linux-kernel - RE: drivers/net/wireless/intel/iwlwifi/mld/mac80211.c:2093 iwl_mld_set_key_add() error: we previously assumed 'mld

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <DM3PPF63A6024A9B5D0F46BBAB9CADD604FA323A@DM3PPF63A6024A9.namprd11.prod.outlook.com>
Date: Mon, 4 Aug 2025 06:53:03 +0000
From: "Korenblit, Miriam Rachel" <miriam.rachel.korenblit@...el.com>
To: Dan Carpenter <dan.carpenter@...aro.org>, "oe-kbuild@...ts.linux.dev"
	<oe-kbuild@...ts.linux.dev>
CC: lkp <lkp@...el.com>, "oe-kbuild-all@...ts.linux.dev"
	<oe-kbuild-all@...ts.linux.dev>, "linux-kernel@...r.kernel.org"
	<linux-kernel@...r.kernel.org>, "Berg, Johannes" <johannes.berg@...el.com>,
	"Stern, Avraham" <avraham.stern@...el.com>, "Gabay, Daniel"
	<daniel.gabay@...el.com>, "Grumbach, Emmanuel" <emmanuel.grumbach@...el.com>,
	"Anjaneyulu, Pagadala Yesu" <pagadala.yesu.anjaneyulu@...el.com>, "Ben
 Shimol, Yedidya" <yedidya.ben.shimol@...el.com>, "Berg, Benjamin"
	<benjamin.berg@...el.com>, "Triebitz, Shaul" <shaul.triebitz@...el.com>
Subject: RE: drivers/net/wireless/intel/iwlwifi/mld/mac80211.c:2093
 iwl_mld_set_key_add() error: we previously assumed 'mld_sta' could be null
 (see line 2076)


> d1e879ec600f9b Miri Korenblit 2025-02-16  2075
> d1e879ec600f9b Miri Korenblit 2025-02-16 @2076  	if (!mld-
> >fw_status.in_hw_restart && mld_sta &&
>                                                                                              ^^^^^^^ This code assumes
> that mld_sta can be NULL
> 
> d1e879ec600f9b Miri Korenblit 2025-02-16  2077  	    key->flags &
> IEEE80211_KEY_FLAG_PAIRWISE &&
> d1e879ec600f9b Miri Korenblit 2025-02-16  2078  	    (key->cipher ==
> WLAN_CIPHER_SUITE_CCMP ||
> d1e879ec600f9b Miri Korenblit 2025-02-16  2079  	     key->cipher ==
> WLAN_CIPHER_SUITE_GCMP ||
> d1e879ec600f9b Miri Korenblit 2025-02-16  2080  	     key->cipher ==
> WLAN_CIPHER_SUITE_GCMP_256)) {
> d1e879ec600f9b Miri Korenblit 2025-02-16  2081  		ret =
> iwl_mld_alloc_ptk_pn(mld, mld_sta, key, &ptk_pn);
> d1e879ec600f9b Miri Korenblit 2025-02-16  2082  		if (ret)
> d1e879ec600f9b Miri Korenblit 2025-02-16  2083  			return
> ret;

Ptk_pn is not NULL only if mld_sta is not NULL.

> d1e879ec600f9b Miri Korenblit 2025-02-16  2092  		if (ptk_pn) {
> d1e879ec600f9b Miri Korenblit 2025-02-16 @2093
> 	RCU_INIT_POINTER(mld_sta->ptk_pn[keyidx], NULL);
>                                                                                          ^^^^^^^^^ But here it's
> dereferenced without checking.
> 

So, checking this is like checking mld_sta

Miri