On 03/10/2024 20:09, Gax-c wrote:
From: Zichen Xie <zichenxie0106@xxxxxxxxx> mt76_connac_get_he_phy_cap() may return a NULL pointer, leading to NULL Pointer Dereference. Add a NULL check for the returned pointer. Fixes: a5c372f77aa7 ("wifi: mt76: mt7925: extend mt7925_mcu_bss_he_tlv for per-link BSS") Fixes: e6d557a78b60 ("mt76: mt7915: rely on mt76_connac_get_phy utilities") Fixes: 98686cd21624 ("wifi: mt76: mt7996: add driver for MediaTek Wi-Fi 7 (802.11be) devices") Signed-off-by: Zichen Xie <zichenxie0106@xxxxxxxxx> --- drivers/net/wireless/mediatek/mt76/mt7915/mcu.c | 5 +++++ drivers/net/wireless/mediatek/mt76/mt7925/mcu.c | 2 ++ drivers/net/wireless/mediatek/mt76/mt7996/mcu.c | 2 ++ 3 files changed, 9 insertions(+) diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c index 87d0dd040001..762be3a37228 100644 --- a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c +++ b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c @@ -551,6 +551,8 @@ mt7915_mcu_bss_he_tlv(struct sk_buff *skb, struct ieee80211_vif *vif, struct tlv *tlv;cap = mt76_connac_get_he_phy_cap(phy->mt76, vif);+ if (!cap) + return;tlv = mt76_connac_mcu_add_tlv(skb, BSS_INFO_HE_BASIC, sizeof(*he)); @@ -1145,6 +1147,9 @@ mt7915_mcu_sta_bfer_he(struct ieee80211_sta *sta, struct ieee80211_vif *vif,u8 nss_mcs = mt7915_mcu_get_sta_nss(mcs_map); u8 snd_dim, sts;+ if (!vc)+ return; +
That will already blow up at line:
const struct ieee80211_he_cap_elem *ve = &vc->he_cap_elem;
This needs some more code changes.
Regards,
Matthias
bf->tx_mode = MT_PHY_TYPE_HE_SU;mt7915_mcu_sta_sounding_rate(bf);diff --git a/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c index 748ea6adbc6b..55e4cda2f20f 100644 --- a/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c +++ b/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c @@ -2508,6 +2508,8 @@ mt7925_mcu_bss_he_tlv(struct sk_buff *skb, struct ieee80211_bss_conf *link_conf, struct tlv *tlv;cap = mt76_connac_get_he_phy_cap(phy->mt76, link_conf->vif);+ if (!cap) + return;tlv = mt76_connac_mcu_add_tlv(skb, UNI_BSS_INFO_HE_BASIC, sizeof(*he)); diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.cindex 6c445a9dbc03..55bb2d0e67e5 100644 --- a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c +++ b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c @@ -798,6 +798,8 @@ mt7996_mcu_bss_he_tlv(struct sk_buff *skb, struct ieee80211_vif *vif, struct tlv *tlv;cap = mt76_connac_get_he_phy_cap(phy->mt76, vif);+ if (!cap) + return;tlv = mt7996_mcu_add_uni_tlv(skb, UNI_BSS_INFO_HE_BASIC, sizeof(*he));
