From 52953d149ab4da0432d54b09f3c8add42b4d4a82 Mon Sep 17 00:00:00 2001 From: Mikhail Lobanov Date: Mon, 9 Sep 2024 11:08:20 -0400 Subject: [PATCH] wifi: ath11k: modify null check logic in ath11k_ce_rx_post_pipe() The previous logic in ath11k_ce_rx_post_pipe() incorrectly required both dest_ring and status_ring to be NULL in order to exit the function. This caused the function to continue even if only one of the pointers was NULL, potentially leading to null pointer dereferences in ath11k_ce_rx_buf_enqueue_pipe(). Fix the condition by modifying the logic so that the function returns early if either dest_ring or status_ring is NULL. Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: d5c65159f289 ("ath11k: driver for Qualcomm IEEE 802.11ax devices") Signed-off-by: Mikhail Lobanov Reviewed-by: Baochen Qiang Reviewed-by: Rameshkumar Sundaram Acked-by: Jeff Johnson Link: https://patch.msgid.link/20240909150824.28195-1-m.lobanov@rosalinux.ru Signed-off-by: Jeff Johnson --- drivers/net/wireless/ath/ath11k/ce.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/wireless/ath/ath11k/ce.c b/drivers/net/wireless/ath/ath11k/ce.c index c56dd8a86760..1e08b0970b14 100644 --- a/drivers/net/wireless/ath/ath11k/ce.c +++ b/drivers/net/wireless/ath/ath11k/ce.c @@ -325,7 +325,7 @@ static int ath11k_ce_rx_post_pipe(struct ath11k_ce_pipe *pipe) dma_addr_t paddr; int ret = 0; - if (!(pipe->dest_ring || pipe->status_ring)) + if (!pipe->dest_ring || !pipe->status_ring) return 0; spin_lock_bh(&ab->ce.ce_lock);