From: Dan Carpenter <dan.carpenter@linaro.org>
To: Ilan Peer <ilan.peer@intel.com>
Cc: linux-wireless@vger.kernel.org
Subject: [bug report] wifi: mac80211_hwsim: Add simulation support for NAN device
Date: Tue, 23 Sep 2025 11:04:39 +0300 [thread overview]
Message-ID: <aNJUlyIiSTW9zZdr@stanley.mountain> (raw)
Hello Ilan Peer,
Commit a37a6f54439b ("wifi: mac80211_hwsim: Add simulation support
for NAN device") from Sep 8, 2025 (linux-next), leads to the
following Smatch static checker warning:
drivers/net/wireless/virtual/mac80211_hwsim.c:2011 mac80211_hwsim_tx()
error: we previously assumed 'vif' could be null (see line 1978)
drivers/net/wireless/virtual/mac80211_hwsim.c
1958 static void mac80211_hwsim_tx(struct ieee80211_hw *hw,
1959 struct ieee80211_tx_control *control,
1960 struct sk_buff *skb)
1961 {
1962 struct mac80211_hwsim_data *data = hw->priv;
1963 struct ieee80211_tx_info *txi = IEEE80211_SKB_CB(skb);
1964 struct ieee80211_hdr *hdr = (void *)skb->data;
1965 struct ieee80211_chanctx_conf *chanctx_conf;
1966 struct ieee80211_channel *channel;
1967 struct ieee80211_vif *vif = txi->control.vif;
1968 bool ack;
1969 enum nl80211_chan_width confbw = NL80211_CHAN_WIDTH_20_NOHT;
1970 u32 _portid, i;
1971
1972 if (WARN_ON(skb->len < 10)) {
1973 /* Should not happen; just a sanity check for addr1 use */
1974 ieee80211_free_txskb(hw, skb);
1975 return;
1976 }
1977
1978 if (vif && vif->type == NL80211_IFTYPE_NAN && !data->tmp_chan) {
^^^
Lets assume vif is NULL
1979 /* For NAN Device simulation purposes, assume that NAN is always
1980 * on channel 6 or channel 149, unless a ROC is in progress (for
1981 * USD use cases).
1982 */
1983 if (data->nan_curr_dw_band == NL80211_BAND_2GHZ)
1984 channel = ieee80211_get_channel(hw->wiphy, 2437);
1985 else if (data->nan_curr_dw_band == NL80211_BAND_5GHZ)
1986 channel = ieee80211_get_channel(hw->wiphy, 5745);
1987 else
1988 channel = NULL;
1989
1990 if (WARN_ON(!channel)) {
1991 ieee80211_free_txskb(hw, skb);
1992 return;
1993 }
1994 } else if (!data->use_chanctx) {
1995 channel = data->channel;
1996 confbw = data->bw;
1997 } else if (txi->hw_queue == 4) {
1998 channel = data->tmp_chan;
1999 } else {
2000 u8 link = u32_get_bits(IEEE80211_SKB_CB(skb)->control.flags,
2001 IEEE80211_TX_CTRL_MLO_LINK);
2002 struct ieee80211_link_sta *link_sta = NULL;
2003 struct ieee80211_sta *sta = control->sta;
2004 struct ieee80211_bss_conf *bss_conf;
2005
2006 if (link != IEEE80211_LINK_UNSPECIFIED) {
2007 bss_conf = rcu_dereference(txi->control.vif->link_conf[link]);
^^^^^^^^^^^^^^^^
2008 if (sta)
2009 link_sta = rcu_dereference(sta->link[link]);
2010 } else {
--> 2011 bss_conf = mac80211_hwsim_select_tx_link(data, vif, sta,
^^^
It is dereferenced on the else path with no NULL checks.
2012 hdr, &link_sta);
2013 }
2014
2015 if (unlikely(!bss_conf)) {
2016 /* if it's an MLO STA, it might have deactivated all
2017 * links temporarily - but we don't handle real PS in
2018 * this code yet, so just drop the frame in that case
2019 */
2020 WARN(link != IEEE80211_LINK_UNSPECIFIED || !sta || !sta->mlo,
2021 "link:%d, sta:%pM, sta->mlo:%d\n",
2022 link, sta ? sta->addr : NULL, sta ? sta->mlo : -1);
2023 ieee80211_free_txskb(hw, skb);
2024 return;
2025 }
2026
2027 /* Do address translations only between shared links. It is
2028 * possible that while an non-AP MLD station and an AP MLD
2029 * station have shared links, the frame is intended to be sent
2030 * on a link which is not shared (for example when sending a
2031 * probe response).
2032 */
2033 if (sta && sta->mlo && link_sta) {
2034 /* address translation to link addresses on TX */
2035 ether_addr_copy(hdr->addr1, link_sta->addr);
2036 ether_addr_copy(hdr->addr2, bss_conf->addr);
2037 /* translate A3 only if it's the BSSID */
2038 if (!ieee80211_has_tods(hdr->frame_control) &&
2039 !ieee80211_has_fromds(hdr->frame_control)) {
2040 if (ether_addr_equal(hdr->addr3, sta->addr))
2041 ether_addr_copy(hdr->addr3, link_sta->addr);
2042 else if (ether_addr_equal(hdr->addr3, vif->addr))
2043 ether_addr_copy(hdr->addr3, bss_conf->addr);
2044 }
2045 /* no need to look at A4, if present it's SA */
2046 }
2047
2048 chanctx_conf = rcu_dereference(bss_conf->chanctx_conf);
2049 if (chanctx_conf) {
2050 channel = chanctx_conf->def.chan;
2051 confbw = chanctx_conf->def.width;
2052 } else {
2053 channel = NULL;
2054 }
2055 }
2056
2057 if (WARN(!channel, "TX w/o channel - queue = %d\n", txi->hw_queue)) {
2058 ieee80211_free_txskb(hw, skb);
2059 return;
2060 }
2061
2062 if (data->idle && !data->tmp_chan) {
2063 wiphy_dbg(hw->wiphy, "Trying to TX when idle - reject\n");
2064 ieee80211_free_txskb(hw, skb);
2065 return;
2066 }
2067
2068 if (txi->control.vif)
^^^^^^^^^^^^^^^^
Here is another check.
2069 hwsim_check_magic(txi->control.vif);
2070 if (control->sta)
2071 hwsim_check_sta_magic(control->sta);
2072
regards,
dan carpenter
reply other threads:[~2025-09-23 8:04 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=aNJUlyIiSTW9zZdr@stanley.mountain \
--to=dan.carpenter@linaro.org \
--cc=ilan.peer@intel.com \
--cc=linux-wireless@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox