wifi: mac80211_hwsim: Fix possible NULL dereference

The 'vif' pointer in the Tx information might be NULL, e.g., in
case of injected frames etc. and is not checked in all paths. Fix it.
While at it, also directly use the local 'vif' pointer.

Fixes: a37a6f54439b ("wifi: mac80211_hwsim: Add simulation support for NAN device")
Signed-off-by: Ilan Peer <ilan.peer@intel.com>
Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
Closes: https://lore.kernel.org/linux-wireless/aNJUlyIiSTW9zZdr@stanley.mountain
Reviewed-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
Link: https://patch.msgid.link/20251110140128.ec00ae795a32.I9c65659b52434189d8b2ba06710d482669a3887a@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>

diff --git a/drivers/net/wireless/virtual/mac80211_hwsim.c b/drivers/net/wireless/virtual/mac80211_hwsim.c
index d28bf18d57ecacfae7ff87cfda7be02ef7c2bb88..5903d82e1ab1e8396fcb022bd31dee8737fe25a5 100644 (file)
--- a/drivers/net/wireless/virtual/mac80211_hwsim.c
+++ b/drivers/net/wireless/virtual/mac80211_hwsim.c
@@ -2003,8 +2003,14 @@ static void mac80211_hwsim_tx(struct ieee80211_hw *hw,
                struct ieee80211_sta *sta = control->sta;
                struct ieee80211_bss_conf *bss_conf;
 
+               /* This can happen in case of monitor injection */
+               if (!vif) {
+                       ieee80211_free_txskb(hw, skb);
+                       return;
+               }
+
                if (link != IEEE80211_LINK_UNSPECIFIED) {
-                       bss_conf = rcu_dereference(txi->control.vif->link_conf[link]);
+                       bss_conf = rcu_dereference(vif->link_conf[link]);
                        if (sta)
                                link_sta = rcu_dereference(sta->link[link]);
                } else {
@@ -2065,13 +2071,13 @@ static void mac80211_hwsim_tx(struct ieee80211_hw *hw,
                return;
        }
 
-       if (txi->control.vif)
-               hwsim_check_magic(txi->control.vif);
+       if (vif)
+               hwsim_check_magic(vif);
        if (control->sta)
                hwsim_check_sta_magic(control->sta);
 
        if (ieee80211_hw_check(hw, SUPPORTS_RC_TABLE))
-               ieee80211_get_tx_rates(txi->control.vif, control->sta, skb,
+               ieee80211_get_tx_rates(vif, control->sta, skb,
                                       txi->control.rates,
                                       ARRAY_SIZE(txi->control.rates));