Commit 46c7b05a authored by Emmanuel Grumbach's avatar Emmanuel Grumbach Committed by Luca Coelho
Browse files

iwlwifi: mvm: fix a possible NULL pointer deference 



Smatch spot a possible NULL pointer dereference. Fix it.

__iwl_mvm_mac_set_key can be called with sta = NULL
Also add a NULL pointer check after memory allocation.

Reported-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: default avatarEmmanuel Grumbach <emmanuel.grumbach@intel.com>
Link: https://lore.kernel.org/r/20211130105951.85539-1-emmanuel.grumbach@intel.com


Signed-off-by: default avatarLuca Coelho <luciano.coelho@intel.com>
parent 1a4d5758

drivers/net/wireless/intel/iwlwifi/mei/main.c

+2 −0
Original line number Diff line number Diff line
@@ -632,6 +632,8 @@ static void iwl_mei_handle_csme_filters(struct mei_cl_device *cldev, 
					  lockdep_is_held(&iwl_mei_mutex));



	new_filters = kzalloc(sizeof(*new_filters), GFP_KERNEL);

	if (!new_filters)

		return;



	/* Copy the OOB filters */

	new_filters->filters = filters->filters;

drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c

+6 −5
Original line number Diff line number Diff line
@@ -3563,12 +3563,13 @@ static int __iwl_mvm_mac_set_key(struct ieee80211_hw *hw, 
{

	struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);

	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);

	struct iwl_mvm_sta *mvmsta;

	struct iwl_mvm_sta *mvmsta = NULL;

	struct iwl_mvm_key_pn *ptk_pn;

	int keyidx = key->keyidx;

	int ret, i;

	u8 key_offset;



	if (sta)

		mvmsta = iwl_mvm_sta_from_mac80211(sta);



	switch (key->cipher) {
@@ -3671,7 +3672,7 @@ static int __iwl_mvm_mac_set_key(struct ieee80211_hw *hw, 
		}



		if (!test_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status) &&

		    sta && iwl_mvm_has_new_rx_api(mvm) &&

		    mvmsta && iwl_mvm_has_new_rx_api(mvm) &&

		    key->flags & IEEE80211_KEY_FLAG_PAIRWISE &&

		    (key->cipher == WLAN_CIPHER_SUITE_CCMP ||

		     key->cipher == WLAN_CIPHER_SUITE_GCMP ||
@@ -3705,7 +3706,7 @@ static int __iwl_mvm_mac_set_key(struct ieee80211_hw *hw, 
		else

			key_offset = STA_KEY_IDX_INVALID;



		if (key->flags & IEEE80211_KEY_FLAG_PAIRWISE)

		if (mvmsta && key->flags & IEEE80211_KEY_FLAG_PAIRWISE)

			mvmsta->pairwise_cipher = key->cipher;



		IWL_DEBUG_MAC80211(mvm, "set hwcrypto key\n");
@@ -3748,7 +3749,7 @@ static int __iwl_mvm_mac_set_key(struct ieee80211_hw *hw, 
			break;

		}



		if (sta && iwl_mvm_has_new_rx_api(mvm) &&

		if (mvmsta && iwl_mvm_has_new_rx_api(mvm) &&

		    key->flags & IEEE80211_KEY_FLAG_PAIRWISE &&

		    (key->cipher == WLAN_CIPHER_SUITE_CCMP ||

		     key->cipher == WLAN_CIPHER_SUITE_GCMP ||