diff options
| author | Dmitry Antipov <dmantipov@yandex.ru> | 2023-08-14 12:49:57 +0300 |
|---|---|---|
| committer | Kalle Valo <kvalo@kernel.org> | 2023-08-23 14:11:42 +0300 |
| commit | 35a7a1ce7c7d61664ee54f5239a1f120ab95a87e (patch) | |
| tree | ffdb5402c0f5f6db312ebccacf241f345451d7c7 /drivers/net/wireless/marvell | |
| parent | 821b5192c955144bd2f0aeea6cd153e1aedd16e1 (diff) | |
wifi: mwifiex: avoid possible NULL skb pointer dereference
In 'mwifiex_handle_uap_rx_forward()', always check the value
returned by 'skb_copy()' to avoid potential NULL pointer
dereference in 'mwifiex_uap_queue_bridged_pkt()', and drop
original skb in case of copying failure.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Fixes: 838e4f449297 ("mwifiex: improve uAP RX handling")
Acked-by: Brian Norris <briannorris@chromium.org>
Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru>
Signed-off-by: Kalle Valo <kvalo@kernel.org>
Link: https://lore.kernel.org/r/20230814095041.16416-1-dmantipov@yandex.ru
Diffstat (limited to 'drivers/net/wireless/marvell')
| -rw-r--r-- | drivers/net/wireless/marvell/mwifiex/uap_txrx.c | 10 |
1 files changed, 9 insertions, 1 deletions
diff --git a/drivers/net/wireless/marvell/mwifiex/uap_txrx.c b/drivers/net/wireless/marvell/mwifiex/uap_txrx.c index b9866f2e2644..318bd4ed8399 100644 --- a/drivers/net/wireless/marvell/mwifiex/uap_txrx.c +++ b/drivers/net/wireless/marvell/mwifiex/uap_txrx.c @@ -253,7 +253,15 @@ int mwifiex_handle_uap_rx_forward(struct mwifiex_private *priv, if (is_multicast_ether_addr(ra)) { skb_uap = skb_copy(skb, GFP_ATOMIC); - mwifiex_uap_queue_bridged_pkt(priv, skb_uap); + if (likely(skb_uap)) { + mwifiex_uap_queue_bridged_pkt(priv, skb_uap); + } else { + mwifiex_dbg(adapter, ERROR, + "failed to copy skb for uAP\n"); + priv->stats.rx_dropped++; + dev_kfree_skb_any(skb); + return -1; + } } else { if (mwifiex_get_sta_entry(priv, ra)) { /* Requeue Intra-BSS packet */ |