Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 80e9e5cd authored by Eyal Shapira's avatar Eyal Shapira Committed by Emmanuel Grumbach
Browse files

iwlwifi: mvm: rs: fix a potential NULL deref 



Found by klocwork analysis.
mvm could be NULL which may cause a NULL dereference
in a theoretical call flow

rs_fill_lq_cmd(mvm = NULL, ...)
rs_build_rates_table
rs_fill_rates_for_column
ucode_rate_from_rs_rate
IWL_ERR(mvm,...)

No real reason for passing NULL to rs_fill_lq_cmd so fix that.

Reported-by: default avatarEytan Lifshitz <eytan.lifshitz@intel.com>
Signed-off-by: default avatarEyal Shapira <eyal@wizery.com>
Signed-off-by: default avatarEmmanuel Grumbach <emmanuel.grumbach@intel.com>
parent 6e97b0d2

drivers/net/wireless/iwlwifi/mvm/rs.c

+3 −4
Original line number Diff line number Diff line
@@ -2121,7 +2121,7 @@ static void rs_initialize_lq(struct iwl_mvm *mvm, 
		tbl->column = RS_COLUMN_LEGACY_ANT_B;



	rs_set_expected_tpt_table(lq_sta, tbl);

	rs_fill_lq_cmd(NULL, NULL, lq_sta, rate);

	rs_fill_lq_cmd(mvm, sta, lq_sta, rate);

	/* TODO restore station should remember the lq cmd */

	iwl_mvm_send_lq_cmd(mvm, &lq_sta->lq, init);

}
@@ -2448,7 +2448,6 @@ static void rs_build_rates_table(struct iwl_mvm *mvm, 


	memcpy(&rate, initial_rate, sizeof(rate));



	if (mvm)

	valid_tx_ant = iwl_fw_valid_tx_ant(mvm->fw);



	if (is_siso(&rate)) {
@@ -2623,7 +2622,7 @@ static void rs_program_fix_rate(struct iwl_mvm *mvm, 
		struct rs_rate rate;

		rs_rate_from_ucode_rate(lq_sta->dbg_fixed_rate,

					lq_sta->band, &rate);

		rs_fill_lq_cmd(NULL, NULL, lq_sta, &rate);

		rs_fill_lq_cmd(mvm, NULL, lq_sta, &rate);

		iwl_mvm_send_lq_cmd(lq_sta->drv, &lq_sta->lq, false);

	}

}