[SRU][F][PATCH 1/1] wifi: iwlwifi: mvm: check n_ssids before accessing the ssids

[Koichiro Den]

From: Miri Korenblit <miriam.rachel.korenblit at intel.com>

In some versions of cfg80211, the ssids poinet might be a valid one even
though n_ssids is 0. Accessing the pointer in this case will cuase an
out-of-bound access. Fix this by checking n_ssids first.

Fixes: c1a7515393e4 ("iwlwifi: mvm: add adaptive dwell support")
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit at intel.com>
Reviewed-by: Ilan Peer <ilan.peer at intel.com>
Reviewed-by: Johannes Berg <johannes.berg at intel.com>
Link: https://msgid.link/20240513132416.6e4d1762bf0d.I5a0e6cc8f02050a766db704d15594c61fe583d45@changeid
Signed-off-by: Johannes Berg <johannes.berg at intel.com>
(backported from 60d62757df30b74bf397a2847a6db7385c6ee281)
[koichiroden: Adjusted context due to multiple missing commits,
 including commit 19ff9b2c6e3c ("iwlwifi: scan: adapt the code to use
 api ver 11")]
Signed-off-by: Koichiro Den <koichiro.den at canonical.com>
---
 drivers/net/wireless/intel/iwlwifi/mvm/scan.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/scan.c b/drivers/net/wireless/intel/iwlwifi/mvm/scan.c
index 3a58267d3d71..ca2afbdcb86a 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/scan.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/scan.c
@@ -1339,7 +1339,7 @@ static void iwl_mvm_scan_umac_dwell(struct iwl_mvm *mvm,
 		if (IWL_MVM_ADWELL_MAX_BUDGET)
 			cmd->v7.adwell_max_budget =
 				cpu_to_le16(IWL_MVM_ADWELL_MAX_BUDGET);
-		else if (params->ssids && params->ssids[0].ssid_len)
+		else if (params->n_ssids && params->ssids[0].ssid_len)
 			cmd->v7.adwell_max_budget =
 				cpu_to_le16(IWL_SCAN_ADWELL_MAX_BUDGET_DIRECTED_SCAN);
 		else
-- 
2.43.0