Date:   Tue, 21 Mar 2023 10:03:20 +0300
From:   Dan Carpenter <error27@gmail.com>
To:     miriam.rachel.korenblit@intel.com
Cc:     linux-wireless@vger.kernel.org
Subject: [bug report] wifi: iwlwifi: mvm: add support for the new STA related
 commands
Message-ID: <ca7d3085-b6ef-489b-8601-5743e5d4bfeb@kili.mountain>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Precedence: bulk

Hello Miri Korenblit,

The patch 006c152ac9e5: "wifi: iwlwifi: mvm: add support for the new
STA related commands" from Mar 14, 2023, leads to the following
Smatch static checker warning:

	drivers/net/wireless/intel/iwlwifi/mvm/mld-sta.c:239 iwl_mvm_mld_rm_int_sta()
	error: NULL dereference inside function

drivers/net/wireless/intel/iwlwifi/mvm/mld-sta.c
    225 static int iwl_mvm_mld_rm_int_sta(struct iwl_mvm *mvm,
    226                                   struct iwl_mvm_int_sta *int_sta,
    227                                   bool flush, u8 tid, u16 *queuptr)
    228 {
    229         int ret;
    230 
    231         lockdep_assert_held(&mvm->mutex);
    232 
    233         if (WARN_ON_ONCE(int_sta->sta_id == IWL_MVM_INVALID_STA))
    234                 return -EINVAL;
    235 
    236         if (flush)
    237                 iwl_mvm_flush_sta(mvm, int_sta, true);
    238 
--> 239         iwl_mvm_mld_disable_txq(mvm, NULL, queuptr, tid);
                                             ^^^^
You can't pass a NULL sta pointer.  It will crash.

    240 
    241         ret = iwl_mvm_mld_rm_sta_from_fw(mvm, int_sta->sta_id);
    242         if (ret)
    243                 IWL_WARN(mvm, "Failed sending remove station\n");
    244 
    245         iwl_mvm_dealloc_int_sta(mvm, int_sta);
    246 
    247         return ret;
    248 }

regards,
dan carpenter