diff options
| author | Ping-Ke Shih <pkshih@realtek.com> | 2021-10-22 08:12:42 +0200 |
|---|---|---|
| committer | Kalle Valo <kvalo@codeaurora.org> | 2021-10-27 09:37:59 +0200 |
| commit | 5d44f0672319c19a41ff0e0e4f0d64164cf9752b (patch) | |
| tree | fe954f1d06e1775e7bfaa4a4e01bbcf3dabe698a | |
| parent | rtw89: fix return value in hfc_pub_cfg_chk (diff) | |
| download | linux-5d44f0672319c19a41ff0e0e4f0d64164cf9752b.tar.xz linux-5d44f0672319c19a41ff0e0e4f0d64164cf9752b.zip | |
rtw89: Fix variable dereferenced before check 'sta'
The pointer rtwsta is dereferencing pointer sta before sta is being null
checked. Fix this by assigning sta->drv_priv to rtwsta only if sta is not
NULL, otherwise just NULL.
Fixes: e3ec7017f6a2 ("rtw89: add Realtek 802.11ax driver")
Reported-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20211022061242.8383-1-pkshih@realtek.com
| -rw-r--r-- | drivers/net/wireless/realtek/rtw89/core.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/drivers/net/wireless/realtek/rtw89/core.c b/drivers/net/wireless/realtek/rtw89/core.c index 06fb6e5b1b37..d02ec5a735cb 100644 --- a/drivers/net/wireless/realtek/rtw89/core.c +++ b/drivers/net/wireless/realtek/rtw89/core.c @@ -1412,7 +1412,7 @@ static void rtw89_core_ba_work(struct work_struct *work) list_for_each_entry_safe(rtwtxq, tmp, &rtwdev->ba_list, list) { struct ieee80211_txq *txq = rtw89_txq_to_txq(rtwtxq); struct ieee80211_sta *sta = txq->sta; - struct rtw89_sta *rtwsta = (struct rtw89_sta *)sta->drv_priv; + struct rtw89_sta *rtwsta = sta ? (struct rtw89_sta *)sta->drv_priv : NULL; u8 tid = txq->tid; if (!sta) { @@ -1462,7 +1462,7 @@ static void rtw89_core_txq_check_agg(struct rtw89_dev *rtwdev, struct ieee80211_hw *hw = rtwdev->hw; struct ieee80211_txq *txq = rtw89_txq_to_txq(rtwtxq); struct ieee80211_sta *sta = txq->sta; - struct rtw89_sta *rtwsta = (struct rtw89_sta *)sta->drv_priv; + struct rtw89_sta *rtwsta = sta ? (struct rtw89_sta *)sta->drv_priv : NULL; if (unlikely(skb_get_queue_mapping(skb) == IEEE80211_AC_VO)) return; @@ -1534,7 +1534,7 @@ static bool rtw89_core_txq_agg_wait(struct rtw89_dev *rtwdev, { struct rtw89_txq *rtwtxq = (struct rtw89_txq *)txq->drv_priv; struct ieee80211_sta *sta = txq->sta; - struct rtw89_sta *rtwsta = (struct rtw89_sta *)sta->drv_priv; + struct rtw89_sta *rtwsta = sta ? (struct rtw89_sta *)sta->drv_priv : NULL; if (!sta || rtwsta->max_agg_wait <= 0) return false; |