[lvc-project] [PATCH 2/2] wifi: ath12k: modify null check logic in ath12k_ce_rx_post_pipe()

tascad at altlinux.org tascad at altlinux.org
Mon Dec 22 13:21:44 MSK 2025


From: Dmitry Mihalchenko <tascad at altlinux.org>

The previous logic in ath12k_ce_rx_post_pipe() incorrectly required both
dest_ring and status_ring to be NULL in order to exit the function.
This caused the function to continue even if only one of the pointers
was NULL, potentially leading to null pointer dereferences in
ath12k_ce_rx_buf_enqueue_pipe().

Fix the condition by modifying the logic so that the function returns
early if either dest_ring or status_ring is NULL.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Fixes: d889913205cf ("wifi: ath12k: driver for Qualcomm Wi-Fi 7 devices")
Signed-off-by: Dmitry Mihalchenko <tascad at altlinux.org>
---
 drivers/net/wireless/ath/ath12k/ce.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/wireless/ath/ath12k/ce.c b/drivers/net/wireless/ath/ath12k/ce.c
index 9f9d2f2477c7..53d3b3ba9104 100644
--- a/drivers/net/wireless/ath/ath12k/ce.c
+++ b/drivers/net/wireless/ath/ath12k/ce.c
@@ -64,7 +64,7 @@ static int ath12k_ce_rx_post_pipe(struct ath12k_ce_pipe *pipe)
 	dma_addr_t paddr;
 	int ret = 0;
 
-	if (!(pipe->dest_ring || pipe->status_ring))
+	if (!pipe->dest_ring || !pipe->status_ring)
 		return 0;
 
 	spin_lock_bh(&ab->ce.ce_lock);
-- 
2.50.1




More information about the lvc-project mailing list