| From 0b62b3d6011478da214e46325f8f4e6e87fe6849 Mon Sep 17 00:00:00 2001 |
| From: Sasha Levin <sashal@kernel.org> |
| Date: Mon, 14 Aug 2023 12:49:57 +0300 |
| Subject: wifi: mwifiex: avoid possible NULL skb pointer dereference |
| |
| From: Dmitry Antipov <dmantipov@yandex.ru> |
| |
| [ Upstream commit 35a7a1ce7c7d61664ee54f5239a1f120ab95a87e ] |
| |
| In 'mwifiex_handle_uap_rx_forward()', always check the value |
| returned by 'skb_copy()' to avoid potential NULL pointer |
| dereference in 'mwifiex_uap_queue_bridged_pkt()', and drop |
| original skb in case of copying failure. |
| |
| Found by Linux Verification Center (linuxtesting.org) with SVACE. |
| |
| Fixes: 838e4f449297 ("mwifiex: improve uAP RX handling") |
| Acked-by: Brian Norris <briannorris@chromium.org> |
| Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru> |
| Signed-off-by: Kalle Valo <kvalo@kernel.org> |
| Link: https://lore.kernel.org/r/20230814095041.16416-1-dmantipov@yandex.ru |
| Signed-off-by: Sasha Levin <sashal@kernel.org> |
| --- |
| drivers/net/wireless/marvell/mwifiex/uap_txrx.c | 10 +++++++++- |
| 1 file changed, 9 insertions(+), 1 deletion(-) |
| |
| diff --git a/drivers/net/wireless/marvell/mwifiex/uap_txrx.c b/drivers/net/wireless/marvell/mwifiex/uap_txrx.c |
| index c1b8d41dd7536..b8b9a0fcb19cd 100644 |
| --- a/drivers/net/wireless/marvell/mwifiex/uap_txrx.c |
| +++ b/drivers/net/wireless/marvell/mwifiex/uap_txrx.c |
| @@ -253,7 +253,15 @@ int mwifiex_handle_uap_rx_forward(struct mwifiex_private *priv, |
| |
| if (is_multicast_ether_addr(ra)) { |
| skb_uap = skb_copy(skb, GFP_ATOMIC); |
| - mwifiex_uap_queue_bridged_pkt(priv, skb_uap); |
| + if (likely(skb_uap)) { |
| + mwifiex_uap_queue_bridged_pkt(priv, skb_uap); |
| + } else { |
| + mwifiex_dbg(adapter, ERROR, |
| + "failed to copy skb for uAP\n"); |
| + priv->stats.rx_dropped++; |
| + dev_kfree_skb_any(skb); |
| + return -1; |
| + } |
| } else { |
| if (mwifiex_get_sta_entry(priv, ra)) { |
| /* Requeue Intra-BSS packet */ |
| -- |
| 2.40.1 |
| |
