This is a note to let you know that I've just added the patch titled iwlwifi: mvm: Don't call iwl_mvm_sta_from_mac80211() with NULL sta to the 5.15-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: iwlwifi-mvm-don-t-call-iwl_mvm_sta_from_mac80211-wit.patch and it can be found in the queue-5.15 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable@xxxxxxxxxxxxxxx> know about it. commit eb33583e0c17b2b29e6808294e246df9eb6c80ac Author: Takashi Iwai <tiwai@xxxxxxx> Date: Fri Jan 21 12:40:24 2022 +0100 iwlwifi: mvm: Don't call iwl_mvm_sta_from_mac80211() with NULL sta [ Upstream commit 30d17c12b0895e15ce22ebc1f52a4ff02df6dbc6 ] The recent fix for NULL sta in iwl_mvm_get_tx_rate() still has a call of iwl_mvm_sta_from_mac80211() that may be called with NULL sta. Although this practically only points to the address and the actual access doesn't happen due to the conditional evaluation at a later point, it looks a bit flaky. This patch drops the temporary variable above and evaluates iwm_mvm_sta_from_mac80211() directly for avoiding confusions. Fixes: d599f714b73e ("iwlwifi: mvm: don't crash on invalid rate w/o STA") Signed-off-by: Takashi Iwai <tiwai@xxxxxxx> Link: https://lore.kernel.org/r/20220121114024.10454-1-tiwai@xxxxxxx Signed-off-by: Luca Coelho <luciano.coelho@xxxxxxxxx> Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx> diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c index 06fbd9ab37df..b5368cb57ca8 100644 --- a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c +++ b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c @@ -271,15 +271,14 @@ static u32 iwl_mvm_get_tx_rate(struct iwl_mvm *mvm, /* info->control is only relevant for non HW rate control */ if (!ieee80211_hw_check(mvm->hw, HAS_RATE_CONTROL)) { - struct iwl_mvm_sta *mvmsta = iwl_mvm_sta_from_mac80211(sta); - /* HT rate doesn't make sense for a non data frame */ WARN_ONCE(info->control.rates[0].flags & IEEE80211_TX_RC_MCS && !ieee80211_is_data(fc), "Got a HT rate (flags:0x%x/mcs:%d/fc:0x%x/state:%d) for a non data frame\n", info->control.rates[0].flags, info->control.rates[0].idx, - le16_to_cpu(fc), sta ? mvmsta->sta_state : -1); + le16_to_cpu(fc), + sta ? iwl_mvm_sta_from_mac80211(sta)->sta_state : -1); rate_idx = info->control.rates[0].idx; }