Commit 5d44f067 authored by Ping-Ke Shih's avatar Ping-Ke Shih Committed by Kalle Valo
Browse files

rtw89: Fix variable dereferenced before check 'sta' 



The pointer rtwsta is dereferencing pointer sta before sta is being null
checked. Fix this by assigning sta->drv_priv to rtwsta only if sta is not
NULL, otherwise just NULL.

Fixes: e3ec7017 ("rtw89: add Realtek 802.11ax driver")
Reported-by: default avatarColin Ian King <colin.king@canonical.com>
Signed-off-by: default avatarPing-Ke Shih <pkshih@realtek.com>
Signed-off-by: default avatarKalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20211022061242.8383-1-pkshih@realtek.com
parent c6477cb2

drivers/net/wireless/realtek/rtw89/core.c

+3 −3
Original line number Diff line number Diff line
@@ -1412,7 +1412,7 @@ static void rtw89_core_ba_work(struct work_struct *work) 
	list_for_each_entry_safe(rtwtxq, tmp, &rtwdev->ba_list, list) {

		struct ieee80211_txq *txq = rtw89_txq_to_txq(rtwtxq);

		struct ieee80211_sta *sta = txq->sta;

		struct rtw89_sta *rtwsta = (struct rtw89_sta *)sta->drv_priv;

		struct rtw89_sta *rtwsta = sta ? (struct rtw89_sta *)sta->drv_priv : NULL;

		u8 tid = txq->tid;



		if (!sta) {
@@ -1462,7 +1462,7 @@ static void rtw89_core_txq_check_agg(struct rtw89_dev *rtwdev, 
	struct ieee80211_hw *hw = rtwdev->hw;

	struct ieee80211_txq *txq = rtw89_txq_to_txq(rtwtxq);

	struct ieee80211_sta *sta = txq->sta;

	struct rtw89_sta *rtwsta = (struct rtw89_sta *)sta->drv_priv;

	struct rtw89_sta *rtwsta = sta ? (struct rtw89_sta *)sta->drv_priv : NULL;



	if (unlikely(skb_get_queue_mapping(skb) == IEEE80211_AC_VO))

		return;
@@ -1534,7 +1534,7 @@ static bool rtw89_core_txq_agg_wait(struct rtw89_dev *rtwdev, 
{

	struct rtw89_txq *rtwtxq = (struct rtw89_txq *)txq->drv_priv;

	struct ieee80211_sta *sta = txq->sta;

	struct rtw89_sta *rtwsta = (struct rtw89_sta *)sta->drv_priv;

	struct rtw89_sta *rtwsta = sta ? (struct rtw89_sta *)sta->drv_priv : NULL;



	if (!sta || rtwsta->max_agg_wait <= 0)

		return false;