Received-SPF: pass (google.com: domain of linux-wireless-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
IronPort-SDR: TZOEjna1MtI2m9Lol1CkNAiFw6GF/QgJoUK6Nw+CSjnmS+rtgRy6a4OgYWxZVTy9gaIRpN9F5z
 XvnDO7oteh8Q==
IronPort-SDR: S0uH38uaL7KaV1EKDKR0jBi/74dDIMIA/5J3iY8T+noXQav3c2QtBMoTPj4wCr/5oU444IyaJQ
 eEF+cdjoPgYQ==
From:   "Stern, Avraham" <avraham.stern@intel.com>
To:     Dan Carpenter <dan.carpenter@oracle.com>
CC:     "linux-wireless@vger.kernel.org" <linux-wireless@vger.kernel.org>,
        "Coelho, Luciano" <luciano.coelho@intel.com>
Subject: RE: [bug report] iwlwifi: mvm: toggle tx antenna if tx fails during
 connection establishment
Thread-Topic: [bug report] iwlwifi: mvm: toggle tx antenna if tx fails during
 connection establishment
Thread-Index: AQHW/5tJrUIzt0cmHkKnZtyf2ByQqapRTfSg
Date:   Wed, 10 Feb 2021 12:26:31 +0000
Message-ID: <BN6PR11MB1539F4E287D03E2F23723B8CFF8D9@BN6PR11MB1539.namprd11.prod.outlook.com>
References: <YCO7gahK0ktH8YkY@mwanda>
In-Reply-To: <YCO7gahK0ktH8YkY@mwanda>
Accept-Language: en-US
Content-Language: en-US
dlp-version: 11.5.1.3
dlp-reaction: no-action
dlp-product: dlpe-windows
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
X-MS-Exchange-CrossTenant-Network-Message-Id: 5b89a0d2-a4fd-47b7-1713-08d8cdbf1959
X-MS-Exchange-CrossTenant-originalarrivaltime: 10 Feb 2021 12:26:31.9962
 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 46c98d88-e344-4ed4-8496-4ed7712e255d
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: lJGjF9hERvSQWjx1X16UN7jmgc4jMxuUUqpiY7Yr5O47Tv9x0Y/+ylvAs+QWTd9TsBmR4/YaQQPZT7fJAOhSKA==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: BN6PR1101MB2081
X-OriginatorOrg: intel.com
Content-Transfer-Encoding: quoted-printable
Precedence: bulk
List-ID: <linux-wireless.vger.kernel.org>
X-Mailing-List: linux-wireless@vger.kernel.org

Hi Dan,

The offending patch that caused the Smatch complaint is:
"iwlwifi: mvm: add explicit check for non-data frames in get Tx rate"

this patch adds an unconditional dereference of the  sta  parameter in iwl_=
mvm_get_tx_rate().
Before that, all the code paths check for the NULL option.

(this patch is from the recent days, that's why Smatch only complains now).

Regards,
Avi


-----Original Message-----
From: Dan Carpenter <dan.carpenter@oracle.com> =

Sent: Wednesday, February 10, 2021 12:55
To: Stern, Avraham <avraham.stern@intel.com>
Cc: linux-wireless@vger.kernel.org
Subject: [bug report] iwlwifi: mvm: toggle tx antenna if tx fails during co=
nnection establishment

[ Sorry, I don't know why Smatch is warning about a three year old bug
  and I'm not sure that it's blaming the correct commit but the warning
  looks correct.  - dan ]

Hello Avraham Stern,

This is a semi-automatic email about new static checker warnings.

The patch 0dde2440a77f: "iwlwifi: mvm: toggle tx antenna if tx fails during=
 connection establishment" from Jul 11, 2018, leads to the following Smatch=
 complaint:

    drivers/net/wireless/intel/iwlwifi/mvm/tx.c:356 iwl_mvm_set_tx_cmd_rate=
()
    error: we previously assumed 'sta' could be null (see line 341)

drivers/net/wireless/intel/iwlwifi/mvm/tx.c
   340	=

   341		if (ieee80211_is_data(fc) && sta) {
                                             ^^^ This assumes that "sta" ca=
n be NULL.

   342			struct iwl_mvm_sta *mvmsta =3D iwl_mvm_sta_from_mac80211(sta);
   343	=

   344			if (mvmsta->sta_state >=3D IEEE80211_STA_AUTHORIZED) {
   345				tx_cmd->initial_rate_index =3D 0;
   346				tx_cmd->tx_flags |=3D cpu_to_le32(TX_CMD_FLG_STA_RATE);
   347				return;
   348			}
   349		} else if (ieee80211_is_back_req(fc)) {
   350			tx_cmd->tx_flags |=3D
   351				cpu_to_le32(TX_CMD_FLG_ACK | TX_CMD_FLG_BAR);
   352		}
   353	=

   354		/* Set the rate in the TX cmd */
   355		tx_cmd->rate_n_flags =3D
   356			cpu_to_le32(iwl_mvm_get_tx_rate_n_flags(mvm, info, sta, fc));
                                                                           =
^^^ It is dereferenced unconsiditionally inside the function.

   357	}
   358	=


See also:
drivers/net/wireless/intel/iwlwifi/mvm/tx.c:486 iwl_mvm_set_tx_params() err=
or: we previously assumed 'sta' could be null (see line 482)

regards,
dan carpenter
---------------------------------------------------------------------
A member of the Intel Corporation group of companies

This e-mail and any attachments may contain confidential material for
the sole use of the intended recipient(s). Any review or distribution
by others is strictly prohibited. If you are not the intended
recipient, please contact the sender and delete all copies.