Received-SPF: pass (google.com: domain of linux-wireless-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
Date:   Tue, 31 Aug 2021 10:43:06 +0300
From:   Dan Carpenter <dan.carpenter@oracle.com>
To:     ilan.peer@intel.com
Cc:     linux-wireless@vger.kernel.org
Subject: [bug report] iwlwifi: mvm: Explicitly stop session protection before
 unbinding
Message-ID: <20210831074305.GA11178@kili>
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
User-Agent: Mutt/1.10.1 (2018-07-13)
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?Ff5vjkTG+tW65TsVMsB86rfLD85ZiEZPZVsRYHR6yjK0VjA3ciTqO0Qu5thW?=
 =?us-ascii?Q?7vIC0mBgIJlzFwYW4gyl/VOFyfrFRHzhImo8GIFXKonR422Slb1CCg3l01vM?=
 =?us-ascii?Q?L9f99wlSC+BHowUkTqQWBHLbN8NAX5V3HQNBMRqAJ48icuezn5Sn1DgzM5mo?=
 =?us-ascii?Q?ksWoxi7enywtn7uGCe+1xQYCKNmXaxRyMgZUoNd4Xe0kpNCuTv/i07ENPyup?=
 =?us-ascii?Q?jhPTUe99X5IGU20hOarnWr/JsqQ/xuXBO7Hc0Ih7X7Q8Sj/1TETRE0XWMMRg?=
 =?us-ascii?Q?vw3xqUxbJMOZmOhbBiChMdxeo6Ik71mBAoKzfNttiF7ENIhIUdFHfLuiRKfx?=
 =?us-ascii?Q?keZ+HOGcUqOCOjq6i3PYnVYU7ciocGblHiIQhXBnN5plerC+u923zHb6YeLt?=
 =?us-ascii?Q?xOG5pt+yRCj2af3RH2wbMe1cQiYErdvKJSdxY1HESOixcfX9suIgmCqffqjG?=
 =?us-ascii?Q?IQLCFcHTZ/Ezsz9kFZ1ESWQQVveaMlswPMpjBHfxJ2MLVEchO9vOThSuJOAB?=
 =?us-ascii?Q?6fIml+gc8F9fDipiA1zq62FfBuoGuFysANkzD9tsJcDOC7FqJYlPLREMjWKC?=
 =?us-ascii?Q?vMdxPS6gYsDqja1LBMCVRGfhcHmGRtC5PE1ZIZjNr18T/JW3dUiFGkqhyOcD?=
 =?us-ascii?Q?BlQDYPmNGhBk9KdVkb1m2ICKtHDMXLIoLQhyOf6vtAMsdLGbelaeLeEfy04N?=
 =?us-ascii?Q?p1vhSKPpTTTl2erws1Glx73wYBRXjILQA6eCp/Ls/1btCyxFUHLtqUrpOmki?=
 =?us-ascii?Q?+nDuC9thZYo9AC1lwoTmRG8JOqzfYryA4FJ0q6CKL0zwoxxRJXhGVOKaU8Xq?=
 =?us-ascii?Q?YJGc3Znazi0CCTNMRK+tEeh4wkZgAEbVVdOicDl+T9i+zjCSNuBmUMFPVD0C?=
 =?us-ascii?Q?QHIRA2AVgD2YIivOk7mbyov/+TErWsN6iYcgSciVtVzC3GduVWDukF1ZtL1r?=
 =?us-ascii?Q?QwVxJTYIn+YpVGSGP4Ji35FVYSrqnqSujmiOz0bAms3eRQbDPvA38h0c36w4?=
 =?us-ascii?Q?DbbPI6THjFj4qT7UjOa2QLJXyWy8quMUxSKA4uPaRBISq3MmIwNTAHueKvz4?=
 =?us-ascii?Q?O9pbo9fzQBRqLB8e2js0NXyapqxZ1amOUOHnY6cU+uBEJb5coksxbyGSMx05?=
 =?us-ascii?Q?J9bsOwvVy1PI8lvl1CC2F3easqALXqHKE6ZS7jqHt6XWHRg3QgIZJWT7ctVH?=
 =?us-ascii?Q?cPOOWVh6ghX3Fpqx1nT8vM1gSRWf/WEnGF12aYLewRVAUqDeCwR1fsYIZMjn?=
 =?us-ascii?Q?pLxReAzt8g2cfVhOarfUn2VuRCGj3lPlx7VACMrvxc0S71HygXjvI7SZO2Fr?=
 =?us-ascii?Q?lmGePk5n+5cMiJbqeib99wozbjKU53Rle6qsyI2+sCyI3fBeif2PJLUcXoec?=
 =?us-ascii?Q?AbxTg7Y=3D?=
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-Network-Message-Id: bd7971a5-64e1-433e-3753-08d96c530c80
X-MS-Exchange-CrossTenant-AuthSource: MWHPR1001MB2365.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 31 Aug 2021 07:43:39.9209
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: zoX+p4ZyRhvEkm+dCrUaHCyRXQ76LjT1tGjNqmhaCILowHUCc9jeHalY+6wfrMu2obLTalICkH2lUCbKfbd6mxRqZdguQ7YMIX/q8c3QFsE=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: CO1PR10MB4500
X-Proofpoint-Virus-Version: vendor=nai engine=6300 definitions=10092 signatures=668682
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 malwarescore=0 bulkscore=0 phishscore=0
 spamscore=0 mlxlogscore=812 adultscore=0 suspectscore=0 mlxscore=0
 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2107140000
 definitions=main-2108310043
X-Proofpoint-GUID: qkdZTmJRBoWxflgQugjg_bR5WVNHwFpC
X-Proofpoint-ORIG-GUID: qkdZTmJRBoWxflgQugjg_bR5WVNHwFpC
Precedence: bulk
List-ID: <linux-wireless.vger.kernel.org>
X-Mailing-List: linux-wireless@vger.kernel.org

Hello Ilan Peer,

This is a semi-automatic email about new static checker warnings.

The patch 7b3954a1d69a: "iwlwifi: mvm: Explicitly stop session 
protection before unbinding" from Jun 18, 2021, leads to the 
following Smatch complaint:

    drivers/net/wireless/intel/iwlwifi/mvm/time-event.c:668 __iwl_mvm_remove_time_event()
    warn: variable dereferenced before check 'te_data->vif' (see line 665)

drivers/net/wireless/intel/iwlwifi/mvm/time-event.c
   664		u32 id;
   665		struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(te_data->vif);
                                                                       ^^^^^^^^^^^^
This is dereferenced inside the function.

   666		enum nl80211_iftype iftype;
   667	
   668		if (!te_data->vif)
                    ^^^^^^^^^^^^^
The new patch adds a check for NULL, but I don't think it is required.
The kernel would have already crashed at this point at any rate so the
dereference needs to be moved.

   669			return false;
   670	
   671          iftype = te_data->vif->type;
   672  
   673          /*
   674           * It is possible that by the time we got to this point the time
   675           * event was already removed.


regards,
dan carpenter