queue-6.8/wifi-nl80211-don-t-free-null-coalescing-rule.patch

   1 From 801ea33ae82d6a9d954074fbcf8ea9d18f1543a7 Mon Sep 17 00:00:00 2001
   2 From: Johannes Berg <johannes.berg@intel.com>
   3 Date: Thu, 18 Apr 2024 10:52:23 +0200
   4 Subject: wifi: nl80211: don't free NULL coalescing rule
   5
   6 From: Johannes Berg <johannes.berg@intel.com>
   7
   8 commit 801ea33ae82d6a9d954074fbcf8ea9d18f1543a7 upstream.
   9
  10 If the parsing fails, we can dereference a NULL pointer here.
  11
  12 Cc: stable@vger.kernel.org
  13 Fixes: be29b99a9b51 ("cfg80211/nl80211: Add packet coalesce support")
  14 Reviewed-by: Miriam Rachel Korenblit <miriam.rachel.korenblit@intel.com>
  15 Link: https://msgid.link/20240418105220.b328f80406e7.Id75d961050deb05b3e4e354e024866f350c68103@changeid
  16 Signed-off-by: Johannes Berg <johannes.berg@intel.com>
  17 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  18 ---
  19  net/wireless/nl80211.c |    2 ++
  20  1 file changed, 2 insertions(+)
  21
  22 --- a/net/wireless/nl80211.c
  23 +++ b/net/wireless/nl80211.c
  24 @@ -14092,6 +14092,8 @@ static int nl80211_set_coalesce(struct s
  25  error:
  26         for (i = 0; i < new_coalesce.n_rules; i++) {
  27                 tmp_rule = &new_coalesce.rules[i];
  28 +               if (!tmp_rule)
  29 +                       continue;
  30                 for (j = 0; j < tmp_rule->n_patterns; j++)
  31                         kfree(tmp_rule->patterns[j].mask);
  32                 kfree(tmp_rule->patterns);