Commit 17f64517 authored by Benjamin Berg's avatar Benjamin Berg Committed by Johannes Berg
Browse files

wifi: iwlwifi: mvm: guard against invalid STA ID on removal 



Guard against invalid station IDs in iwl_mvm_mld_rm_sta_id as that would
result in out-of-bounds array accesses. This prevents issues should the
driver get into a bad state during error handling.

Signed-off-by: default avatarBenjamin Berg <benjamin.berg@intel.com>
Signed-off-by: default avatarMiri Korenblit <miriam.rachel.korenblit@intel.com>
Link: https://msgid.link/20240320232419.d523167bda9c.I1cffd86363805bf86a95d8bdfd4b438bb54baddc@changeid


Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
parent c2ace630

drivers/net/wireless/intel/iwlwifi/mvm/mld-sta.c

+6 −1
Original line number Diff line number Diff line
@@ -855,10 +855,15 @@ int iwl_mvm_mld_rm_sta(struct iwl_mvm *mvm, struct ieee80211_vif *vif, 


int iwl_mvm_mld_rm_sta_id(struct iwl_mvm *mvm, u8 sta_id)

{

	int ret = iwl_mvm_mld_rm_sta_from_fw(mvm, sta_id);

	int ret;



	lockdep_assert_held(&mvm->mutex);



	if (WARN_ON(sta_id == IWL_MVM_INVALID_STA))

		return 0;



	ret = iwl_mvm_mld_rm_sta_from_fw(mvm, sta_id);



	RCU_INIT_POINTER(mvm->fw_id_to_mac_id[sta_id], NULL);

	RCU_INIT_POINTER(mvm->fw_id_to_link_sta[sta_id], NULL);

	return ret;