diff options
| author | Benjamin Berg <benjamin.berg@intel.com> | 2024-03-08 12:00:12 +0100 |
|---|---|---|
| committer | iwlwifi publisher <> | 2024-04-17 13:35:40 +0000 |
| commit | d3a7d6e91854eb317974073fa7ad0150c3c2f010 (patch) | |
| tree | 98516767c49d4ca76a8d9a0f45f569370fdcfcac | |
| parent | d812b888da464f49b4ceadbccf0d298f7efe4922 (diff) | |
| download | backport-iwlwifi-d3a7d6e91854eb317974073fa7ad0150c3c2f010.tar.gz | |
[BUGFIX] wifi: iwlwifi: mvm: guard against invalid STA ID on removal
Guard against invalid station IDs in iwl_mvm_mld_rm_sta_id as that would
result in out-of-bounds array accesses. This prevents issues should the
driver get into a bad state during error handling.
type=bugfix
ticket=jira:WIFI-393588
Change-Id: I1cffd86363805bf86a95d8bdfd4b438bb54baddc
Signed-off-by: Benjamin Berg <benjamin.berg@intel.com>
Reviewed-on: https://gerritwcs.ir.intel.com/c/iwlwifi-stack-dev/+/98218
tested: iil_jenkins iil_jenkins <EC.GER.UNIX.IIL.JENKINS@INTEL.COM>
Reviewed-by: Miriam Rachel Korenblit <miriam.rachel.korenblit@intel.com>
Reviewed-on: https://gerritwcs.ir.intel.com/c/iwlwifi-stack-dev/+/99148
Reviewed-by: Golan Ben Ami <golan.ben.ami@intel.com>
x-iwlwifi-stack-dev: 101f93c8a4b586b3d1e8749dcd83986660499170
| -rw-r--r-- | drivers/net/wireless/intel/iwlwifi/mvm/mld-sta.c | 7 | ||||
| -rw-r--r-- | versions | 2 |
2 files changed, 7 insertions, 2 deletions
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mld-sta.c b/drivers/net/wireless/intel/iwlwifi/mvm/mld-sta.c index c714c70bc7..d7da9af4bb 100644 --- a/drivers/net/wireless/intel/iwlwifi/mvm/mld-sta.c +++ b/drivers/net/wireless/intel/iwlwifi/mvm/mld-sta.c @@ -879,10 +879,15 @@ int iwl_mvm_mld_rm_sta(struct iwl_mvm *mvm, struct ieee80211_vif *vif, int iwl_mvm_mld_rm_sta_id(struct iwl_mvm *mvm, u8 sta_id) { - int ret = iwl_mvm_mld_rm_sta_from_fw(mvm, sta_id); + int ret; lockdep_assert_held(&mvm->mutex); + if (WARN_ON(sta_id == IWL_MVM_INVALID_STA)) + return 0; + + ret = iwl_mvm_mld_rm_sta_from_fw(mvm, sta_id); + RCU_INIT_POINTER(mvm->fw_id_to_mac_id[sta_id], NULL); RCU_INIT_POINTER(mvm->fw_id_to_link_sta[sta_id], NULL); return ret; @@ -2,5 +2,5 @@ BACKPORTS_VERSION="(see git)" BACKPORTED_KERNEL_VERSION="(see git)" BACKPORTED_KERNEL_NAME="iwlwifi" BACKPORTS_BUILD_TSTAMP=__DATE__ \" \" __TIME__ -BACKPORTS_GIT_TRACKED="iwlwifi-stack-public:release/core87:12011:4f70dc32" +BACKPORTS_GIT_TRACKED="iwlwifi-stack-public:release/core87:12012:101f93c8" BACKPORTS_BRANCH_TSTAMP="Apr 17 2024 13:11:40" |