[PATCH v5] wifi: mt76: Fix NULL Dereference caused by mt76_connac_get_he_phy_cap()

[Zichen Xie]

On 2024/10/7 14:13, Matthias Brugger wrote:
>
>
> On 07/10/2024 17:36, Zichen Xie wrote:
>> IMHO, using operator "&" for a NULL dereferenced pointer won't cause a
>> crash. 've' will only be assigned to a invalid address.
>>
>
> Please don't top post.
>
>> So we can put off the NULL check after
>> 'const struct ieee80211_he_cap_elem *ve = &vc->he_cap_elem;'
>>
>
> You are right, nevertheless for better code readability I'd still 
> advise to change the code so that vc is checked for NULL before any 
> use of struct vc.

The code snippets here does the same thing like me.

https://elixir.bootlin.com/linux/v6.12-rc2/source/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c#L1547

Should I also repair it for readability?


>
> Regards,
> Matthias
>
>> Best Regards,
>> Zichen
>>
>> On Mon, Oct 7, 2024 at 9:23 AM Matthias Brugger 
>> <matthias.bgg at gmail.com> wrote:
>>>
>>>
>>>
>>> On 03/10/2024 20:09, Gax-c wrote:
>>>> From: Zichen Xie <zichenxie0106 at gmail.com>
>>>>
>>>> mt76_connac_get_he_phy_cap() may return a NULL pointer,
>>>> leading to NULL Pointer Dereference.
>>>> Add a NULL check for the returned pointer.
>>>>
>>>> Fixes: a5c372f77aa7 ("wifi: mt76: mt7925: extend 
>>>> mt7925_mcu_bss_he_tlv for per-link BSS")
>>>> Fixes: e6d557a78b60 ("mt76: mt7915: rely on mt76_connac_get_phy 
>>>> utilities")
>>>> Fixes: 98686cd21624 ("wifi: mt76: mt7996: add driver for MediaTek 
>>>> Wi-Fi 7 (802.11be) devices")
>>>> Signed-off-by: Zichen Xie <zichenxie0106 at gmail.com>
>>>> ---
>>>>    drivers/net/wireless/mediatek/mt76/mt7915/mcu.c | 5 +++++
>>>>    drivers/net/wireless/mediatek/mt76/mt7925/mcu.c | 2 ++
>>>>    drivers/net/wireless/mediatek/mt76/mt7996/mcu.c | 2 ++
>>>>    3 files changed, 9 insertions(+)
>>>>
>>>> diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c 
>>>> b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c
>>>> index 87d0dd040001..762be3a37228 100644
>>>> --- a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c
>>>> +++ b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c
>>>> @@ -551,6 +551,8 @@ mt7915_mcu_bss_he_tlv(struct sk_buff *skb, 
>>>> struct ieee80211_vif *vif,
>>>>        struct tlv *tlv;
>>>>
>>>>        cap = mt76_connac_get_he_phy_cap(phy->mt76, vif);
>>>> +     if (!cap)
>>>> +             return;
>>>>
>>>>        tlv = mt76_connac_mcu_add_tlv(skb, BSS_INFO_HE_BASIC, 
>>>> sizeof(*he));
>>>>
>>>> @@ -1145,6 +1147,9 @@ mt7915_mcu_sta_bfer_he(struct ieee80211_sta 
>>>> *sta, struct ieee80211_vif *vif,
>>>>        u8 nss_mcs = mt7915_mcu_get_sta_nss(mcs_map);
>>>>        u8 snd_dim, sts;
>>>>
>>>> +     if (!vc)
>>>> +             return;
>>>> +
>>>
>>> That will already blow up at line:
>>>           const struct ieee80211_he_cap_elem *ve = &vc->he_cap_elem;
>>>
>>> This needs some more code changes.
>>>
>>> Regards,
>>> Matthias
>>>
>>>>        bf->tx_mode = MT_PHY_TYPE_HE_SU;
>>>>
>>>>        mt7915_mcu_sta_sounding_rate(bf);
>>>> diff --git a/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c 
>>>> b/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c
>>>> index 748ea6adbc6b..55e4cda2f20f 100644
>>>> --- a/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c
>>>> +++ b/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c
>>>> @@ -2508,6 +2508,8 @@ mt7925_mcu_bss_he_tlv(struct sk_buff *skb, 
>>>> struct ieee80211_bss_conf *link_conf,
>>>>        struct tlv *tlv;
>>>>
>>>>        cap = mt76_connac_get_he_phy_cap(phy->mt76, link_conf->vif);
>>>> +     if (!cap)
>>>> +             return;
>>>>
>>>>        tlv = mt76_connac_mcu_add_tlv(skb, UNI_BSS_INFO_HE_BASIC, 
>>>> sizeof(*he));
>>>>
>>>> diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c 
>>>> b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
>>>> index 6c445a9dbc03..55bb2d0e67e5 100644
>>>> --- a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
>>>> +++ b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
>>>> @@ -798,6 +798,8 @@ mt7996_mcu_bss_he_tlv(struct sk_buff *skb, 
>>>> struct ieee80211_vif *vif,
>>>>        struct tlv *tlv;
>>>>
>>>>        cap = mt76_connac_get_he_phy_cap(phy->mt76, vif);
>>>> +     if (!cap)
>>>> +             return;
>>>>
>>>>        tlv = mt7996_mcu_add_uni_tlv(skb, UNI_BSS_INFO_HE_BASIC, 
>>>> sizeof(*he));
>>>>