwl_tx_cmd
> > *tx_cmd;
> > d1e879ec600f9b3 Miri Korenblit 2025-02-16 548 bool amsdu =
> > ieee80211_is_data_qos(hdr->frame_control) &&
> > d1e879ec600f9b3 Miri Korenblit 2025-02-16 549
> > (*ieee80211_get_qos_ctl(hdr) &
> > d1e879ec600f9b3 Miri Korenblit 2025-02-16 550
> > IEEE80211_QOS_CTL_A_MSDU_PRESENT);
> > dabc88cb3b78c0d Johannes Berg 2025-05-05 551 __le32 rate_n_flags =
> > 0;
> > d1e879ec600f9b3 Miri Korenblit 2025-02-16 552 u16 flags = 0;
> > d1e879ec600f9b3 Miri Korenblit 2025-02-16 553
> > d1e879ec600f9b3 Miri Korenblit 2025-02-16 554 dev_tx_cmd->hdr.cmd
> > = TX_CMD;
> > d1e879ec600f9b3 Miri Korenblit 2025-02-16 555
> > d1e879ec600f9b3 Miri Korenblit 2025-02-16 556 if (!info-
> > >control.hw_key)
> > d1e879ec600f9b3 Miri Korenblit 2025-02-16 557 flags |=
> > IWL_TX_FLAGS_ENCRYPT_DIS;
> > d1e879ec600f9b3 Miri Korenblit 2025-02-16 558
> > d1e879ec600f9b3 Miri Korenblit 2025-02-16 559 /* For data and mgmt
> > packets rate info comes from the fw.
> > d751c944055aedf Miri Korenblit 2026-05-10 560 * Only set
> > rate/antenna for:
> > d751c944055aedf Miri Korenblit 2026-05-10 561 * - injected frames
> > with fixed rate,
> > d751c944055aedf Miri Korenblit 2026-05-10 562 * - when no sta is
> > given.
> > d751c944055aedf Miri Korenblit 2026-05-10 563 * - frames that are
> > sent to an NMI sta, which is only used for management.
> > d1e879ec600f9b3 Miri Korenblit 2025-02-16 564 */
> > d751c944055aedf Miri Korenblit 2026-05-10 @565 if (unlikely(!sta ||
> > mld_sta->vif->type == NL80211_IFTYPE_NAN ||
> > ^^^^^^^^^^^^^^^^^^ Dereference
>
>
> This is not a real issue because (sta != NULL) -> (mld_sta != NULL)
>
You could delete the other NULL check then. The checker just wants
it to be consistent.
regards,
dan carpenter
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2026-05-18 5:14 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-05-17 2:25 [iwlwifi-next:next 13/93] drivers/net/wireless/intel/iwlwifi/mld/tx.c:571 iwl_mld_fill_tx_cmd() warn: variable dereferenced before check 'mld_sta' (see line 565) kernel test robot
2026-05-18 5:03 ` Dan Carpenter
2026-05-18 5:11 ` Korenblit, Miriam Rachel
2026-05-18 5:14 ` Dan Carpenter
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.