github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-10-08 19:46:02 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

wifi: mt76: mt7925: guard BSS capability lookups

Browse Source 
mt7925 BSS setup may dereference missing channel data or query HE 6 GHz
capabilities for an iftype without HE support.

Guard both lookups before adding NAN paths that can use partially
configured BSS state.

Co-developed-by: Stella Liu <yu-ching.liu@mediatek.com>
Signed-off-by: Stella Liu <yu-ching.liu@mediatek.com>
Co-developed-by: Jeremy Yu <chengwei.yu@mediatek.com>
Signed-off-by: Jeremy Yu <chengwei.yu@mediatek.com>
Signed-off-by: Sean Wang <sean.wang@mediatek.com>
Link: https://patch.msgid.link/20260625001834.475094-3-sean.wang@kernel.org
Signed-off-by: Felix Fietkau <nbd@nbd.name>
This commit is contained in:
Sean Wang 2026-06-24 19:18:27 -05:00 committed by Felix Fietkau
parent a7c71a3465
commit 9080164f3b
1 changed files with 20 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

26
drivers/net/wireless/mediatek/mt76/mt7925/mcu.c
View File

@ -2400,11 +2400,18 @@ void mt7925_mcu_bss_rlm_tlv(struct sk_buff *skb, struct mt76_phy *phy,
{
struct cfg80211_chan_def *chandef = ctx ? &ctx->def :
&link_conf->chanreq.oper;
int freq1 = chandef->center_freq1, freq2 = chandef->center_freq2;
enum nl80211_band band = chandef->chan->band;
struct bss_rlm_tlv *req;
enum nl80211_band band;
int freq1, freq2;
struct tlv *tlv;
if (WARN_ON_ONCE(!chandef || !chandef->chan))
return;
freq1 = chandef->center_freq1;
freq2 = chandef->center_freq2;
band = chandef->chan->band;
tlv = mt76_connac_mcu_add_tlv(skb, UNI_BSS_INFO_RLM, sizeof(*req));
req = (struct bss_rlm_tlv *)tlv;
req->control_channel = chandef->chan->hw_value;
@ -2542,8 +2549,8 @@ mt7925_get_phy_mode_ext(struct mt76_phy *phy, struct ieee80211_vif *vif,
enum nl80211_band band,
struct ieee80211_link_sta *link_sta)
{
struct ieee80211_he_6ghz_capa *he_6ghz_capa;
const struct ieee80211_sta_eht_cap *eht_cap;
struct ieee80211_he_6ghz_capa *he_6ghz_capa = NULL;
const struct ieee80211_sta_eht_cap *eht_cap = NULL;
__le16 capa = 0;
u8 mode = 0;
@ -2551,11 +2558,18 @@ mt7925_get_phy_mode_ext(struct mt76_phy *phy, struct ieee80211_vif *vif,
he_6ghz_capa = &link_sta->he_6ghz_capa;
eht_cap = &link_sta->eht_cap;
} else {
const struct ieee80211_sta_he_cap *he_cap;
struct ieee80211_supported_band *sband;
sband = phy->hw->wiphy->bands[band];
capa = ieee80211_get_he_6ghz_capa(sband, vif->type);
he_6ghz_capa = (struct ieee80211_he_6ghz_capa *)&capa;
he_cap = (band == NL80211_BAND_6GHZ) ?
ieee80211_get_he_iftype_cap(sband, vif->type) : NULL;
if (he_cap) {
capa = ieee80211_get_he_6ghz_capa(sband, vif->type);
he_6ghz_capa = (struct ieee80211_he_6ghz_capa *)&capa;
}
eht_cap = ieee80211_get_eht_iftype_cap(sband, vif->type);
}