Received: by 2002:a05:6a10:f347:0:0:0:0 with SMTP id d7csp3030943pxu; Tue, 8 Dec 2020 01:22:56 -0800 (PST) X-Google-Smtp-Source: ABdhPJwQoy1bwKTGlzFWR4OuA/1fOX5Bzqi/+B2or/zeYoLRPRZ78OvvfGmKscIHHcom6Xc631hJ X-Received: by 2002:a50:fd10:: with SMTP id i16mr15999210eds.331.1607419376321; Tue, 08 Dec 2020 01:22:56 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1607419376; cv=none; d=google.com; s=arc-20160816; b=R5RcxIad9Gnxa9j+9yrSpyGo7inxC3y08mf414tyV2sT9zGQbh3kJfYwigo9/FZLP7 xs9Xr4MRTXz3qmmM8vXDpiowWjwOUzK93pTj12QDF+cS1nmhckGYlAGQVPZNATBnfZTR /yndK8voNDzAp1o0iLC5KiLTM000T6VJiV7rJK4+PN3vnaDzVU0C7mLiX/Y01mwHQPNu H+8ZP7X39hqqVpTnX00v/QY4nRMTXjDNn8EoH+JqbMj0w1/I9yAE/UyEM0HO8xnvz7BD wfjy2JHW2luUiQZf4mdeMe7x12wecnA4kXJCAzygfGciiI8bPzwh0BTDWbMMpKfXLh10 URWQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :message-id:date:subject:cc:to:from; bh=9GgmVc+Vq7iwkirCEOTQUA7MpcqlM/Id5T0Fi/QTChQ=; b=rmPDt1ogXyiOzJrbcxcfEd/cwMRAYG8n5wAxxISzzHSv7NZ/Kh9KszjvTmnDkWiK/D RljZf5eGP9qcLoIQU1QNxbxBPbfRfzq0opB4PsV4kBbruibXHkLvoyxiX7ZSS56WHSmk qMWBJSk4hJFwez78M+xiEh3qxBRhbcRsyWWwd9xrw1187YptvSAnc8pVpB4JocpjlTXy LMXDE56yVdHuV7yaS+iqRyN4uzHF1qJuYNEGwF7dR8hjkiORTVq7RdOxfLdfLn0aQ0dq n0nsTz0l6tPtAFTzbrrOgM2CIbOwM8MtBoJ0FkypqsO1R6qhtqgCqxczv/GUr/7Su58T X/0w== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of linux-wireless-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-wireless-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [23.128.96.18]) by mx.google.com with ESMTP id s11si9736202edy.18.2020.12.08.01.22.25; Tue, 08 Dec 2020 01:22:56 -0800 (PST) Received-SPF: pass (google.com: domain of linux-wireless-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18; Authentication-Results: mx.google.com; spf=pass (google.com: domain of linux-wireless-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-wireless-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728669AbgLHJS7 (ORCPT + 99 others); Tue, 8 Dec 2020 04:18:59 -0500 Received: from mail.kernel.org ([198.145.29.99]:37374 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1728527AbgLHJS6 (ORCPT ); Tue, 8 Dec 2020 04:18:58 -0500 From: Lorenzo Bianconi Authentication-Results: mail.kernel.org; dkim=permerror (bad message/signature format) To: nbd@nbd.name Cc: linux-wireless@vger.kernel.org, lorenzo.bianconi@redhat.com Subject: [PATCH] mt76: mt76s: fix NULL pointer dereference in mt76s_process_tx_queue Date: Tue, 8 Dec 2020 10:18:11 +0100 Message-Id: X-Mailer: git-send-email 2.28.0 MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: linux-wireless@vger.kernel.org Fix a possible NULL pointer dereference in mt76s_process_tx_queue that can occur if status thread runs before allocating tx queues Fixes: 6a618acb7e62 ("mt76: sdio: convert {status/net}_work to mt76_worker") Signed-off-by: Lorenzo Bianconi --- drivers/net/wireless/mediatek/mt76/sdio.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/drivers/net/wireless/mediatek/mt76/sdio.c b/drivers/net/wireless/mediatek/mt76/sdio.c index 7cd995118257..0b6facb17ff7 100644 --- a/drivers/net/wireless/mediatek/mt76/sdio.c +++ b/drivers/net/wireless/mediatek/mt76/sdio.c @@ -157,10 +157,14 @@ static void mt76s_net_worker(struct mt76_worker *w) static int mt76s_process_tx_queue(struct mt76_dev *dev, struct mt76_queue *q) { - bool mcu = q == dev->q_mcu[MT_MCUQ_WM]; struct mt76_queue_entry entry; int nframes = 0; + bool mcu; + if (!q) + return 0; + + mcu = q == dev->q_mcu[MT_MCUQ_WM]; while (q->queued > 0) { if (!q->entry[q->tail].done) break; -- 2.28.0