This is a note to let you know that I've just added the patch titled rtw88: don't treat NULL pointer as an array to the 5.9-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: rtw88-don-t-treat-null-pointer-as-an-array.patch and it can be found in the queue-5.9 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable@xxxxxxxxxxxxxxx> know about it. commit e44ccbd42b695f2ea0b5d05c8c3b4407f03e991b Author: Brian Norris <briannorris@xxxxxxxxxxxx> Date: Fri Aug 21 14:17:16 2020 -0700 rtw88: don't treat NULL pointer as an array [ Upstream commit 22b726cbdd09d9891ede8aa122a950d2d0ae5e09 ] I'm not a standards expert, but this really looks to be undefined behavior, when chip->dig_cck may be NULL. (And, we're trying to do a NULL check a few lines down, because some chip variants will use NULL.) Fixes: fc637a860a82 ("rtw88: 8723d: Set IG register for CCK rate") Signed-off-by: Brian Norris <briannorris@xxxxxxxxxxxx> Acked-by: Yan-Hsuan Chuang <yhchuang@xxxxxxxxxxx> Signed-off-by: Kalle Valo <kvalo@xxxxxxxxxxxxxx> Link: https://lore.kernel.org/r/20200821211716.1631556-1-briannorris@xxxxxxxxxxxx Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx> diff --git a/drivers/net/wireless/realtek/rtw88/phy.c b/drivers/net/wireless/realtek/rtw88/phy.c index 8d93f31597469..9687b376d221b 100644 --- a/drivers/net/wireless/realtek/rtw88/phy.c +++ b/drivers/net/wireless/realtek/rtw88/phy.c @@ -147,12 +147,13 @@ void rtw_phy_dig_write(struct rtw_dev *rtwdev, u8 igi) { struct rtw_chip_info *chip = rtwdev->chip; struct rtw_hal *hal = &rtwdev->hal; - const struct rtw_hw_reg *dig_cck = &chip->dig_cck[0]; u32 addr, mask; u8 path; - if (dig_cck) + if (chip->dig_cck) { + const struct rtw_hw_reg *dig_cck = &chip->dig_cck[0]; rtw_write32_mask(rtwdev, dig_cck->addr, dig_cck->mask, igi >> 1); + } for (path = 0; path < hal->rf_path_num; path++) { addr = chip->dig[path].addr;