Commit 35a7a1ce authored by Dmitry Antipov's avatar Dmitry Antipov Committed by Kalle Valo
Browse files

wifi: mwifiex: avoid possible NULL skb pointer dereference 



In 'mwifiex_handle_uap_rx_forward()', always check the value
returned by 'skb_copy()' to avoid potential NULL pointer
dereference in 'mwifiex_uap_queue_bridged_pkt()', and drop
original skb in case of copying failure.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Fixes: 838e4f44 ("mwifiex: improve uAP RX handling")
Acked-by: default avatarBrian Norris <briannorris@chromium.org>
Signed-off-by: default avatarDmitry Antipov <dmantipov@yandex.ru>
Signed-off-by: default avatarKalle Valo <kvalo@kernel.org>
Link: https://lore.kernel.org/r/20230814095041.16416-1-dmantipov@yandex.ru
parent 821b5192

drivers/net/wireless/marvell/mwifiex/uap_txrx.c

+9 −1
Original line number Diff line number Diff line
@@ -253,7 +253,15 @@ int mwifiex_handle_uap_rx_forward(struct mwifiex_private *priv, 


	if (is_multicast_ether_addr(ra)) {

		skb_uap = skb_copy(skb, GFP_ATOMIC);

		if (likely(skb_uap)) {

			mwifiex_uap_queue_bridged_pkt(priv, skb_uap);

		} else {

			mwifiex_dbg(adapter, ERROR,

				    "failed to copy skb for uAP\n");

			priv->stats.rx_dropped++;

			dev_kfree_skb_any(skb);

			return -1;

		}

	} else {

		if (mwifiex_get_sta_entry(priv, ra)) {

			/* Requeue Intra-BSS packet */