Re: [PATCH 6.1] wifi: iwlwifi: mvm: avoid NULL pointer dereference

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



[ Sasha's backport helper bot ]

Hi,

The upstream commit SHA1 provided is correct: 557a6cd847645e667f3b362560bd7e7c09aac284

WARNING: Author mismatch between patch and upstream commit:
Backport author: Xiangyu Chen <xiangyu.chen@xxxxxxxxxxxxxxxxx>
Commit author: Miri Korenblit <miriam.rachel.korenblit@xxxxxxxxx>


Status in newer kernel trees:
6.12.y | Present (exact SHA1)
6.11.y | Present (different SHA1: c0b4f5d94934)
6.6.y | Present (different SHA1: 6dcadb2ed3b7)
6.1.y | Not found

Note: The patch differs from the upstream commit:
---
--- -	2024-11-27 11:10:11.665423970 -0500
+++ /tmp/tmp.HPjq0KxGeN	2024-11-27 11:10:11.649712662 -0500
@@ -1,3 +1,5 @@
+[ Upstream commit 557a6cd847645e667f3b362560bd7e7c09aac284 ]
+
 iwl_mvm_tx_skb_sta() and iwl_mvm_tx_mpdu() verify that the mvmvsta
 pointer is not NULL.
 It retrieves this pointer using iwl_mvm_sta_from_mac80211, which is
@@ -11,15 +13,17 @@
 Reviewed-by: Johannes Berg <johannes.berg@xxxxxxxxx>
 Link: https://patch.msgid.link/20240825191257.880921ce23b7.I340052d70ab6d3410724ce955eb00da10e08188f@changeid
 Signed-off-by: Johannes Berg <johannes.berg@xxxxxxxxx>
+Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>
+Signed-off-by: Xiangyu Chen <xiangyu.chen@xxxxxxxxxxxxx>
 ---
  drivers/net/wireless/intel/iwlwifi/mvm/tx.c | 12 +++++++-----
  1 file changed, 7 insertions(+), 5 deletions(-)
 
 diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
-index 7ff5ea5e7aca5..db926b2f4d8d5 100644
+index 76219486b9c2..43a732b0c168 100644
 --- a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
 +++ b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
-@@ -1203,6 +1203,9 @@ static int iwl_mvm_tx_mpdu(struct iwl_mvm *mvm, struct sk_buff *skb,
+@@ -1105,6 +1105,9 @@ static int iwl_mvm_tx_mpdu(struct iwl_mvm *mvm, struct sk_buff *skb,
  	bool is_ampdu = false;
  	int hdrlen;
  
@@ -29,17 +33,17 @@
  	mvmsta = iwl_mvm_sta_from_mac80211(sta);
  	fc = hdr->frame_control;
  	hdrlen = ieee80211_hdrlen(fc);
-@@ -1210,9 +1213,6 @@ static int iwl_mvm_tx_mpdu(struct iwl_mvm *mvm, struct sk_buff *skb,
+@@ -1112,9 +1115,6 @@ static int iwl_mvm_tx_mpdu(struct iwl_mvm *mvm, struct sk_buff *skb,
  	if (IWL_MVM_NON_TRANSMITTING_AP && ieee80211_is_probe_resp(fc))
  		return -1;
  
 -	if (WARN_ON_ONCE(!mvmsta))
 -		return -1;
 -
- 	if (WARN_ON_ONCE(mvmsta->deflink.sta_id == IWL_MVM_INVALID_STA))
+ 	if (WARN_ON_ONCE(mvmsta->sta_id == IWL_MVM_INVALID_STA))
  		return -1;
  
-@@ -1343,7 +1343,7 @@ static int iwl_mvm_tx_mpdu(struct iwl_mvm *mvm, struct sk_buff *skb,
+@@ -1242,16 +1242,18 @@ static int iwl_mvm_tx_mpdu(struct iwl_mvm *mvm, struct sk_buff *skb,
  int iwl_mvm_tx_skb_sta(struct iwl_mvm *mvm, struct sk_buff *skb,
  		       struct ieee80211_sta *sta)
  {
@@ -47,10 +51,9 @@
 +	struct iwl_mvm_sta *mvmsta;
  	struct ieee80211_tx_info info;
  	struct sk_buff_head mpdus_skbs;
- 	struct ieee80211_vif *vif;
-@@ -1352,9 +1352,11 @@ int iwl_mvm_tx_skb_sta(struct iwl_mvm *mvm, struct sk_buff *skb,
+ 	unsigned int payload_len;
+ 	int ret;
  	struct sk_buff *orig_skb = skb;
- 	const u8 *addr3;
  
 -	if (WARN_ON_ONCE(!mvmsta))
 +	if (WARN_ON_ONCE(!sta))
@@ -58,6 +61,9 @@
  
 +	mvmsta = iwl_mvm_sta_from_mac80211(sta);
 +
- 	if (WARN_ON_ONCE(mvmsta->deflink.sta_id == IWL_MVM_INVALID_STA))
+ 	if (WARN_ON_ONCE(mvmsta->sta_id == IWL_MVM_INVALID_STA))
  		return -1;
  
+-- 
+2.25.1
+
---

Results of testing on various branches:

| Branch                    | Patch Apply | Build Test |
|---------------------------|-------------|------------|
| stable/linux-6.1.y        |  Success    |  Success   |




[Index of Archives]     [Linux Kernel]     [Kernel Development Newbies]     [Linux USB Devel]     [Video for Linux]     [Linux Audio Users]     [Yosemite Hiking]     [Linux Kernel]     [Linux SCSI]

  Powered by Linux