lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-ID: <20231226002420.6303-7-sashal@kernel.org> Date: Mon, 25 Dec 2023 19:23:56 -0500 From: Sasha Levin <sashal@...nel.org> To: linux-kernel@...r.kernel.org, stable@...r.kernel.org Cc: Avraham Stern <avraham.stern@...el.com>, Miri Korenblit <miriam.rachel.korenblit@...el.com>, Johannes Berg <johannes.berg@...el.com>, Sasha Levin <sashal@...nel.org>, gregory.greenman@...el.com, kvalo@...nel.org, benjamin.berg@...el.com, ansuelsmth@...il.com, pagadala.yesu.anjaneyulu@...el.com, linux-wireless@...r.kernel.org Subject: [PATCH AUTOSEL 5.15 07/11] wifi: iwlwifi: pcie: avoid a NULL pointer dereference From: Avraham Stern <avraham.stern@...el.com> [ Upstream commit ce038edfce43fb345f8dfdca0f7b17f535896701 ] It possible that while the rx rb is being handled, the transport has been stopped and re-started. In this case the tx queue pointer is not yet initialized, which will lead to a NULL pointer dereference. Fix it. Signed-off-by: Avraham Stern <avraham.stern@...el.com> Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@...el.com> Link: https://msgid.link/20231207044813.cd0898cafd89.I0b84daae753ba9612092bf383f5c6f761446e964@changeid Signed-off-by: Johannes Berg <johannes.berg@...el.com> Signed-off-by: Sasha Levin <sashal@...nel.org> --- drivers/net/wireless/intel/iwlwifi/pcie/rx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/rx.c b/drivers/net/wireless/intel/iwlwifi/pcie/rx.c index df201d40f6c95..92f14ea13a573 100644 --- a/drivers/net/wireless/intel/iwlwifi/pcie/rx.c +++ b/drivers/net/wireless/intel/iwlwifi/pcie/rx.c @@ -1380,7 +1380,7 @@ static void iwl_pcie_rx_handle_rb(struct iwl_trans *trans, * if it is true then one of the handlers took the page. */ - if (reclaim) { + if (reclaim && txq) { u16 sequence = le16_to_cpu(pkt->hdr.sequence); int index = SEQ_TO_INDEX(sequence); int cmd_index = iwl_txq_get_cmd_index(txq, index); -- 2.43.0
Powered by blists - more mailing lists