Commit d599f714 authored by Johannes Berg's avatar Johannes Berg Committed by Kalle Valo
Browse files

iwlwifi: mvm: don't crash on invalid rate w/o STA 



If we get to the WARN_ONCE(..., "Got a HT rate (...)", ...)
here with a NULL sta, then we crash because mvmsta is bad
and we try to dereference it. Fix that by printing -1 as the
state if no station was given.

Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
Fixes: 6761a718 ("iwlwifi: mvm: add explicit check for non-data frames in get Tx rate")
Signed-off-by: default avatarLuca Coelho <luciano.coelho@intel.com>
Signed-off-by: default avatarKalle Valo <kvalo@kernel.org>
Link: https://lore.kernel.org/r/iwlwifi.20211203140410.1a1541d7dcb5.I606c746e11447fe168cf046376b70b04e278c3b4@changeid
parent 06d59d62

drivers/net/wireless/intel/iwlwifi/mvm/tx.c

+3 −2
Original line number Diff line number Diff line
@@ -269,17 +269,18 @@ static u32 iwl_mvm_get_tx_rate(struct iwl_mvm *mvm, 
	u8 rate_plcp;

	u32 rate_flags = 0;

	bool is_cck;

	struct iwl_mvm_sta *mvmsta = iwl_mvm_sta_from_mac80211(sta);



	/* info->control is only relevant for non HW rate control */

	if (!ieee80211_hw_check(mvm->hw, HAS_RATE_CONTROL)) {

		struct iwl_mvm_sta *mvmsta = iwl_mvm_sta_from_mac80211(sta);



		/* HT rate doesn't make sense for a non data frame */

		WARN_ONCE(info->control.rates[0].flags & IEEE80211_TX_RC_MCS &&

			  !ieee80211_is_data(fc),

			  "Got a HT rate (flags:0x%x/mcs:%d/fc:0x%x/state:%d) for a non data frame\n",

			  info->control.rates[0].flags,

			  info->control.rates[0].idx,

			  le16_to_cpu(fc), mvmsta->sta_state);

			  le16_to_cpu(fc), sta ? mvmsta->sta_state : -1);



		rate_idx = info->control.rates[0].idx;

	}