Commit 42576d27 authored by Miri Korenblit's avatar Miri Korenblit Committed by Dong Chenchen
Browse files

wifi: iwlwifi: mvm: avoid NULL pointer dereference 

mainline inclusion
from mainline-v6.12-rc1
commit 557a6cd847645e667f3b362560bd7e7c09aac284
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYRCA
CVE: CVE-2024-49929

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=557a6cd847645e667f3b362560bd7e7c09aac284



--------------------------------

iwl_mvm_tx_skb_sta() and iwl_mvm_tx_mpdu() verify that the mvmvsta
pointer is not NULL.
It retrieves this pointer using iwl_mvm_sta_from_mac80211, which is
dereferencing the ieee80211_sta pointer.
If sta is NULL, iwl_mvm_sta_from_mac80211 will dereference a NULL
pointer.
Fix this by checking the sta pointer before retrieving the mvmsta
from it. If sta is not NULL, then mvmsta isn't either.

Signed-off-by: default avatarMiri Korenblit <miriam.rachel.korenblit@intel.com>
Reviewed-by: default avatarJohannes Berg <johannes.berg@intel.com>
Link: https://patch.msgid.link/20240825191257.880921ce23b7.I340052d70ab6d3410724ce955eb00da10e08188f@changeid


Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
Conflicts:
	drivers/net/wireless/intel/iwlwifi/mvm/tx.c
[commit c8ee33e1("wifi: iwlwifi: mvm: sta preparation for MLO")
add struct iwl_mvm_link_sta deflink to mvmsta, which not merged lead
to conflicts]
Signed-off-by: default avatarDong Chenchen <dongchenchen2@huawei.com>
parent 81248561

drivers/net/wireless/intel/iwlwifi/mvm/tx.c

+7 −5
Original line number Diff line number Diff line
@@ -1076,6 +1076,9 @@ static int iwl_mvm_tx_mpdu(struct iwl_mvm *mvm, struct sk_buff *skb, 
	bool is_ampdu = false;

	int hdrlen;



	if (WARN_ON_ONCE(!sta))

		return -1;



	mvmsta = iwl_mvm_sta_from_mac80211(sta);

	fc = hdr->frame_control;

	hdrlen = ieee80211_hdrlen(fc);
@@ -1083,9 +1086,6 @@ static int iwl_mvm_tx_mpdu(struct iwl_mvm *mvm, struct sk_buff *skb, 
	if (IWL_MVM_NON_TRANSMITTING_AP && ieee80211_is_probe_resp(fc))

		return -1;



	if (WARN_ON_ONCE(!mvmsta))

		return -1;



	if (WARN_ON_ONCE(mvmsta->sta_id == IWL_MVM_INVALID_STA))

		return -1;
@@ -1202,16 +1202,18 @@ static int iwl_mvm_tx_mpdu(struct iwl_mvm *mvm, struct sk_buff *skb, 
int iwl_mvm_tx_skb_sta(struct iwl_mvm *mvm, struct sk_buff *skb,

		       struct ieee80211_sta *sta)

{

	struct iwl_mvm_sta *mvmsta = iwl_mvm_sta_from_mac80211(sta);

	struct iwl_mvm_sta *mvmsta;

	struct ieee80211_tx_info info;

	struct sk_buff_head mpdus_skbs;

	unsigned int payload_len;

	int ret;

	struct sk_buff *orig_skb = skb;



	if (WARN_ON_ONCE(!mvmsta))

	if (WARN_ON_ONCE(!sta))

		return -1;



	mvmsta = iwl_mvm_sta_from_mac80211(sta);



	if (WARN_ON_ONCE(mvmsta->sta_id == IWL_MVM_INVALID_STA))

		return -1;