| Message ID | 20240930212014.30607-1-zichenxie0106@gmail.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | wifi: mt76: Fix NULL Pointer Dereference caused by mt76_connac_get_he_phy_cap() | expand |
On 30/09/2024 23:20, Gax-c wrote: > like commit f503ae90c735 ("wifi: mt76: mt7996: fix NULL pointer dereference in mt7996_mcu_sta_bfer_he"), mt76_connac_get_he_phy_cap() may return a NULL pointer, leading to NULL Pointer Dereference. > Add a null check for the returned pointer. > > Fixes: a5c372f77aa7 ("wifi: mt76: mt7925: extend mt7925_mcu_bss_he_tlv for per-link BSS") > Fixes: e6d557a78b60 ("mt76: mt7915: rely on mt76_connac_get_phy utilities") > Fixes: 98686cd21624 ("wifi: mt76: mt7996: add driver for MediaTek Wi-Fi 7 (802.11be) devices") > Signed-off-by: Zichen Xie <zichenxie0106@gmail.com> > Reported-by: Zichen Xie <zichenxie0106@gmail.com> > Reported-by: Zijie Zhao <zzjas98@gmail.com> > Reported-by: Chenyuan Yang <chenyuan0y@gmail.com> Same comments as in other patches. > --- > drivers/net/wireless/mediatek/mt76/mt7915/mcu.c | 6 ++++++ > drivers/net/wireless/mediatek/mt76/mt7925/mcu.c | 3 +++ > drivers/net/wireless/mediatek/mt76/mt7996/mcu.c | 3 +++ > 3 files changed, 12 insertions(+) > > diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c > index 87d0dd040001..941a6e40e94c 100644 > --- a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c > +++ b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c > @@ -552,6 +552,9 @@ mt7915_mcu_bss_he_tlv(struct sk_buff *skb, struct ieee80211_vif *vif, > > cap = mt76_connac_get_he_phy_cap(phy->mt76, vif); > Same problem as in other patches - drop unnecessary blank line. > + if (!cap) > + return; > + > tlv = mt76_connac_mcu_add_tlv(skb, BSS_INFO_HE_BASIC, sizeof(*he)); > > he = (struct bss_info_he *)tlv; > @@ -1145,6 +1148,9 @@ mt7915_mcu_sta_bfer_he(struct ieee80211_sta *sta, struct ieee80211_vif *vif, > u8 nss_mcs = mt7915_mcu_get_sta_nss(mcs_map); > u8 snd_dim, sts; > > + if (!vc) > + return; > + > bf->tx_mode = MT_PHY_TYPE_HE_SU; > > mt7915_mcu_sta_sounding_rate(bf); > diff --git a/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c > index 748ea6adbc6b..1caf3e3e0e87 100644 > --- a/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c > +++ b/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c > @@ -2509,6 +2509,9 @@ mt7925_mcu_bss_he_tlv(struct sk_buff *skb, struct ieee80211_bss_conf *link_conf, > > cap = mt76_connac_get_he_phy_cap(phy->mt76, link_conf->vif); > > + if (!cap) > + return; > + > tlv = mt76_connac_mcu_add_tlv(skb, UNI_BSS_INFO_HE_BASIC, sizeof(*he)); > > he = (struct bss_info_uni_he *)tlv; > diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c > index 6c445a9dbc03..e547729701b7 100644 > --- a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c > +++ b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c > @@ -799,6 +799,9 @@ mt7996_mcu_bss_he_tlv(struct sk_buff *skb, struct ieee80211_vif *vif, > > cap = mt76_connac_get_he_phy_cap(phy->mt76, vif); > > + if (!cap) > + return; Don't you need to handle the error? Cleanup? Best regards, Krzysztof
diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c index 87d0dd040001..941a6e40e94c 100644 --- a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c +++ b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c @@ -552,6 +552,9 @@ mt7915_mcu_bss_he_tlv(struct sk_buff *skb, struct ieee80211_vif *vif, cap = mt76_connac_get_he_phy_cap(phy->mt76, vif); + if (!cap) + return; + tlv = mt76_connac_mcu_add_tlv(skb, BSS_INFO_HE_BASIC, sizeof(*he)); he = (struct bss_info_he *)tlv; @@ -1145,6 +1148,9 @@ mt7915_mcu_sta_bfer_he(struct ieee80211_sta *sta, struct ieee80211_vif *vif, u8 nss_mcs = mt7915_mcu_get_sta_nss(mcs_map); u8 snd_dim, sts; + if (!vc) + return; + bf->tx_mode = MT_PHY_TYPE_HE_SU; mt7915_mcu_sta_sounding_rate(bf); diff --git a/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c index 748ea6adbc6b..1caf3e3e0e87 100644 --- a/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c +++ b/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c @@ -2509,6 +2509,9 @@ mt7925_mcu_bss_he_tlv(struct sk_buff *skb, struct ieee80211_bss_conf *link_conf, cap = mt76_connac_get_he_phy_cap(phy->mt76, link_conf->vif); + if (!cap) + return; + tlv = mt76_connac_mcu_add_tlv(skb, UNI_BSS_INFO_HE_BASIC, sizeof(*he)); he = (struct bss_info_uni_he *)tlv; diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c index 6c445a9dbc03..e547729701b7 100644 --- a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c +++ b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c @@ -799,6 +799,9 @@ mt7996_mcu_bss_he_tlv(struct sk_buff *skb, struct ieee80211_vif *vif, cap = mt76_connac_get_he_phy_cap(phy->mt76, vif); + if (!cap) + return; + tlv = mt7996_mcu_add_uni_tlv(skb, UNI_BSS_INFO_HE_BASIC, sizeof(*he)); he = (struct bss_info_uni_he *)tlv;
like commit f503ae90c735 ("wifi: mt76: mt7996: fix NULL pointer dereference in mt7996_mcu_sta_bfer_he"), mt76_connac_get_he_phy_cap() may return a NULL pointer, leading to NULL Pointer Dereference. Add a null check for the returned pointer. Fixes: a5c372f77aa7 ("wifi: mt76: mt7925: extend mt7925_mcu_bss_he_tlv for per-link BSS") Fixes: e6d557a78b60 ("mt76: mt7915: rely on mt76_connac_get_phy utilities") Fixes: 98686cd21624 ("wifi: mt76: mt7996: add driver for MediaTek Wi-Fi 7 (802.11be) devices") Signed-off-by: Zichen Xie <zichenxie0106@gmail.com> Reported-by: Zichen Xie <zichenxie0106@gmail.com> Reported-by: Zijie Zhao <zzjas98@gmail.com> Reported-by: Chenyuan Yang <chenyuan0y@gmail.com> --- drivers/net/wireless/mediatek/mt76/mt7915/mcu.c | 6 ++++++ drivers/net/wireless/mediatek/mt76/mt7925/mcu.c | 3 +++ drivers/net/wireless/mediatek/mt76/mt7996/mcu.c | 3 +++ 3 files changed, 12 insertions(+)