[PATCH 0/2] Fix two possible NULL pointer dereferencing issues

[PATCH 0/2] Fix two possible NULL pointer dereferencing issues

[Lorenzo Bianconi]

Lorenzo Bianconi (2):
  mt76: fix possible NULL pointer dereferencing in mt76x2_ampdu_action()
  mt76: fix possible NULL pointer dereferencing in
    mt76x2_mac_write_txwi()

 drivers/net/wireless/mediatek/mt76/mt76x2_mac.c  | 2 +-
 drivers/net/wireless/mediatek/mt76/mt76x2_main.c | 4 +++-
 2 files changed, 4 insertions(+), 2 deletions(-)

-- 
2.13.6

[PATCH 1/2] mt76: fix possible NULL pointer dereferencing in mt76x2_ampdu_action()

[Lorenzo Bianconi]

Initialize mt76_txq pointer after ieee80211_txq pointer check.
Remove space after the pointer cast

Fixes: 7bc04215a66b ("mt76: add driver code for MT76x2e")
Signed-off-by: Lorenzo Bianconi <lorenzo.bianconi@redhat.com>
---
 drivers/net/wireless/mediatek/mt76/mt76x2_main.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/net/wireless/mediatek/mt76/mt76x2_main.c b/drivers/net/wireless/mediatek/mt76/mt76x2_main.c
index 2cef48edb275..33469e32567b 100644
--- a/drivers/net/wireless/mediatek/mt76/mt76x2_main.c
+++ b/drivers/net/wireless/mediatek/mt76/mt76x2_main.c
@@ -450,13 +450,15 @@ mt76x2_ampdu_action(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
 	struct mt76x2_dev *dev = hw->priv;
 	struct mt76x2_sta *msta = (struct mt76x2_sta *) sta->drv_priv;
 	struct ieee80211_txq *txq = sta->txq[params->tid];
-	struct mt76_txq *mtxq = (struct mt76_txq *) txq->drv_priv;
 	u16 tid = params->tid;
 	u16 *ssn = &params->ssn;
+	struct mt76_txq *mtxq;
 
 	if (!txq)
 		return -EINVAL;
 
+	mtxq = (struct mt76_txq *)txq->drv_priv;
+
 	switch (action) {
 	case IEEE80211_AMPDU_RX_START:
 		mt76_set(dev, MT_WCID_ADDR(msta->wcid.idx) + 4, BIT(16 + tid));
-- 
2.13.6

Re: [1/2] mt76: fix possible NULL pointer dereferencing in mt76x2_ampdu_action()

[Kalle Valo]

Lorenzo Bianconi <lorenzo.bianconi@redhat.com> wrote:

> Initialize mt76_txq pointer after ieee80211_txq pointer check.
> Remove space after the pointer cast
> 
> Fixes: 7bc04215a66b ("mt76: add driver code for MT76x2e")
> Signed-off-by: Lorenzo Bianconi <lorenzo.bianconi@redhat.com>

What am I supposed to do with this and patch 2? Drop?

-- 
https://patchwork.kernel.org/patch/10111937/

https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches

Re: [1/2] mt76: fix possible NULL pointer dereferencing in mt76x2_ampdu_action()

[Lorenzo Bianconi]

> Lorenzo Bianconi <lorenzo.bianconi@redhat.com> wrote:
>
>> Initialize mt76_txq pointer after ieee80211_txq pointer check.
>> Remove space after the pointer cast
>>
>> Fixes: 7bc04215a66b ("mt76: add driver code for MT76x2e")
>> Signed-off-by: Lorenzo Bianconi <lorenzo.bianconi@redhat.com>
>
> What am I supposed to do with this and patch 2? Drop?

Hi Kalle,

What do you mean? Why drop?

Regards,
Lorenzo

>
> --
> https://patchwork.kernel.org/patch/10111937/
>
> https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches
>

Re: [1/2] mt76: fix possible NULL pointer dereferencing in mt76x2_ampdu_action()

[Kalle Valo]

Lorenzo Bianconi <lorenzo.bianconi@redhat.com> writes:

>> Lorenzo Bianconi <lorenzo.bianconi@redhat.com> wrote:
>>
>>> Initialize mt76_txq pointer after ieee80211_txq pointer check.
>>> Remove space after the pointer cast
>>>
>>> Fixes: 7bc04215a66b ("mt76: add driver code for MT76x2e")
>>> Signed-off-by: Lorenzo Bianconi <lorenzo.bianconi@redhat.com>
>>
>> What am I supposed to do with this and patch 2? Drop?
>
> What do you mean? Why drop?

I didn't see Felix's ack, at least not on patchwork.

-- 
Kalle Valo

Re: [1/2] mt76: fix possible NULL pointer dereferencing in mt76x2_ampdu_action()

[Lorenzo Bianconi]

> Lorenzo Bianconi <lorenzo.bianconi@redhat.com> writes:
>
>>> Lorenzo Bianconi <lorenzo.bianconi@redhat.com> wrote:
>>>
>>>> Initialize mt76_txq pointer after ieee80211_txq pointer check.
>>>> Remove space after the pointer cast
>>>>
>>>> Fixes: 7bc04215a66b ("mt76: add driver code for MT76x2e")
>>>> Signed-off-by: Lorenzo Bianconi <lorenzo.bianconi@redhat.com>
>>>
>>> What am I supposed to do with this and patch 2? Drop?
>>
>> What do you mean? Why drop?
>
> I didn't see Felix's ack, at least not on patchwork.
>
> --
> Kalle Valo

They should be fine since he merged them in mt76 github repo:
- https://github.com/openwrt/mt76/commit/ca5ca8c779932e7cab3224053377b29f139904b9
- https://github.com/openwrt/mt76/commit/2d4b8f57cc5e3101d45785ae9a9f1eb6fc229de9

Anyway we can wait for him, up to you.
Regards,

Lorenzo

Re: [1/2] mt76: fix possible NULL pointer dereferencing in mt76x2_ampdu_action()

[Felix Fietkau]

On 2018-01-08 19:16, Kalle Valo wrote:
> Lorenzo Bianconi <lorenzo.bianconi@redhat.com> writes:
> 
>>> Lorenzo Bianconi <lorenzo.bianconi@redhat.com> wrote:
>>>
>>>> Initialize mt76_txq pointer after ieee80211_txq pointer check.
>>>> Remove space after the pointer cast
>>>>
>>>> Fixes: 7bc04215a66b ("mt76: add driver code for MT76x2e")
>>>> Signed-off-by: Lorenzo Bianconi <lorenzo.bianconi@redhat.com>
>>>
>>> What am I supposed to do with this and patch 2? Drop?
>>
>> What do you mean? Why drop?
> 
> I didn't see Felix's ack, at least not on patchwork.
I sent my ack (for both patches) as a reply to 0/2
These patches should go in.

- Felix

Re: [1/2] mt76: fix possible NULL pointer dereferencing in mt76x2_ampdu_action()

[Kalle Valo]

Felix Fietkau <nbd@nbd.name> writes:

> On 2018-01-08 19:16, Kalle Valo wrote:
>> Lorenzo Bianconi <lorenzo.bianconi@redhat.com> writes:
>> 
>>>> Lorenzo Bianconi <lorenzo.bianconi@redhat.com> wrote:
>>>>
>>>>> Initialize mt76_txq pointer after ieee80211_txq pointer check.
>>>>> Remove space after the pointer cast
>>>>>
>>>>> Fixes: 7bc04215a66b ("mt76: add driver code for MT76x2e")
>>>>> Signed-off-by: Lorenzo Bianconi <lorenzo.bianconi@redhat.com>
>>>>
>>>> What am I supposed to do with this and patch 2? Drop?
>>>
>>> What do you mean? Why drop?
>> 
>> I didn't see Felix's ack, at least not on patchwork.
>
> I sent my ack (for both patches) as a reply to 0/2

Ah. patchwork is annoying as it doesn't show the cover letter at all so
I missed that.

> These patches should go in.

These two are applied now.

-- 
Kalle Valo

Re: [1/2] mt76: fix possible NULL pointer dereferencing in mt76x2_ampdu_action()

[Sven Eckelmann]

[-- Attachment #1: Type: text/plain, Size: 562 bytes --]

On Mittwoch, 17. Januar 2018 16:50:23 CET Kalle Valo wrote:
[...]
> >> I didn't see Felix's ack, at least not on patchwork.
> >
> > I sent my ack (for both patches) as a reply to 0/2
> 
> Ah. patchwork is annoying as it doesn't show the cover letter at all so
> I missed that.

Newer version at least can track the series and their cover letters. This is 
not completely what you want but at least there is hope. Here is an example: 
https://patchwork.open-mesh.org/cover/17240/ (you can use "Related" to see all 
the patches in the series).

Kind regards,
	Sven

[-- Attachment #2: This is a digitally signed message part. --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

Re: [1/2] mt76: fix possible NULL pointer dereferencing in mt76x2_ampdu_action()

[Kalle Valo]

Sven Eckelmann <sven@narfation.org> writes:

> On Mittwoch, 17. Januar 2018 16:50:23 CET Kalle Valo wrote:
> [...]
>> >> I didn't see Felix's ack, at least not on patchwork.
>> >
>> > I sent my ack (for both patches) as a reply to 0/2
>> 
>> Ah. patchwork is annoying as it doesn't show the cover letter at all so
>> I missed that.
>
> Newer version at least can track the series and their cover letters. This is 
> not completely what you want but at least there is hope. Here is an example: 
> https://patchwork.open-mesh.org/cover/17240/ (you can use "Related" to see all 
> the patches in the series).

Nice, looking forward to see that version in patchwork.kernel.org. My
ultimate goal is that I could doo all my maintenance work via my
patchwork script and not touch my email client at all. That's getting
closer.

-- 
Kalle Valo

Re: [1/2] mt76: fix possible NULL pointer dereferencing in mt76x2_ampdu_action()

[Kalle Valo]

Lorenzo Bianconi <lorenzo.bianconi@redhat.com> wrote:

> Initialize mt76_txq pointer after ieee80211_txq pointer check.
> Remove space after the pointer cast
> 
> Fixes: 7bc04215a66b ("mt76: add driver code for MT76x2e")
> Signed-off-by: Lorenzo Bianconi <lorenzo.bianconi@redhat.com>

2 patches applied to wireless-drivers-next.git, thanks.

99ac5327e902 mt76: fix possible NULL pointer dereferencing in mt76x2_ampdu_action()
98051872fd25 mt76: fix possible NULL pointer dereferencing in mt76x2_mac_write_txwi()

-- 
https://patchwork.kernel.org/patch/10111937/

https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches

[PATCH 2/2] mt76: fix possible NULL pointer dereferencing in mt76x2_mac_write_txwi()

[Lorenzo Bianconi]

Verify wcid is not NULL before dereferencing the pointer to initialize
txwi rate/power info

Fixes: 7bc04215a66b ("mt76: add driver code for MT76x2e")
Signed-off-by: Lorenzo Bianconi <lorenzo.bianconi@redhat.com>
---
 drivers/net/wireless/mediatek/mt76/mt76x2_mac.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/wireless/mediatek/mt76/mt76x2_mac.c b/drivers/net/wireless/mediatek/mt76/mt76x2_mac.c
index 39fc1d7b65ce..a1f695e9b51c 100644
--- a/drivers/net/wireless/mediatek/mt76/mt76x2_mac.c
+++ b/drivers/net/wireless/mediatek/mt76/mt76x2_mac.c
@@ -185,7 +185,7 @@ void mt76x2_mac_write_txwi(struct mt76x2_dev *dev, struct mt76x2_txwi *txwi,
 	txwi->pktid = 1;
 
 	spin_lock_bh(&dev->mt76.lock);
-	if (rate->idx < 0 || !rate->count) {
+	if (wcid && (rate->idx < 0 || !rate->count)) {
 		txwi->rate = wcid->tx_rate;
 		max_txpwr_adj = wcid->max_txpwr_adj;
 		nss = wcid->tx_rate_nss;
-- 
2.13.6

Re: [PATCH 0/2] Fix two possible NULL pointer dereferencing issues

[Felix Fietkau]

On 2017-12-14 13:03, Lorenzo Bianconi wrote:
> Lorenzo Bianconi (2):
>   mt76: fix possible NULL pointer dereferencing in mt76x2_ampdu_action()
>   mt76: fix possible NULL pointer dereferencing in
>     mt76x2_mac_write_txwi()
For both patches:
Acked-by: Felix Fietkau <nbd@nbd.name>