Daniil Dulov
c1958270de
wifi: zd1211rw: Fix potential NULL pointer dereference in zd_mac_tx_to_dev() ...
[ Upstream commit 74b1ec9f5d627d2bdd5e5b6f3f81c23317657023 ]
There is a potential NULL pointer dereference in zd_mac_tx_to_dev(). For
example, the following is possible:
T0 T1
zd_mac_tx_to_dev()
/* len == skb_queue_len(q) */
while (len > ZD_MAC_MAX_ACK_WAITERS) {
filter_ack()
spin_lock_irqsave(&q->lock, flags);
/* position == skb_queue_len(q) */
for (i=1; i<position; i++)
skb = __skb_dequeue(q)
if (mac->type == NL80211_IFTYPE_AP)
skb = __skb_dequeue(q);
spin_unlock_irqrestore(&q->lock, flags);
skb_dequeue() -> NULL
Since there is a small gap between checking skb queue length and skb being
unconditionally dequeued in zd_mac_tx_to_dev(), skb_dequeue() can return NULL.
Then the pointer is passed to zd_mac_tx_status() where it is dereferenced.
In order to avoid potential NULL pointer dereference due to situations like
above, check if skb is not NULL before passing it to zd_mac_tx_status().
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Fixes: 459c51ad6ehttps://patch.msgid.link/20250626114619.172631-1-d.dulov@aladdin.ru
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2025-07-17 18:25:04 +02:00
Revert "ACPI: battery: negate current when discharging"
2025-07-17 18:25:03 +02:00
binder: fix UAF caused by offsets overwrite
2024-09-12 11:03:55 +02:00
ata: pata_cs5536: fix build on 32-bit UML
2025-07-17 18:24:57 +02:00
atm: atmtcp: Free invalid length skb in atmtcp_c_send().
2025-06-27 11:02:57 +01:00
PM: runtime: fix denying of auto suspend in pm_suspend_timer_fn()
2025-06-27 11:02:53 +01:00
aoe: clean device rq_list in aoedev_downdev()
2025-06-27 11:02:57 +01:00
Bluetooth: btrtl: Prevent potential NULL dereference
2025-05-02 07:39:19 +02:00
Revert "bus: ti-sysc: Probe for l4_wkup and l4_cfg interconnect devices first"
2025-06-27 11:02:55 +01:00
virtio_console: fix missing byte order handling for cols and rows
2025-05-02 07:39:26 +02:00
clk: rockchip: rk3036: mark ddrphy as critical
2025-06-27 11:02:55 +01:00
clocksource/i8253: Use raw_spinlock_irqsave() in clockevent_i8253_disable()
2025-06-04 14:32:29 +02:00
counter: stm32-lptimer-cnt: fix error handling when enabling
2025-04-10 14:29:39 +02:00
cpufreq: Force sync policy boost with global boost on sysfs update
2025-06-27 11:02:54 +01:00
cpuidle: menu: Avoid discarding useful information
2025-06-04 14:32:32 +02:00
crypto: marvell/cesa - Avoid empty transfer descriptor
2025-06-27 11:02:45 +01:00
dmaengine: xilinx_dma: Set dma_device directions
2025-07-17 18:24:49 +02:00
dma-buf: fix timeout handling in dma_resv_wait_timeout v2
2025-07-17 18:25:04 +02:00
EDAC/altera: Use correct write width with the INTTEST register
2025-06-27 11:02:51 +01:00
firmware: psci: Fix refcount leak in psci_dt_init
2025-06-27 11:02:46 +01:00
fpga: altera-cvp: Increase credit timeout
2025-06-04 14:32:32 +02:00
gpio: zynq: Fix wakeup source leaks on device unbind
2025-05-02 07:39:17 +02:00
drm/exynos: exynos7_drm_decon: add vblank check in IRQ handling
2025-07-17 18:25:01 +02:00
HID: wacom: fix kobject reference count leak
2025-07-17 18:24:54 +02:00
HSI: ssi_protocol: Fix use after free vulnerability in ssi_protocol Driver Due to Race Condition
2025-05-02 07:39:18 +02:00
Drivers: hv: vmbus: Don't release fb_mmio resource in vmbus_free_mmio()
2025-04-10 14:29:35 +02:00
hwmon: (occ) fix unaligned accesses
2025-06-27 11:02:57 +01:00
coresight: catu: Fix number of pages while using 64k pages
2025-04-10 14:29:41 +02:00
i2c: robotfuzz-osif: disable zero-length read messages
2025-07-17 18:24:53 +02:00
i3c: Add NULL pointer check in i3c_master_queue_ibi()
2025-05-02 07:39:15 +02:00
iio: pressure: zpa2326: Use aligned_s64 for the timestamp
2025-07-17 18:24:50 +02:00
RDMA/mlx5: Fix vport loopback for MPV device
2025-07-17 18:25:03 +02:00
Input: xpad - support Acer NGR 200 Controller
2025-07-17 18:25:04 +02:00
iommu/amd: Fix potential buffer overflow in parse_ivrs_acpihid
2025-06-04 14:32:26 +02:00
irqchip/gic-v2m: Prevent use after free of gicv2m_get_fwnode()
2025-06-04 14:32:25 +02:00
leds: lp8860: Write full EEPROM, not only half of it
2025-03-13 12:43:06 +01:00
mailbox: Not protect module_put with spin_lock_irqsave
2025-07-17 18:24:49 +02:00
mcb: fix a double free bug in chameleon_parse_gdd()
2025-05-02 07:39:26 +02:00
dm-raid: fix variable in journal device check
2025-07-17 18:24:54 +02:00
media: uvcvideo: Rollback non processed entities on error
2025-07-17 18:25:01 +02:00
memstick: rtsx_usb_ms: Fix slab-use-after-free in rtsx_usb_ms_drv_remove
2025-04-10 14:29:39 +02:00
scsi: fusion: Remove unused variable 'rc'
2024-12-14 19:44:29 +01:00
mfd: max14577: Fix wakeup source leaks on device unbind
2025-07-17 18:24:49 +02:00
VMCI: fix race between vmci_host_setup_notify and vmci_ctx_unset_notify
2025-07-17 18:24:51 +02:00
mtk-sd: reset host->mrq on prepare_data() error
2025-07-17 18:24:58 +02:00
mtd: nand: sunxi: Add randomizer configuration before randomizer enable
2025-06-27 11:02:52 +01:00
wifi: zd1211rw: Fix potential NULL pointer dereference in zd_mac_tx_to_dev()
2025-07-17 18:25:04 +02:00
nfc: pn533: Add poll mod list filling check
2024-09-04 13:15:04 +02:00
ntb: reduce stack usage in idt_scan_mws
2025-05-02 07:39:28 +02:00
libnvdimm/labels: Fix divide error in nd_label_data_init()
2025-06-04 14:32:30 +02:00
nvmet-tcp: don't restore null sk_state_change
2025-06-04 14:32:35 +02:00
nvmem: core: improve range check for nvmem_cell_write()
2025-03-13 12:43:10 +01:00
of: module: add buffer overflow check in of_modalias()
2025-06-04 14:32:25 +02:00
parport_pc: add support for ASIX AX99100
2025-03-13 12:43:19 +01:00
PCI: Fix lock symmetry in pci_slot_unlock()
2025-06-27 11:02:52 +01:00
pcmcia: Use resource_size function on resource object
2024-09-12 11:03:52 +02:00
perf: arm_pmu: Don't disable counter in armpmu_add()
2025-05-02 07:39:09 +02:00
phy: core: don't require set_mode() callback for phy_get_mode() to work
2025-06-04 14:32:33 +02:00
pinctrl: qcom: msm: mark certain pins as invalid for interrupts
2025-07-17 18:25:03 +02:00
platform/mellanox: mlxbf-tmfifo: fix vring_desc.len assignment
2025-07-17 18:24:56 +02:00
power: supply: bq27xxx: Retrieve again when busy
2025-06-27 11:02:53 +01:00
powercap: call put_device() on an error path in powercap_register_control_type()
2025-04-10 14:29:36 +02:00
pps: Fix a use-after-free
2025-03-13 12:43:19 +01:00
ptp: Ensure info->enable callback is always set
2025-03-13 12:43:11 +01:00
pwm: mediatek: Ensure to disable clocks in error path
2025-07-17 18:25:03 +02:00
drivers/rapidio/rio_cm.c: prevent possible heap overwrite
2025-06-27 11:02:56 +01:00
regulator: gpio: Fix the out-of-bounds access to drvdata::gpiods
2025-07-17 18:24:58 +02:00
reset: berlin: fix OF node leak in probe() error path
2024-11-08 16:20:28 +01:00
rpmsg: qcom_smd: Fix uninitialized return variable in __qcom_smd_send()
2025-06-27 11:02:48 +01:00
rtc: test: Fix invalid format specifier.
2025-06-27 11:02:58 +01:00
scsi: s390: zfcp: Ensure synchronous unit_add
2025-06-27 11:02:56 +01:00
scsi: ufs: core: Fix spelling of a sysfs attribute name
2025-07-17 18:24:58 +02:00
sh: clk: Fix clk_enable() to return 0 on NULL clk
2025-01-09 13:23:29 +01:00
slimbus: messaging: Free transaction ID in delayed interrupt scenario
2025-03-13 12:43:33 +01:00
soc: aspeed: Add NULL check in aspeed_lpc_enable_snoop()
2025-06-27 11:02:48 +01:00
soundwire: stream: Revert "soundwire: stream: fix programming slave ports for non-continous port maps"
2024-11-08 16:20:25 +01:00
spi: spi-fsl-dspi: Clear completion counter before initiating transfer
2025-07-17 18:25:00 +02:00
ssb: Fix division by zero issue in ssb_calc_clock_rate
2024-09-04 13:14:53 +02:00
staging: rtl8723bs: Avoid memset() in aes_cipher() and aes_decipher()
2025-07-17 18:25:01 +02:00
scsi: target: iscsi: Fix timeout on deleted connection
2025-06-04 14:32:29 +02:00
tee: Prevent size calculation wraparound on 32-bit kernels
2025-06-27 11:02:55 +01:00
thermal/drivers/rockchip: Add missing rk3328 mapping entry
2025-05-02 07:39:16 +02:00
thunderbolt: Do not double dequeue a configuration request
2025-06-27 11:02:44 +01:00
tty: serial: uartlite: register uart driver in init
2025-07-17 18:24:50 +02:00
uio_hv_generic: Use correct size for interrupt and monitor pages
2025-06-27 11:02:52 +01:00
usb: gadget: u_serial: Fix race condition in TTY wakeup
2025-07-17 18:25:03 +02:00
vfio/pci: Enable iowrite64 and ioread64 for vfio pci
2025-03-13 12:43:13 +01:00
vgacon: Add check for vc_origin address range in vgacon_scroll()
2025-06-27 11:02:51 +01:00
watchdog: da9052_wdt: respect TWDMIN
2025-06-27 11:02:55 +01:00
xen/swiotlb: relax alignment requirements
2025-06-04 14:32:37 +02:00
c1958270de