Commit 9084f3a1 authored by Ping-Ke Shih's avatar Ping-Ke Shih Committed by Wang Wensheng
Browse files

wifi: rtw89: check return value of ieee80211_probereq_get() for RNR 

stable inclusion
from stable-v6.6.66
commit 1a0f54cb3fea5d087440b2bae03202c445156a8d
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBI835
CVE: CVE-2024-48873

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=1a0f54cb3fea5d087440b2bae03202c445156a8d



--------------------------------

[ Upstream commit 630d5d8f2bf6b340202b6bc2c05d794bbd8e4c1c ]

The return value of ieee80211_probereq_get() might be NULL, so check it
before using to avoid NULL pointer access.

Addresses-Coverity-ID: 1529805 ("Dereference null return value")

Signed-off-by: default avatarPing-Ke Shih <pkshih@realtek.com>
Link: https://patch.msgid.link/20240919081216.28505-2-pkshih@realtek.com


Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
Signed-off-by: default avatarWang Wensheng <wangwensheng4@huawei.com>
parent 37dafafe

drivers/net/wireless/realtek/rtw89/fw.c

+3 −0
Original line number Diff line number Diff line
@@ -3662,6 +3662,9 @@ static int rtw89_update_6ghz_rnr_chan(struct rtw89_dev *rtwdev, 


		skb = ieee80211_probereq_get(rtwdev->hw, rtwvif->mac_addr,

					     NULL, 0, req->ie_len);

		if (!skb)

			return -ENOMEM;



		skb_put_data(skb, ies->ies[NL80211_BAND_6GHZ], ies->len[NL80211_BAND_6GHZ]);

		skb_put_data(skb, ies->common_ies, ies->common_ie_len);

		hdr = (struct ieee80211_hdr *)skb->data;