From: Jeff Johnson <quic_jjohnson@quicinc.com>
To: Kalle Valo <kvalo@kernel.org>, Mikhail Lobanov <m.lobanov@rosalinux.ru>
Cc: Jeff Johnson <jjohnson@kernel.org>,
Govindaraj Saminathan <quic_gsamin@quicinc.com>,
Miles Hu <milehu@codeaurora.org>,
Sven Eckelmann <seckelmann@datto.com>,
Rajkumar Manoharan <rmanohar@codeaurora.org>,
John Crispin <john@phrozen.org>, <linux-wireless@vger.kernel.org>,
<ath11k@lists.infradead.org>, <linux-kernel@vger.kernel.org>,
<lvc-project@linuxtesting.org>
Subject: Re: [PATCH] ath11k: modify null check logic in ath11k_ce_rx_post_pipe()
Date: Thu, 19 Sep 2024 12:42:45 -0700 [thread overview]
Message-ID: <9ebea291-df1e-4d2d-8f86-9a089542d895@quicinc.com> (raw)
In-Reply-To: <172676437762.281449.1201751345434084726.kvalo@kernel.org>
On 9/19/2024 9:46 AM, Kalle Valo wrote:
> Mikhail Lobanov <m.lobanov@rosalinux.ru> wrote:
>
>> The previous logic in ath11k_ce_rx_post_pipe() incorrectly required both
>> dest_ring and status_ring to be NULL in order to exit the function.
>> This caused the function to continue even if only one of the pointers
>> was NULL, potentially leading to null pointer dereferences in
>> ath11k_ce_rx_buf_enqueue_pipe().
>>
>> Fix the condition by modifying the logic so that the function returns
>> early if either dest_ring or status_ring is NULL.
>>
>> Found by Linux Verification Center (linuxtesting.org) with SVACE.
>>
>> Fixes: d5c65159f289 ("ath11k: driver for Qualcomm IEEE 802.11ax devices")
>> Signed-off-by: Mikhail Lobanov <m.lobanov@rosalinux.ru>
>
> Jeff, what do you think?
>
Acked-by: Jeff Johnson <quic_jjohnson@quicinc.com>
(could have just s/||/&&/ but this change is also ok)
next prev parent reply other threads:[~2024-09-19 19:43 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-09-09 15:08 Mikhail Lobanov
2024-09-19 16:46 ` Kalle Valo
2024-09-19 19:42 ` Jeff Johnson [this message]
2026-08-04 16:27 ` Rameshkumar Sundaram
2026-08-11 2:24 ` Baochen Qiang
2026-09-09 17:57 ` Jeff Johnson
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=9ebea291-df1e-4d2d-8f86-9a089542d895@quicinc.com \
--to=quic_jjohnson@quicinc.com \
--cc=ath11k@lists.infradead.org \
--cc=jjohnson@kernel.org \
--cc=john@phrozen.org \
--cc=kvalo@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-wireless@vger.kernel.org \
--cc=lvc-project@linuxtesting.org \
--cc=m.lobanov@rosalinux.ru \
--cc=milehu@codeaurora.org \
--cc=quic_gsamin@quicinc.com \
--cc=rmanohar@codeaurora.org \
--cc=seckelmann@datto.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®