Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit f4f155e5 authored by Sara Sharon's avatar Sara Sharon Committed by Luca Coelho
Browse files

iwlwifi: mvm: take RCU lock before dereferencing 



RCU isn't properly locked.

Fixes: 46d372af ("iwlwifi: mvm: rs: new rate scale API - add FW notifications")
Signed-off-by: default avatarSara Sharon <sara.sharon@intel.com>
Signed-off-by: default avatarLuca Coelho <luciano.coelho@intel.com>
parent e4d72208

drivers/net/wireless/intel/iwlwifi/mvm/rs-fw.c

+5 −1
Original line number Diff line number Diff line
@@ -234,13 +234,15 @@ void iwl_mvm_tlc_update_notif(struct iwl_mvm *mvm, struct iwl_rx_packet *pkt) 
	struct iwl_mvm_sta *mvmsta;

	struct iwl_lq_sta_rs_fw *lq_sta;



	rcu_read_lock();



	notif = (void *)pkt->data;

	mvmsta = iwl_mvm_sta_from_staid_rcu(mvm, notif->sta_id);



	if (!mvmsta) {

		IWL_ERR(mvm, "Invalid sta id (%d) in FW TLC notification\n",

			notif->sta_id);

		return;

		goto out;

	}



	lq_sta = &mvmsta->lq_sta.rs_fw;
@@ -251,6 +253,8 @@ void iwl_mvm_tlc_update_notif(struct iwl_mvm *mvm, struct iwl_rx_packet *pkt) 
		IWL_DEBUG_RATE(mvm, "new rate_n_flags: 0x%X\n",

			       lq_sta->last_rate_n_flags);

	}

out:

	rcu_read_unlock();

}



void rs_fw_rate_init(struct iwl_mvm *mvm, struct ieee80211_sta *sta,