* Re: [PATCH] ath11k: modify null check logic in ath11k_ce_rx_post_pipe()
2024-09-09 15:08 [PATCH] ath11k: modify null check logic in ath11k_ce_rx_post_pipe() Mikhail Lobanov
@ 2024-09-19 16:46 ` Kalle Valo
2024-09-19 19:42 ` Jeff Johnson
2026-08-04 16:27 ` Rameshkumar Sundaram
` (2 subsequent siblings)
3 siblings, 1 reply; 6+ messages in thread
From: Kalle Valo @ 2024-09-19 16:46 UTC (permalink / raw)
To: Mikhail Lobanov
Cc: Mikhail Lobanov, Jeff Johnson, Govindaraj Saminathan, Miles Hu,
Sven Eckelmann, Rajkumar Manoharan, John Crispin, linux-wireless,
ath11k, linux-kernel, lvc-project
Mikhail Lobanov <m.lobanov@rosalinux.ru> wrote:
> The previous logic in ath11k_ce_rx_post_pipe() incorrectly required both
> dest_ring and status_ring to be NULL in order to exit the function.
> This caused the function to continue even if only one of the pointers
> was NULL, potentially leading to null pointer dereferences in
> ath11k_ce_rx_buf_enqueue_pipe().
>
> Fix the condition by modifying the logic so that the function returns
> early if either dest_ring or status_ring is NULL.
>
> Found by Linux Verification Center (linuxtesting.org) with SVACE.
>
> Fixes: d5c65159f289 ("ath11k: driver for Qualcomm IEEE 802.11ax devices")
> Signed-off-by: Mikhail Lobanov <m.lobanov@rosalinux.ru>
Jeff, what do you think?
--
https://patchwork.kernel.org/project/linux-wireless/patch/20240909150824.28195-1-m.lobanov@rosalinux.ru/
https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches
https://docs.kernel.org/process/submitting-patches.html
^ permalink raw reply [flat|nested] 6+ messages in thread* Re: [PATCH] ath11k: modify null check logic in ath11k_ce_rx_post_pipe()
2024-09-19 16:46 ` Kalle Valo
@ 2024-09-19 19:42 ` Jeff Johnson
0 siblings, 0 replies; 6+ messages in thread
From: Jeff Johnson @ 2024-09-19 19:42 UTC (permalink / raw)
To: Kalle Valo, Mikhail Lobanov
Cc: Jeff Johnson, Govindaraj Saminathan, Miles Hu, Sven Eckelmann,
Rajkumar Manoharan, John Crispin, linux-wireless, ath11k,
linux-kernel, lvc-project
On 9/19/2024 9:46 AM, Kalle Valo wrote:
> Mikhail Lobanov <m.lobanov@rosalinux.ru> wrote:
>
>> The previous logic in ath11k_ce_rx_post_pipe() incorrectly required both
>> dest_ring and status_ring to be NULL in order to exit the function.
>> This caused the function to continue even if only one of the pointers
>> was NULL, potentially leading to null pointer dereferences in
>> ath11k_ce_rx_buf_enqueue_pipe().
>>
>> Fix the condition by modifying the logic so that the function returns
>> early if either dest_ring or status_ring is NULL.
>>
>> Found by Linux Verification Center (linuxtesting.org) with SVACE.
>>
>> Fixes: d5c65159f289 ("ath11k: driver for Qualcomm IEEE 802.11ax devices")
>> Signed-off-by: Mikhail Lobanov <m.lobanov@rosalinux.ru>
>
> Jeff, what do you think?
>
Acked-by: Jeff Johnson <quic_jjohnson@quicinc.com>
(could have just s/||/&&/ but this change is also ok)
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH] ath11k: modify null check logic in ath11k_ce_rx_post_pipe()
2024-09-09 15:08 [PATCH] ath11k: modify null check logic in ath11k_ce_rx_post_pipe() Mikhail Lobanov
2024-09-19 16:46 ` Kalle Valo
@ 2026-08-04 16:27 ` Rameshkumar Sundaram
2026-08-11 2:24 ` Baochen Qiang
2026-09-09 17:57 ` Jeff Johnson
3 siblings, 0 replies; 6+ messages in thread
From: Rameshkumar Sundaram @ 2026-08-04 16:27 UTC (permalink / raw)
To: Mikhail Lobanov, Kalle Valo
Cc: Jeff Johnson, Govindaraj Saminathan, Miles Hu, Sven Eckelmann,
Rajkumar Manoharan, John Crispin, linux-wireless, ath11k,
linux-kernel, lvc-project
On 9/9/2024 8:38 PM, Mikhail Lobanov wrote:
> The previous logic in ath11k_ce_rx_post_pipe() incorrectly required both
> dest_ring and status_ring to be NULL in order to exit the function.
> This caused the function to continue even if only one of the pointers
> was NULL, potentially leading to null pointer dereferences in
> ath11k_ce_rx_buf_enqueue_pipe().
>
> Fix the condition by modifying the logic so that the function returns
> early if either dest_ring or status_ring is NULL.
>
> Found by Linux Verification Center (linuxtesting.org) with SVACE.
>
> Fixes: d5c65159f289 ("ath11k: driver for Qualcomm IEEE 802.11ax devices")
> Signed-off-by: Mikhail Lobanov <m.lobanov@rosalinux.ru>
Reviewed-by: Rameshkumar Sundaram <rameshkumar.sundaram@oss.qualcomm.com>
^ permalink raw reply [flat|nested] 6+ messages in thread* Re: [PATCH] ath11k: modify null check logic in ath11k_ce_rx_post_pipe()
2024-09-09 15:08 [PATCH] ath11k: modify null check logic in ath11k_ce_rx_post_pipe() Mikhail Lobanov
2024-09-19 16:46 ` Kalle Valo
2026-08-04 16:27 ` Rameshkumar Sundaram
@ 2026-08-11 2:24 ` Baochen Qiang
2026-09-09 17:57 ` Jeff Johnson
3 siblings, 0 replies; 6+ messages in thread
From: Baochen Qiang @ 2026-08-11 2:24 UTC (permalink / raw)
To: Mikhail Lobanov, Kalle Valo
Cc: Jeff Johnson, Govindaraj Saminathan, Miles Hu, Sven Eckelmann,
Rajkumar Manoharan, John Crispin, linux-wireless, ath11k,
linux-kernel, lvc-project
On 9/9/2024 11:08 PM, Mikhail Lobanov wrote:
> The previous logic in ath11k_ce_rx_post_pipe() incorrectly required both
> dest_ring and status_ring to be NULL in order to exit the function.
> This caused the function to continue even if only one of the pointers
> was NULL, potentially leading to null pointer dereferences in
> ath11k_ce_rx_buf_enqueue_pipe().
>
> Fix the condition by modifying the logic so that the function returns
> early if either dest_ring or status_ring is NULL.
>
> Found by Linux Verification Center (linuxtesting.org) with SVACE.
>
> Fixes: d5c65159f289 ("ath11k: driver for Qualcomm IEEE 802.11ax devices")
> Signed-off-by: Mikhail Lobanov <m.lobanov@rosalinux.ru>
> ---
> drivers/net/wireless/ath/ath11k/ce.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/net/wireless/ath/ath11k/ce.c b/drivers/net/wireless/ath/ath11k/ce.c
> index e66e86bdec20..9d4246d65d68 100644
> --- a/drivers/net/wireless/ath/ath11k/ce.c
> +++ b/drivers/net/wireless/ath/ath11k/ce.c
> @@ -324,7 +324,7 @@ static int ath11k_ce_rx_post_pipe(struct ath11k_ce_pipe *pipe)
> dma_addr_t paddr;
> int ret = 0;
>
> - if (!(pipe->dest_ring || pipe->status_ring))
> + if (!pipe->dest_ring || !pipe->status_ring)
> return 0;
>
> spin_lock_bh(&ab->ce.ce_lock);
Reviewed-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
^ permalink raw reply [flat|nested] 6+ messages in thread* Re: [PATCH] ath11k: modify null check logic in ath11k_ce_rx_post_pipe()
2024-09-09 15:08 [PATCH] ath11k: modify null check logic in ath11k_ce_rx_post_pipe() Mikhail Lobanov
` (2 preceding siblings ...)
2026-08-11 2:24 ` Baochen Qiang
@ 2026-09-09 17:57 ` Jeff Johnson
3 siblings, 0 replies; 6+ messages in thread
From: Jeff Johnson @ 2026-09-09 17:57 UTC (permalink / raw)
To: Kalle Valo, Mikhail Lobanov
Cc: Jeff Johnson, Govindaraj Saminathan, Miles Hu,
Rajkumar Manoharan, John Crispin, linux-wireless, ath11k,
linux-kernel, lvc-project, Sven Eckelmann
On Mon, 09 Sep 2024 11:08:20 -0400, Mikhail Lobanov wrote:
> The previous logic in ath11k_ce_rx_post_pipe() incorrectly required both
> dest_ring and status_ring to be NULL in order to exit the function.
> This caused the function to continue even if only one of the pointers
> was NULL, potentially leading to null pointer dereferences in
> ath11k_ce_rx_buf_enqueue_pipe().
>
> Fix the condition by modifying the logic so that the function returns
> early if either dest_ring or status_ring is NULL.
>
> [...]
Applied, thanks!
[1/1] ath11k: modify null check logic in ath11k_ce_rx_post_pipe()
commit: 52953d149ab4da0432d54b09f3c8add42b4d4a82
Best regards,
--
Jeff Johnson <jeff.johnson@oss.qualcomm.com>
^ permalink raw reply [flat|nested] 6+ messages in thread