Received-SPF: pass (google.com: domain of linux-wireless-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Message-ID: <0ee06d5296b836312346e23e7876ede8655835a0.camel@sipsolutions.net>
Subject: Re: [bug report] wifi: nl80211: support MLO in auth/assoc
From:   Johannes Berg <johannes@sipsolutions.net>
To:     Dan Carpenter <dan.carpenter@oracle.com>
Cc:     linux-wireless@vger.kernel.org
Date:   Wed, 22 Jun 2022 10:11:42 +0200
In-Reply-To: <YrK+sjPSFRxX4XAM@kili>
References: <YrK+sjPSFRxX4XAM@kili>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
User-Agent: Evolution 3.44.2 (3.44.2-1.fc36) 
MIME-Version: 1.0
Precedence: bulk

On Wed, 2022-06-22 at 10:03 +0300, Dan Carpenter wrote:
> The patch d648c23024bd: "wifi: nl80211: support MLO in auth/assoc"
> from May 31, 2022, leads to the following Smatch complaint:
>=20
>     net/wireless/mlme.c:328 cfg80211_mlme_assoc()
>     warn: variable dereferenced before check 'req->bss' (see line 324)
>=20
> net/wireless/mlme.c
>    323=09
>    324		err =3D rdev_assoc(rdev, dev, req);
>                                             ^^^
> req->bss dereferenced inside the function call
>=20
>    325		if (!err) {
>    326			int link_id;
>    327=09
>    328			if (req->bss) {
>                             ^^^^^^^^
> Check for NULL is too late
>=20

I was writing why all of this is correct but now I realized that
literally in rdev_assoc() we dereference it ... that's obviously
garbage, I need to adjust the tracing for all of this.

But anyway I should move that into the tracing.

For now this is fine because you can't get here with req->bss =3D=3D NULL
(which would imply req->link[i] !=3D NULL for some value(s) of i) because
no driver advertises MLO support.

Thanks for the report!

johannes