mirror of https://lore.kernel.org/lkml/
 help / color / mirror / Atom feed
From: Markus Elfring <Markus.Elfring@web.de>
To: kernel-janitors@vger.kernel.org, linux-wireless@vger.kernel.org,
	netdev@vger.kernel.org, Benjamin Berg <benjamin.berg@intel.com>,
	Gregory Greenman <gregory.greenman@intel.com>,
	"David S. Miller" <davem@davemloft.net>,
	Eric Dumazet <edumazet@google.com>,
	Jakub Kicinski <kuba@kernel.org>,
	Johannes Berg <johannes.berg@intel.com>,
	Kalle Valo <kvalo@kernel.org>,
	Miri Korenblit <miriam.rachel.korenblit@intel.com>,
	Paolo Abeni <pabeni@redhat.com>,
	Sriram R <quic_srirrama@quicinc.com>
Cc: cocci@inria.fr, LKML <linux-kernel@vger.kernel.org>,
	Simon Horman <horms@kernel.org>
Subject: [PATCH RESEND] iwlwifi: Adjust input parameter validation in iwl_sta_calc_ht_flags()
Date: Mon, 3 Mar 2025 14:18:18 +0100	[thread overview]
Message-ID: <22e24ec8-283f-49e9-b7b0-555e8113c250@web.de> (raw)
In-Reply-To: <9cb634c8-d6e6-32bc-5fd6-79bf6b274f96@web.de>

From: Markus Elfring <elfring@users.sourceforge.net>
Date: Wed, 19 Apr 2023 19:19:34 +0200

The address of a data structure member was determined before
a corresponding null pointer check in the implementation of
the function “iwl_sta_calc_ht_flags”.

Thus avoid the risk for undefined behaviour by moving the assignment
for the variable “sta_ht_inf” behind the null pointer check.

This issue was detected by using the Coccinelle software.

Fixes: 046d2e7c50e3 ("mac80211: prepare sta handling for MLO support")
Signed-off-by: Markus Elfring <elfring@users.sourceforge.net>
---
 drivers/net/wireless/intel/iwlwifi/dvm/sta.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/drivers/net/wireless/intel/iwlwifi/dvm/sta.c b/drivers/net/wireless/intel/iwlwifi/dvm/sta.c
index cef43cf80620..74814ce0155e 100644
--- a/drivers/net/wireless/intel/iwlwifi/dvm/sta.c
+++ b/drivers/net/wireless/intel/iwlwifi/dvm/sta.c
@@ -147,7 +147,7 @@ static void iwl_sta_calc_ht_flags(struct iwl_priv *priv,
 				  struct iwl_rxon_context *ctx,
 				  __le32 *flags, __le32 *mask)
 {
-	struct ieee80211_sta_ht_cap *sta_ht_inf = &sta->deflink.ht_cap;
+	struct ieee80211_sta_ht_cap *sta_ht_inf;

 	*mask = STA_FLG_RTS_MIMO_PROT_MSK |
 		STA_FLG_MIMO_DIS_MSK |
@@ -156,7 +156,11 @@ static void iwl_sta_calc_ht_flags(struct iwl_priv *priv,
 		STA_FLG_AGG_MPDU_DENSITY_MSK;
 	*flags = 0;

-	if (!sta || !sta_ht_inf->ht_supported)
+	if (!sta)
+		return;
+
+	sta_ht_inf = &sta->deflink.ht_cap;
+	if (!sta_ht_inf->ht_supported)
 		return;

 	IWL_DEBUG_INFO(priv, "STA %pM SM PS mode: %s\n",
--
2.40.0


  parent reply	other threads:[~2025-03-03 13:18 UTC|newest]

Thread overview: 64+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
     [not found] <40c60719-4bfe-b1a4-ead7-724b84637f55@web.de>
     [not found] ` <1a11455f-ab57-dce0-1677-6beb8492a257@web.de>
     [not found]   ` <13566308-9a80-e4aa-f64e-978c02b1406d@web.de>
2023-04-11 16:43     ` [PATCH] drm/msm/dpu: Delete a variable initialisation before a null pointer check in two functions Dmitry Baryshkov
2023-04-11 16:44     ` Abhinav Kumar
2025-03-02 20:56     ` [PATCH RESEND] " Markus Elfring
2025-03-02 23:01       ` Dmitry Baryshkov
2025-03-03  7:14         ` Dan Carpenter
2025-03-03  8:15           ` [RESEND] " Markus Elfring
2025-03-03  8:24             ` Dan Carpenter
2025-03-05  8:40           ` [RFC] Clarification for “undefined behaviour”? Markus Elfring
2025-03-05  8:51             ` Dan Carpenter
2025-03-05  9:20               ` Markus Elfring
2025-03-05 14:17               ` David Laight
2025-03-05 14:30                 ` Dan Carpenter
2025-03-05 21:35                   ` David Laight
     [not found]   ` <54a21fea-64e3-de67-82ef-d61b90ffad05@web.de>
2023-04-13 15:49     ` [PATCH] perf map: Delete two variable initialisations before null pointer checks in sort__sym_from_cmp() Ian Rogers
     [not found]   ` <d8ed4e5d-49d4-ca7e-1283-1ec166bf643d@web.de>
2023-04-14 17:13     ` [PATCH] media: atomisp: Move a variable assignment behind a null pointer check in atomisp_cp_general_isp_parameters() Andy Shevchenko
2023-04-16 13:12       ` Hans de Goede
     [not found]   ` <d2403b7a-c6cd-4ee9-2a35-86ea57554eec@web.de>
2023-04-14 15:22     ` [PATCH] nvdimm: Replace the usage of a variable by a direct function call in nd_pfn_validate() Alison Schofield
     [not found]       ` <88f4dd20-4159-2b66-3adc-9a5a68f9eec7@web.de>
2023-04-14 19:14         ` Alison Schofield
2023-04-14 17:15     ` Andy Shevchenko
     [not found]   ` <b98dcc94-13f3-a6cb-f5bd-f1f8644d87d1@web.de>
2023-04-17  7:44     ` [PATCH] media: mediatek: vcodec: Move a variable assignment behind condition checks in vdec_vp9_slice_single_decode() AngeloGioacchino Del Regno
2023-04-17  8:01     ` Hans Verkuil
     [not found]   ` <622ed461-059b-455f-8a7b-7200a834bdc4@web.de>
2023-04-17  7:58     ` [PATCH] media: au0828: Move a variable assignment behind condition checks in au0828_isoc_copy() Hans Verkuil
     [not found]   ` <2a746461-844a-2ad6-7b52-03f13fe1b9bf@web.de>
2023-04-17 16:25     ` [PATCH 0/9] GPU-DRM-nouveau: Adjustments for seven function implementations Karol Herbst
     [not found]   ` <5800e1f5-8681-e140-fef0-8b2c3b4b6efa@web.de>
2023-04-18 12:51     ` [PATCH] gfs2: Move a variable assignment behind a null pointer check in inode_go_dump() Andreas Gruenbacher
2026-07-13 12:04       ` Markus Elfring
     [not found]   ` <c18331ca-3de9-d433-f477-b04103958b9c@web.de>
2023-04-19 19:03     ` [PATCH] ASoC: SOF: Intel: hda-stream: Move three variable assignments behind condition checks in hda_dsp_iccmax_stream_hw_params() Pierre-Louis Bossart
     [not found]   ` <93913f0c-4699-cf9a-0f10-8edd478fd2b3@web.de>
2023-04-21  5:32     ` [PATCH 0/4] staging: rtl8712: Adjustments for process_link_qual() Philipp Hortmann
     [not found]   ` <14636275-4d26-d639-5f6e-293fc6d1c4c6@web.de>
2023-04-25 13:30     ` [PATCH] drm/bridge: it6505: Move a variable assignment behind a null pointer check in receive_timing_debugfs_show() Robert Foss
     [not found]       ` <6f758653-36c9-91a2-7bbc-278ae3f8ccee@web.de>
2023-04-27 15:10         ` Robert Foss
     [not found]           ` <14083012-2f19-3760-a840-d685fcedc15e@web.de>
2023-04-28 11:49             ` Robert Foss
     [not found]               ` <fa69384f-1485-142b-c4ee-3df54ac68a89@web.de>
2023-04-28 17:27                 ` [PATCH resent] " Robert Foss
     [not found]   ` <2258ce64-2a14-6778-8319-b342b06a1f33@web.de>
     [not found]     ` <0d4b92ab-f7c2-4f18-f3c3-c0f82ba47fc8@web.de>
2023-04-11 13:59       ` [PATCH 1/5] drm/amdgpu: Move a variable assignment behind a null pointer check in amdgpu_ras_interrupt_dispatch() Felix Kuehling
2024-09-09  9:42       ` Markus Elfring
     [not found]     ` <89048a5f-2dbb-012c-41f5-7c300e8415f5@web.de>
2023-04-11 15:04       ` [PATCH 2/5] drm/amd/display: Move three variable assignments behind condition checks in trigger_hotplug() Christian König
2024-01-05 19:21     ` [PATCH 0/5] drm/amd: Adjustments for three function implementations Markus Elfring
     [not found]   ` <f7967bee-f3f1-54c4-7352-40c39dd7fead@web.de>
2025-03-02 16:55     ` [PATCH RESEND] qed: Move a variable assignment behind a null pointer check in two functions Markus Elfring
2025-03-03  6:21       ` Michal Swiatkowski
2025-03-03  7:40         ` Dan Carpenter
2025-03-03  8:22           ` [RESEND] " Markus Elfring
2025-03-03  8:28             ` Dan Carpenter
2025-03-03 10:25               ` Markus Elfring
2025-03-03 17:35               ` [RESEND] " Kory Maincent
2025-03-03 17:55                 ` Markus Elfring
     [not found]   ` <86551e6f-d529-1ff6-6ce6-b9669d10e6cb@web.de>
2025-03-02 18:02     ` [PATCH RESEND] video: au1100fb: Move a variable assignment behind a null pointer check in au1100fb_setmode() Markus Elfring
2025-03-03  9:19       ` Uwe Kleine-König
2025-03-03 10:08         ` Dan Carpenter
2025-03-03 10:08           ` Dan Carpenter
2025-03-03 10:14           ` Dan Carpenter
2025-03-03 10:30           ` Uwe Kleine-König
2025-03-03 10:36             ` Markus Elfring
2025-03-03 10:53             ` [PATCH RESEND] " Dan Carpenter
2025-03-05 12:14               ` Markus Elfring
2025-03-05 17:07                 ` Helge Deller
2025-03-05 17:28                   ` Markus Elfring
2025-03-08 21:26         ` [PATCH RESEND] " Helge Deller
     [not found]   ` <10e10996-d53d-0733-6d90-a04f251812ba@web.de>
2023-04-21  5:09     ` [PATCH] usb: dwc2: gadget: Move a variable assignment behind condition checks in dwc2_hsotg_handle_outdone() Minas Harutyunyan
2025-03-02 20:00     ` [PATCH RESEND] " Markus Elfring
     [not found]   ` <624fb730-d9de-ba92-1641-f21260b65283@web.de>
2025-03-02 20:30     ` [PATCH RESEND] tipc: Reduce scope for the variable “fdefq” in tipc_link_tnl_prepare() Markus Elfring
2025-03-05  2:50       ` Jakub Kicinski
     [not found]   ` <fffd36dd-ec5d-4678-9e63-c52b0a711e76@web.de>
2025-03-03  9:11     ` [PATCH RESEND] scsi: hpsa: Move two variable assignments behind condition checks in hpsa_scsi_ioaccel_raid_map() Markus Elfring
     [not found]   ` <a3329002-827e-d53b-8a4e-860342eb18f7@web.de>
2025-03-03 12:48     ` [PATCH RESEND] drm/mm: Adjust input parameter validation in DECLARE_NEXT_HOLE_ADDR() Markus Elfring
     [not found]   ` <d90b8c11-7a40-eec4-007d-3640c0725a56@web.de>
2025-03-03 13:04     ` [PATCH RESEND] iwlegacy: Adjust input parameter validation in il_set_ht_add_station() Markus Elfring
     [not found]   ` <9cb634c8-d6e6-32bc-5fd6-79bf6b274f96@web.de>
2025-03-03 13:18     ` Markus Elfring [this message]
2025-03-03 13:46       ` [PATCH RESEND] iwlwifi: Adjust input parameter validation in iwl_sta_calc_ht_flags() Berg, Benjamin

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=22e24ec8-283f-49e9-b7b0-555e8113c250@web.de \
    --to=markus.elfring@web.de \
    --cc=benjamin.berg@intel.com \
    --cc=cocci@inria.fr \
    --cc=davem@davemloft.net \
    --cc=edumazet@google.com \
    --cc=gregory.greenman@intel.com \
    --cc=horms@kernel.org \
    --cc=johannes.berg@intel.com \
    --cc=kernel-janitors@vger.kernel.org \
    --cc=kuba@kernel.org \
    --cc=kvalo@kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-wireless@vger.kernel.org \
    --cc=miriam.rachel.korenblit@intel.com \
    --cc=netdev@vger.kernel.org \
    --cc=pabeni@redhat.com \
    --cc=quic_srirrama@quicinc.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox

all inboxes | Powered by JetHome®