From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 101593B961B; Sat, 17 Oct 2026 17:13:19 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1792257200; cv=none; b=Wt1Owtm3JhtIIlhIGynJR88dq2QP25F03jKvKKzcZ8qZTJsEtnurPB5UpHRu6Q4/D36fNFY98Zrkm3RxaRT6hYRRtLMdBfGI3M44KDSyRKe4w35whrnw7n/7RPABTAW0ANwOmhDtpL20pBi3VBsgwAcswTpZAQfj70ptyn+A1bE= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1792257200; c=relaxed/simple; bh=gg702beErS/KNJBSPVX2ihA/vZ2IrNhAOhPigHX9IW4=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=cmslB14KRsnQB9q5ggyuzPFRSw1hR8Rdy/wmD9fzzGYv+abdD3P4StAL2Pta5MuRMYbMrYcpzIKwLRPe3dfiDOK7nLMGDWFtes+vKVzGLBtFDz6D1zOukQ7YCPPsZSXs/QkiVSawfzZDbI/PzwuDq+ixkEmvIelvyHgWjB6Erlc= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=vDiJnlEe; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="vDiJnlEe" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 510D91F000C4; Sat, 17 Oct 2026 17:13:18 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1792257198; bh=pnyG9yCG2wb+/CNBSuJ91KNo/UMMaXPU6I7IlaHYUbw=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=vDiJnlEeF1I8WndOORnVPfnQlw3csmNRLXJ7UOR4kePO/KDhNYQf6GilUYkDTqEdb jtosRN7D4Dc83jUJFDFkgon8T6OYNkbtwNcPxin1z2yb4o1dczieFrZgvQyibzreTc KR1GxnT9HNuA07ILYPhfulKQgaqivkPuTS8LnTik= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Tamizh Chelvam Raja , Johannes Berg , Sasha Levin Subject: [PATCH 6.6 0441/1674] wifi: mac80211: Add sta pointer sanity check in ieee80211_8023_xmit() Date: Sat, 17 Oct 2026 17:45:13 +0200 Message-ID: <20261017160442.441854227@linuxfoundation.org> X-Mailer: git-send-email 2.56.0 In-Reply-To: <20261017160431.119607952@linuxfoundation.org> References: <20261017160431.119607952@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: stable@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.6-stable review patch. If anyone has any objections, please let me know. ------------------ From: Tamizh Chelvam Raja [ Upstream commit 303f11fda2fa4c6f7aa86b8fa54aaee5e1ef181b ] Currently ieee80211_8023_xmit() accesses the sta pointer without any sanity check, assuming that only unicast packets for an authorized station are processed. But the sta pointer could become NULL when a framework to support 802.3 offload for the multicast packets is added in the follow-up patches. Add the valid sta pointer sanity check to avoid the invalid pointer access. This aligns with some of the subordinate functions called by ieee80211_8023_xmit() that already NULL-check 'sta' such as ieee80211_select_queue() and ieee80211_aggr_check(). Signed-off-by: Tamizh Chelvam Raja Link: https://patch.msgid.link/20260604162403.1563729-2-tamizh.raja@oss.qualcomm.com Signed-off-by: Johannes Berg Stable-dep-of: 4febc02cd02f ("wifi: mac80211: set info->band for 802.3 encap offload frames") Signed-off-by: Sasha Levin --- net/mac80211/tx.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c index e5bd558c9ae51..931acf3bb6da1 100644 --- a/net/mac80211/tx.c +++ b/net/mac80211/tx.c @@ -4623,7 +4623,7 @@ static void ieee80211_8023_xmit(struct ieee80211_sub_if_data *sdata, { struct ieee80211_tx_info *info; struct ieee80211_local *local = sdata->local; - struct tid_ampdu_tx *tid_tx; + struct tid_ampdu_tx *tid_tx = NULL; struct sk_buff *seg, *next; unsigned int skbs = 0, len = 0; u16 queue; @@ -4643,7 +4643,9 @@ static void ieee80211_8023_xmit(struct ieee80211_sub_if_data *sdata, ieee80211_aggr_check(sdata, sta, skb); tid = skb->priority & IEEE80211_QOS_CTL_TAG1D_MASK; - tid_tx = rcu_dereference(sta->ampdu_mlme.tid_tx[tid]); + + if (sta) + tid_tx = rcu_dereference(sta->ampdu_mlme.tid_tx[tid]); if (tid_tx) { if (!test_bit(HT_AGG_STATE_OPERATIONAL, &tid_tx->state)) { /* fall back to non-offload slow path */ @@ -4692,8 +4694,11 @@ static void ieee80211_8023_xmit(struct ieee80211_sub_if_data *sdata, } dev_sw_netstats_tx_add(dev, skbs, len); - sta->deflink.tx_stats.packets[queue] += skbs; - sta->deflink.tx_stats.bytes[queue] += len; + + if (sta) { + sta->deflink.tx_stats.packets[queue] += skbs; + sta->deflink.tx_stats.bytes[queue] += len; + } ieee80211_tpt_led_trig_tx(local, len); -- 2.53.0