iwlwifi: mvm: fix a possible NULL pointer deference

Smatch spot a possible NULL pointer dereference. Fix it.

__iwl_mvm_mac_set_key can be called with sta = NULL
Also add a NULL pointer check after memory allocation.

Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Link: https://lore.kernel.org/r/20211130105951.85539-1-emmanuel.grumbach@intel.com
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>

diff --git a/drivers/net/wireless/intel/iwlwifi/mei/main.c b/drivers/net/wireless/intel/iwlwifi/mei/main.c
index 3435998f079134a5a9c762a3d620643fc310eda9..4453cd2571c2cca3ba31e8b6178aef2066a904af 100644 (file)
--- a/drivers/net/wireless/intel/iwlwifi/mei/main.c
+++ b/drivers/net/wireless/intel/iwlwifi/mei/main.c
@@ -632,6 +632,8 @@ static void iwl_mei_handle_csme_filters(struct mei_cl_device *cldev,
                                          lockdep_is_held(&iwl_mei_mutex));
 
        new_filters = kzalloc(sizeof(*new_filters), GFP_KERNEL);
+       if (!new_filters)
+               return;
 
        /* Copy the OOB filters */
        new_filters->filters = filters->filters;

diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
index 20422e6400590db69c6ec16924b3e8b048df26fc..aac2c03fbcb3441ec662de476ca95384e96448c0 100644 (file)
--- a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
@@ -3563,13 +3563,14 @@ static int __iwl_mvm_mac_set_key(struct ieee80211_hw *hw,
 {
        struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
        struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
-       struct iwl_mvm_sta *mvmsta;
+       struct iwl_mvm_sta *mvmsta = NULL;
        struct iwl_mvm_key_pn *ptk_pn;
        int keyidx = key->keyidx;
        int ret, i;
        u8 key_offset;
 
-       mvmsta = iwl_mvm_sta_from_mac80211(sta);
+       if (sta)
+               mvmsta = iwl_mvm_sta_from_mac80211(sta);
 
        switch (key->cipher) {
        case WLAN_CIPHER_SUITE_TKIP:
@@ -3671,7 +3672,7 @@ static int __iwl_mvm_mac_set_key(struct ieee80211_hw *hw,
                }
 
                if (!test_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status) &&
-                   sta && iwl_mvm_has_new_rx_api(mvm) &&
+                   mvmsta && iwl_mvm_has_new_rx_api(mvm) &&
                    key->flags & IEEE80211_KEY_FLAG_PAIRWISE &&
                    (key->cipher == WLAN_CIPHER_SUITE_CCMP ||
                     key->cipher == WLAN_CIPHER_SUITE_GCMP ||
@@ -3705,7 +3706,7 @@ static int __iwl_mvm_mac_set_key(struct ieee80211_hw *hw,
                else
                        key_offset = STA_KEY_IDX_INVALID;
 
-               if (key->flags & IEEE80211_KEY_FLAG_PAIRWISE)
+               if (mvmsta && key->flags & IEEE80211_KEY_FLAG_PAIRWISE)
                        mvmsta->pairwise_cipher = key->cipher;
 
                IWL_DEBUG_MAC80211(mvm, "set hwcrypto key\n");
@@ -3748,7 +3749,7 @@ static int __iwl_mvm_mac_set_key(struct ieee80211_hw *hw,
                        break;
                }
 
-               if (sta && iwl_mvm_has_new_rx_api(mvm) &&
+               if (mvmsta && iwl_mvm_has_new_rx_api(mvm) &&
                    key->flags & IEEE80211_KEY_FLAG_PAIRWISE &&
                    (key->cipher == WLAN_CIPHER_SUITE_CCMP ||
                     key->cipher == WLAN_CIPHER_SUITE_GCMP ||