* [PATCH] ath11k: modify null check logic in ath11k_ce_rx_post_pipe()
@ 2024-09-09 15:08 Mikhail Lobanov
2024-09-19 16:46 ` Kalle Valo
` (3 more replies)
0 siblings, 4 replies; 6+ messages in thread
From: Mikhail Lobanov @ 2024-09-09 15:08 UTC (permalink / raw)
To: Kalle Valo
Cc: Mikhail Lobanov, Jeff Johnson, Govindaraj Saminathan, Miles Hu,
Sven Eckelmann, Rajkumar Manoharan, John Crispin, linux-wireless,
ath11k, linux-kernel, lvc-project
The previous logic in ath11k_ce_rx_post_pipe() incorrectly required both
dest_ring and status_ring to be NULL in order to exit the function.
This caused the function to continue even if only one of the pointers
was NULL, potentially leading to null pointer dereferences in
ath11k_ce_rx_buf_enqueue_pipe().
Fix the condition by modifying the logic so that the function returns
early if either dest_ring or status_ring is NULL.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Fixes: d5c65159f289 ("ath11k: driver for Qualcomm IEEE 802.11ax devices")
Signed-off-by: Mikhail Lobanov <m.lobanov@rosalinux.ru>
---
drivers/net/wireless/ath/ath11k/ce.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/wireless/ath/ath11k/ce.c b/drivers/net/wireless/ath/ath11k/ce.c
index e66e86bdec20..9d4246d65d68 100644
--- a/drivers/net/wireless/ath/ath11k/ce.c
+++ b/drivers/net/wireless/ath/ath11k/ce.c
@@ -324,7 +324,7 @@ static int ath11k_ce_rx_post_pipe(struct ath11k_ce_pipe *pipe)
dma_addr_t paddr;
int ret = 0;
- if (!(pipe->dest_ring || pipe->status_ring))
+ if (!pipe->dest_ring || !pipe->status_ring)
return 0;
spin_lock_bh(&ab->ce.ce_lock);
--
2.43.0
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH] ath11k: modify null check logic in ath11k_ce_rx_post_pipe()
2024-09-09 15:08 [PATCH] ath11k: modify null check logic in ath11k_ce_rx_post_pipe() Mikhail Lobanov
@ 2024-09-19 16:46 ` Kalle Valo
2024-09-19 19:42 ` Jeff Johnson
2026-08-04 16:27 ` Rameshkumar Sundaram
` (2 subsequent siblings)
3 siblings, 1 reply; 6+ messages in thread
From: Kalle Valo @ 2024-09-19 16:46 UTC (permalink / raw)
To: Mikhail Lobanov
Cc: Mikhail Lobanov, Jeff Johnson, Govindaraj Saminathan, Miles Hu,
Sven Eckelmann, Rajkumar Manoharan, John Crispin, linux-wireless,
ath11k, linux-kernel, lvc-project
Mikhail Lobanov <m.lobanov@rosalinux.ru> wrote:
> The previous logic in ath11k_ce_rx_post_pipe() incorrectly required both
> dest_ring and status_ring to be NULL in order to exit the function.
> This caused the function to continue even if only one of the pointers
> was NULL, potentially leading to null pointer dereferences in
> ath11k_ce_rx_buf_enqueue_pipe().
>
> Fix the condition by modifying the logic so that the function returns
> early if either dest_ring or status_ring is NULL.
>
> Found by Linux Verification Center (linuxtesting.org) with SVACE.
>
> Fixes: d5c65159f289 ("ath11k: driver for Qualcomm IEEE 802.11ax devices")
> Signed-off-by: Mikhail Lobanov <m.lobanov@rosalinux.ru>
Jeff, what do you think?
--
https://patchwork.kernel.org/project/linux-wireless/patch/20240909150824.28195-1-m.lobanov@rosalinux.ru/
https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches
https://docs.kernel.org/process/submitting-patches.html
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH] ath11k: modify null check logic in ath11k_ce_rx_post_pipe()
2024-09-19 16:46 ` Kalle Valo
@ 2024-09-19 19:42 ` Jeff Johnson
0 siblings, 0 replies; 6+ messages in thread
From: Jeff Johnson @ 2024-09-19 19:42 UTC (permalink / raw)
To: Kalle Valo, Mikhail Lobanov
Cc: Jeff Johnson, Govindaraj Saminathan, Miles Hu, Sven Eckelmann,
Rajkumar Manoharan, John Crispin, linux-wireless, ath11k,
linux-kernel, lvc-project
On 9/19/2024 9:46 AM, Kalle Valo wrote:
> Mikhail Lobanov <m.lobanov@rosalinux.ru> wrote:
>
>> The previous logic in ath11k_ce_rx_post_pipe() incorrectly required both
>> dest_ring and status_ring to be NULL in order to exit the function.
>> This caused the function to continue even if only one of the pointers
>> was NULL, potentially leading to null pointer dereferences in
>> ath11k_ce_rx_buf_enqueue_pipe().
>>
>> Fix the condition by modifying the logic so that the function returns
>> early if either dest_ring or status_ring is NULL.
>>
>> Found by Linux Verification Center (linuxtesting.org) with SVACE.
>>
>> Fixes: d5c65159f289 ("ath11k: driver for Qualcomm IEEE 802.11ax devices")
>> Signed-off-by: Mikhail Lobanov <m.lobanov@rosalinux.ru>
>
> Jeff, what do you think?
>
Acked-by: Jeff Johnson <quic_jjohnson@quicinc.com>
(could have just s/||/&&/ but this change is also ok)
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH] ath11k: modify null check logic in ath11k_ce_rx_post_pipe()
2024-09-09 15:08 [PATCH] ath11k: modify null check logic in ath11k_ce_rx_post_pipe() Mikhail Lobanov
2024-09-19 16:46 ` Kalle Valo
@ 2026-08-04 16:27 ` Rameshkumar Sundaram
2026-08-11 2:24 ` Baochen Qiang
2026-09-09 17:57 ` Jeff Johnson
3 siblings, 0 replies; 6+ messages in thread
From: Rameshkumar Sundaram @ 2026-08-04 16:27 UTC (permalink / raw)
To: Mikhail Lobanov, Kalle Valo
Cc: Jeff Johnson, Govindaraj Saminathan, Miles Hu, Sven Eckelmann,
Rajkumar Manoharan, John Crispin, linux-wireless, ath11k,
linux-kernel, lvc-project
On 9/9/2024 8:38 PM, Mikhail Lobanov wrote:
> The previous logic in ath11k_ce_rx_post_pipe() incorrectly required both
> dest_ring and status_ring to be NULL in order to exit the function.
> This caused the function to continue even if only one of the pointers
> was NULL, potentially leading to null pointer dereferences in
> ath11k_ce_rx_buf_enqueue_pipe().
>
> Fix the condition by modifying the logic so that the function returns
> early if either dest_ring or status_ring is NULL.
>
> Found by Linux Verification Center (linuxtesting.org) with SVACE.
>
> Fixes: d5c65159f289 ("ath11k: driver for Qualcomm IEEE 802.11ax devices")
> Signed-off-by: Mikhail Lobanov <m.lobanov@rosalinux.ru>
Reviewed-by: Rameshkumar Sundaram <rameshkumar.sundaram@oss.qualcomm.com>
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH] ath11k: modify null check logic in ath11k_ce_rx_post_pipe()
2024-09-09 15:08 [PATCH] ath11k: modify null check logic in ath11k_ce_rx_post_pipe() Mikhail Lobanov
2024-09-19 16:46 ` Kalle Valo
2026-08-04 16:27 ` Rameshkumar Sundaram
@ 2026-08-11 2:24 ` Baochen Qiang
2026-09-09 17:57 ` Jeff Johnson
3 siblings, 0 replies; 6+ messages in thread
From: Baochen Qiang @ 2026-08-11 2:24 UTC (permalink / raw)
To: Mikhail Lobanov, Kalle Valo
Cc: Jeff Johnson, Govindaraj Saminathan, Miles Hu, Sven Eckelmann,
Rajkumar Manoharan, John Crispin, linux-wireless, ath11k,
linux-kernel, lvc-project
On 9/9/2024 11:08 PM, Mikhail Lobanov wrote:
> The previous logic in ath11k_ce_rx_post_pipe() incorrectly required both
> dest_ring and status_ring to be NULL in order to exit the function.
> This caused the function to continue even if only one of the pointers
> was NULL, potentially leading to null pointer dereferences in
> ath11k_ce_rx_buf_enqueue_pipe().
>
> Fix the condition by modifying the logic so that the function returns
> early if either dest_ring or status_ring is NULL.
>
> Found by Linux Verification Center (linuxtesting.org) with SVACE.
>
> Fixes: d5c65159f289 ("ath11k: driver for Qualcomm IEEE 802.11ax devices")
> Signed-off-by: Mikhail Lobanov <m.lobanov@rosalinux.ru>
> ---
> drivers/net/wireless/ath/ath11k/ce.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/net/wireless/ath/ath11k/ce.c b/drivers/net/wireless/ath/ath11k/ce.c
> index e66e86bdec20..9d4246d65d68 100644
> --- a/drivers/net/wireless/ath/ath11k/ce.c
> +++ b/drivers/net/wireless/ath/ath11k/ce.c
> @@ -324,7 +324,7 @@ static int ath11k_ce_rx_post_pipe(struct ath11k_ce_pipe *pipe)
> dma_addr_t paddr;
> int ret = 0;
>
> - if (!(pipe->dest_ring || pipe->status_ring))
> + if (!pipe->dest_ring || !pipe->status_ring)
> return 0;
>
> spin_lock_bh(&ab->ce.ce_lock);
Reviewed-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH] ath11k: modify null check logic in ath11k_ce_rx_post_pipe()
2024-09-09 15:08 [PATCH] ath11k: modify null check logic in ath11k_ce_rx_post_pipe() Mikhail Lobanov
` (2 preceding siblings ...)
2026-08-11 2:24 ` Baochen Qiang
@ 2026-09-09 17:57 ` Jeff Johnson
3 siblings, 0 replies; 6+ messages in thread
From: Jeff Johnson @ 2026-09-09 17:57 UTC (permalink / raw)
To: Kalle Valo, Mikhail Lobanov
Cc: Jeff Johnson, Govindaraj Saminathan, Miles Hu,
Rajkumar Manoharan, John Crispin, linux-wireless, ath11k,
linux-kernel, lvc-project, Sven Eckelmann
On Mon, 09 Sep 2024 11:08:20 -0400, Mikhail Lobanov wrote:
> The previous logic in ath11k_ce_rx_post_pipe() incorrectly required both
> dest_ring and status_ring to be NULL in order to exit the function.
> This caused the function to continue even if only one of the pointers
> was NULL, potentially leading to null pointer dereferences in
> ath11k_ce_rx_buf_enqueue_pipe().
>
> Fix the condition by modifying the logic so that the function returns
> early if either dest_ring or status_ring is NULL.
>
> [...]
Applied, thanks!
[1/1] ath11k: modify null check logic in ath11k_ce_rx_post_pipe()
commit: 52953d149ab4da0432d54b09f3c8add42b4d4a82
Best regards,
--
Jeff Johnson <jeff.johnson@oss.qualcomm.com>
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2026-09-09 17:57 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2024-09-09 15:08 [PATCH] ath11k: modify null check logic in ath11k_ce_rx_post_pipe() Mikhail Lobanov
2024-09-19 16:46 ` Kalle Valo
2024-09-19 19:42 ` Jeff Johnson
2026-08-04 16:27 ` Rameshkumar Sundaram
2026-08-11 2:24 ` Baochen Qiang
2026-09-09 17:57 ` Jeff Johnson
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®