diff options
| author | Miri Korenblit <miriam.rachel.korenblit@intel.com> | 2024-12-29 16:44:36 +0200 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2025-02-08 10:01:17 +0100 |
| commit | 7f6fb4b7611eb6371c493c42fefad84a1742bcbb (patch) | |
| tree | b3b7053d00bc0e05c27f9b863942683da0e84ddf /drivers | |
| parent | ef3b8ae39cb301b352d49a63a5e70ea52bd94e3e (diff) | |
| download | linux-7f6fb4b7611eb6371c493c42fefad84a1742bcbb.tar.gz linux-7f6fb4b7611eb6371c493c42fefad84a1742bcbb.tar.bz2 linux-7f6fb4b7611eb6371c493c42fefad84a1742bcbb.zip | |
wifi: iwlwifi: mvm: avoid NULL pointer dereference
[ Upstream commit cf704a7624f99eb2ffca1a16c69183e85544a613 ]
When iterating over the links of a vif, we need to make sure that the
pointer is valid (in other words - that the link exists) before
dereferncing it.
Use for_each_vif_active_link that also does the check.
Fixes: 2b7ee1a10a72 ("wifi: iwlwiif: mvm: handle the new BT notif")
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
Reviewed-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Link: https://patch.msgid.link/20241229164246.31d41f7d3eab.I7fb7036a0b187c1636b01970207259cb2327952c@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/net/wireless/intel/iwlwifi/mvm/coex.c | 9 |
1 files changed, 3 insertions, 6 deletions
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/coex.c b/drivers/net/wireless/intel/iwlwifi/mvm/coex.c index 36726ea4b822..21641d41a958 100644 --- a/drivers/net/wireless/intel/iwlwifi/mvm/coex.c +++ b/drivers/net/wireless/intel/iwlwifi/mvm/coex.c @@ -530,18 +530,15 @@ static void iwl_mvm_bt_coex_notif_iterator(void *_data, u8 *mac, struct ieee80211_vif *vif) { struct iwl_mvm *mvm = _data; + struct ieee80211_bss_conf *link_conf; + unsigned int link_id; lockdep_assert_held(&mvm->mutex); if (vif->type != NL80211_IFTYPE_STATION) return; - for (int link_id = 0; - link_id < IEEE80211_MLD_MAX_NUM_LINKS; - link_id++) { - struct ieee80211_bss_conf *link_conf = - rcu_dereference_check(vif->link_conf[link_id], - lockdep_is_held(&mvm->mutex)); + for_each_vif_active_link(vif, link_conf, link_id) { struct ieee80211_chanctx_conf *chanctx_conf = rcu_dereference_check(link_conf->chanctx_conf, lockdep_is_held(&mvm->mutex)); |