wifi: iwlwifi: mvm: avoid NULL pointer dereference

When iterating over the links of a vif, we need to make sure that the
pointer is valid (in other words - that the link exists) before
dereferncing it.
Use for_each_vif_active_link that also does the check.

Fixes: 2b7ee1a10a72 ("wifi: iwlwiif: mvm: handle the new BT notif")
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
Reviewed-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Link: https://patch.msgid.link/20241229164246.31d41f7d3eab.I7fb7036a0b187c1636b01970207259cb2327952c@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>

diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/coex.c b/drivers/net/wireless/intel/iwlwifi/mvm/coex.c
index 36726ea4b822a407274ac49b2bb9cb6da493ed89..21641d41a958cf5531adb0a4b79e91c4d44a8b06 100644 (file)
--- a/drivers/net/wireless/intel/iwlwifi/mvm/coex.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/coex.c
@@ -530,18 +530,15 @@ static void iwl_mvm_bt_coex_notif_iterator(void *_data, u8 *mac,
                                           struct ieee80211_vif *vif)
 {
        struct iwl_mvm *mvm = _data;
+       struct ieee80211_bss_conf *link_conf;
+       unsigned int link_id;
 
        lockdep_assert_held(&mvm->mutex);
 
        if (vif->type != NL80211_IFTYPE_STATION)
                return;
 
-       for (int link_id = 0;
-            link_id < IEEE80211_MLD_MAX_NUM_LINKS;
-            link_id++) {
-               struct ieee80211_bss_conf *link_conf =
-                       rcu_dereference_check(vif->link_conf[link_id],
-                                             lockdep_is_held(&mvm->mutex));
+       for_each_vif_active_link(vif, link_conf, link_id) {
                struct ieee80211_chanctx_conf *chanctx_conf =
                        rcu_dereference_check(link_conf->chanctx_conf,
                                              lockdep_is_held(&mvm->mutex));