Commit eaa7ce66 authored by Ilan Peer's avatar Ilan Peer Committed by Johannes Berg
Browse files

wifi: mac80211_hwsim: Fix possible NULL dereference 



The 'vif' pointer in the Tx information might be NULL, e.g., in
case of injected frames etc. and is not checked in all paths. Fix it.
While at it, also directly use the local 'vif' pointer.

Fixes: a37a6f54 ("wifi: mac80211_hwsim: Add simulation support for NAN device")
Signed-off-by: default avatarIlan Peer <ilan.peer@intel.com>
Reported-by: default avatarDan Carpenter <dan.carpenter@linaro.org>
Closes: https://lore.kernel.org/linux-wireless/aNJUlyIiSTW9zZdr@stanley.mountain


Reviewed-by: default avatarJohannes Berg <johannes.berg@intel.com>
Signed-off-by: default avatarMiri Korenblit <miriam.rachel.korenblit@intel.com>
Link: https://patch.msgid.link/20251110140128.ec00ae795a32.I9c65659b52434189d8b2ba06710d482669a3887a@changeid


Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
parent 7fe0d21f

drivers/net/wireless/virtual/mac80211_hwsim.c

+10 −4
Original line number Diff line number Diff line
@@ -2003,8 +2003,14 @@ static void mac80211_hwsim_tx(struct ieee80211_hw *hw, 
		struct ieee80211_sta *sta = control->sta;

		struct ieee80211_bss_conf *bss_conf;



		/* This can happen in case of monitor injection */

		if (!vif) {

			ieee80211_free_txskb(hw, skb);

			return;

		}



		if (link != IEEE80211_LINK_UNSPECIFIED) {

			bss_conf = rcu_dereference(txi->control.vif->link_conf[link]);

			bss_conf = rcu_dereference(vif->link_conf[link]);

			if (sta)

				link_sta = rcu_dereference(sta->link[link]);

		} else {
@@ -2065,13 +2071,13 @@ static void mac80211_hwsim_tx(struct ieee80211_hw *hw, 
		return;

	}



	if (txi->control.vif)

		hwsim_check_magic(txi->control.vif);

	if (vif)

		hwsim_check_magic(vif);

	if (control->sta)

		hwsim_check_sta_magic(control->sta);



	if (ieee80211_hw_check(hw, SUPPORTS_RC_TABLE))

		ieee80211_get_tx_rates(txi->control.vif, control->sta, skb,

		ieee80211_get_tx_rates(vif, control->sta, skb,

				       txi->control.rates,

				       ARRAY_SIZE(txi->control.rates));