Commit 46c7b05a authored by Emmanuel Grumbach's avatar Emmanuel Grumbach Committed by Luca Coelho

iwlwifi: mvm: fix a possible NULL pointer deference

Smatch spot a possible NULL pointer dereference. Fix it.

__iwl_mvm_mac_set_key can be called with sta = NULL
Also add a NULL pointer check after memory allocation.
Reported-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: default avatarEmmanuel Grumbach <emmanuel.grumbach@intel.com>
Link: https://lore.kernel.org/r/20211130105951.85539-1-emmanuel.grumbach@intel.comSigned-off-by: default avatarLuca Coelho <luciano.coelho@intel.com>
parent 1a4d5758
...@@ -632,6 +632,8 @@ static void iwl_mei_handle_csme_filters(struct mei_cl_device *cldev, ...@@ -632,6 +632,8 @@ static void iwl_mei_handle_csme_filters(struct mei_cl_device *cldev,
lockdep_is_held(&iwl_mei_mutex)); lockdep_is_held(&iwl_mei_mutex));
new_filters = kzalloc(sizeof(*new_filters), GFP_KERNEL); new_filters = kzalloc(sizeof(*new_filters), GFP_KERNEL);
if (!new_filters)
return;
/* Copy the OOB filters */ /* Copy the OOB filters */
new_filters->filters = filters->filters; new_filters->filters = filters->filters;
......
...@@ -3563,12 +3563,13 @@ static int __iwl_mvm_mac_set_key(struct ieee80211_hw *hw, ...@@ -3563,12 +3563,13 @@ static int __iwl_mvm_mac_set_key(struct ieee80211_hw *hw,
{ {
struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif); struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw); struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
struct iwl_mvm_sta *mvmsta; struct iwl_mvm_sta *mvmsta = NULL;
struct iwl_mvm_key_pn *ptk_pn; struct iwl_mvm_key_pn *ptk_pn;
int keyidx = key->keyidx; int keyidx = key->keyidx;
int ret, i; int ret, i;
u8 key_offset; u8 key_offset;
if (sta)
mvmsta = iwl_mvm_sta_from_mac80211(sta); mvmsta = iwl_mvm_sta_from_mac80211(sta);
switch (key->cipher) { switch (key->cipher) {
...@@ -3671,7 +3672,7 @@ static int __iwl_mvm_mac_set_key(struct ieee80211_hw *hw, ...@@ -3671,7 +3672,7 @@ static int __iwl_mvm_mac_set_key(struct ieee80211_hw *hw,
} }
if (!test_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status) && if (!test_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status) &&
sta && iwl_mvm_has_new_rx_api(mvm) && mvmsta && iwl_mvm_has_new_rx_api(mvm) &&
key->flags & IEEE80211_KEY_FLAG_PAIRWISE && key->flags & IEEE80211_KEY_FLAG_PAIRWISE &&
(key->cipher == WLAN_CIPHER_SUITE_CCMP || (key->cipher == WLAN_CIPHER_SUITE_CCMP ||
key->cipher == WLAN_CIPHER_SUITE_GCMP || key->cipher == WLAN_CIPHER_SUITE_GCMP ||
...@@ -3705,7 +3706,7 @@ static int __iwl_mvm_mac_set_key(struct ieee80211_hw *hw, ...@@ -3705,7 +3706,7 @@ static int __iwl_mvm_mac_set_key(struct ieee80211_hw *hw,
else else
key_offset = STA_KEY_IDX_INVALID; key_offset = STA_KEY_IDX_INVALID;
if (key->flags & IEEE80211_KEY_FLAG_PAIRWISE) if (mvmsta && key->flags & IEEE80211_KEY_FLAG_PAIRWISE)
mvmsta->pairwise_cipher = key->cipher; mvmsta->pairwise_cipher = key->cipher;
IWL_DEBUG_MAC80211(mvm, "set hwcrypto key\n"); IWL_DEBUG_MAC80211(mvm, "set hwcrypto key\n");
...@@ -3748,7 +3749,7 @@ static int __iwl_mvm_mac_set_key(struct ieee80211_hw *hw, ...@@ -3748,7 +3749,7 @@ static int __iwl_mvm_mac_set_key(struct ieee80211_hw *hw,
break; break;
} }
if (sta && iwl_mvm_has_new_rx_api(mvm) && if (mvmsta && iwl_mvm_has_new_rx_api(mvm) &&
key->flags & IEEE80211_KEY_FLAG_PAIRWISE && key->flags & IEEE80211_KEY_FLAG_PAIRWISE &&
(key->cipher == WLAN_CIPHER_SUITE_CCMP || (key->cipher == WLAN_CIPHER_SUITE_CCMP ||
key->cipher == WLAN_CIPHER_SUITE_GCMP || key->cipher == WLAN_CIPHER_SUITE_GCMP ||
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment