* [PATCH v5] wifi: mt76: Fix NULL Dereference caused by mt76_connac_get_he_phy_cap()
@ 2024-10-03 18:09 Gax-c
2024-10-05 17:28 ` Markus Elfring
2024-10-07 14:23 ` Matthias Brugger
0 siblings, 2 replies; 6+ messages in thread
From: Gax-c @ 2024-10-03 18:09 UTC (permalink / raw)
To: nbd, lorenzo, ryder.lee, shayne.chen, sean.wang, kvalo,
matthias.bgg, angelogioacchino.delregno, johannes.berg,
quic_adisi, deren.wu, chui-hao.chiu, mingyen.hsieh, howard-yh.hsu,
StanleyYP.Wang, allen.ye, benjamin-jw.lin, Bo.Jiao, evelyn.tsai,
meichia.chiu, krzk
Cc: linux-wireless, linux-arm-kernel, linux-mediatek, chenyuan0y,
zzjas98, Zichen Xie
From: Zichen Xie <zichenxie0106@gmail.com>
mt76_connac_get_he_phy_cap() may return a NULL pointer,
leading to NULL Pointer Dereference.
Add a NULL check for the returned pointer.
Fixes: a5c372f77aa7 ("wifi: mt76: mt7925: extend mt7925_mcu_bss_he_tlv for per-link BSS")
Fixes: e6d557a78b60 ("mt76: mt7915: rely on mt76_connac_get_phy utilities")
Fixes: 98686cd21624 ("wifi: mt76: mt7996: add driver for MediaTek Wi-Fi 7 (802.11be) devices")
Signed-off-by: Zichen Xie <zichenxie0106@gmail.com>
---
drivers/net/wireless/mediatek/mt76/mt7915/mcu.c | 5 +++++
drivers/net/wireless/mediatek/mt76/mt7925/mcu.c | 2 ++
drivers/net/wireless/mediatek/mt76/mt7996/mcu.c | 2 ++
3 files changed, 9 insertions(+)
diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c
index 87d0dd040001..762be3a37228 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c
@@ -551,6 +551,8 @@ mt7915_mcu_bss_he_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
struct tlv *tlv;
cap = mt76_connac_get_he_phy_cap(phy->mt76, vif);
+ if (!cap)
+ return;
tlv = mt76_connac_mcu_add_tlv(skb, BSS_INFO_HE_BASIC, sizeof(*he));
@@ -1145,6 +1147,9 @@ mt7915_mcu_sta_bfer_he(struct ieee80211_sta *sta, struct ieee80211_vif *vif,
u8 nss_mcs = mt7915_mcu_get_sta_nss(mcs_map);
u8 snd_dim, sts;
+ if (!vc)
+ return;
+
bf->tx_mode = MT_PHY_TYPE_HE_SU;
mt7915_mcu_sta_sounding_rate(bf);
diff --git a/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c
index 748ea6adbc6b..55e4cda2f20f 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c
@@ -2508,6 +2508,8 @@ mt7925_mcu_bss_he_tlv(struct sk_buff *skb, struct ieee80211_bss_conf *link_conf,
struct tlv *tlv;
cap = mt76_connac_get_he_phy_cap(phy->mt76, link_conf->vif);
+ if (!cap)
+ return;
tlv = mt76_connac_mcu_add_tlv(skb, UNI_BSS_INFO_HE_BASIC, sizeof(*he));
diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
index 6c445a9dbc03..55bb2d0e67e5 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
@@ -798,6 +798,8 @@ mt7996_mcu_bss_he_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
struct tlv *tlv;
cap = mt76_connac_get_he_phy_cap(phy->mt76, vif);
+ if (!cap)
+ return;
tlv = mt7996_mcu_add_uni_tlv(skb, UNI_BSS_INFO_HE_BASIC, sizeof(*he));
--
2.25.1
^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: [PATCH v5] wifi: mt76: Fix NULL Dereference caused by mt76_connac_get_he_phy_cap()
2024-10-03 18:09 [PATCH v5] wifi: mt76: Fix NULL Dereference caused by mt76_connac_get_he_phy_cap() Gax-c
@ 2024-10-05 17:28 ` Markus Elfring
2024-10-07 14:23 ` Matthias Brugger
1 sibling, 0 replies; 6+ messages in thread
From: Markus Elfring @ 2024-10-05 17:28 UTC (permalink / raw)
To: Zichen Xie, linux-mediatek, linux-arm-kernel, linux-wireless,
Aditya Kumar Singh, Allen Ye (葉芷勳),
Angelo Gioacchino Del Regno, Benjamin Lin, Bo Jiao, Deren Wu,
Evelyn Tsai (蔡珊鈺), Felix Fietkau, Howard Hsu,
Johannes Berg, Kalle Valo, Krzysztof Kozlowski, Lorenzo Bianconi,
Matthias Brugger, MeiChia Chiu, Ming Yen Hsieh, Peter Chiu,
Ryder Lee, Sean Wang, Shayne Chen, StanleyYP Wang
Cc: LKML, kernel-janitors, Chenyuan Yang, Zijie Zhao
> mt76_connac_get_he_phy_cap() may return a NULL pointer,
> leading to NULL Pointer Dereference.
…
multiple questionable accesses?
How do you think about to use the term “null pointer dereference”
for the final commit message (including the summary phrase)?
Were any static source code analysis tools involved in the detection
of presented change possibilities?
…
> ---
> drivers/net/wireless/mediatek/mt76/mt7915/mcu.c | 5 +++++
…
Did you overlook to add patch version descriptions behind the marker line?
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/Documentation/process/submitting-patches.rst?h=v6.12-rc1#n723
Regards,
Markus
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH v5] wifi: mt76: Fix NULL Dereference caused by mt76_connac_get_he_phy_cap()
2024-10-03 18:09 [PATCH v5] wifi: mt76: Fix NULL Dereference caused by mt76_connac_get_he_phy_cap() Gax-c
2024-10-05 17:28 ` Markus Elfring
@ 2024-10-07 14:23 ` Matthias Brugger
2024-10-07 15:36 ` Zichen Xie
1 sibling, 1 reply; 6+ messages in thread
From: Matthias Brugger @ 2024-10-07 14:23 UTC (permalink / raw)
To: Gax-c, nbd, lorenzo, ryder.lee, shayne.chen, sean.wang, kvalo,
angelogioacchino.delregno, johannes.berg, quic_adisi, deren.wu,
chui-hao.chiu, mingyen.hsieh, howard-yh.hsu, StanleyYP.Wang,
allen.ye, benjamin-jw.lin, Bo.Jiao, evelyn.tsai, meichia.chiu,
krzk
Cc: linux-wireless, linux-arm-kernel, linux-mediatek, chenyuan0y,
zzjas98
On 03/10/2024 20:09, Gax-c wrote:
> From: Zichen Xie <zichenxie0106@gmail.com>
>
> mt76_connac_get_he_phy_cap() may return a NULL pointer,
> leading to NULL Pointer Dereference.
> Add a NULL check for the returned pointer.
>
> Fixes: a5c372f77aa7 ("wifi: mt76: mt7925: extend mt7925_mcu_bss_he_tlv for per-link BSS")
> Fixes: e6d557a78b60 ("mt76: mt7915: rely on mt76_connac_get_phy utilities")
> Fixes: 98686cd21624 ("wifi: mt76: mt7996: add driver for MediaTek Wi-Fi 7 (802.11be) devices")
> Signed-off-by: Zichen Xie <zichenxie0106@gmail.com>
> ---
> drivers/net/wireless/mediatek/mt76/mt7915/mcu.c | 5 +++++
> drivers/net/wireless/mediatek/mt76/mt7925/mcu.c | 2 ++
> drivers/net/wireless/mediatek/mt76/mt7996/mcu.c | 2 ++
> 3 files changed, 9 insertions(+)
>
> diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c
> index 87d0dd040001..762be3a37228 100644
> --- a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c
> +++ b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c
> @@ -551,6 +551,8 @@ mt7915_mcu_bss_he_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
> struct tlv *tlv;
>
> cap = mt76_connac_get_he_phy_cap(phy->mt76, vif);
> + if (!cap)
> + return;
>
> tlv = mt76_connac_mcu_add_tlv(skb, BSS_INFO_HE_BASIC, sizeof(*he));
>
> @@ -1145,6 +1147,9 @@ mt7915_mcu_sta_bfer_he(struct ieee80211_sta *sta, struct ieee80211_vif *vif,
> u8 nss_mcs = mt7915_mcu_get_sta_nss(mcs_map);
> u8 snd_dim, sts;
>
> + if (!vc)
> + return;
> +
That will already blow up at line:
const struct ieee80211_he_cap_elem *ve = &vc->he_cap_elem;
This needs some more code changes.
Regards,
Matthias
> bf->tx_mode = MT_PHY_TYPE_HE_SU;
>
> mt7915_mcu_sta_sounding_rate(bf);
> diff --git a/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c
> index 748ea6adbc6b..55e4cda2f20f 100644
> --- a/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c
> +++ b/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c
> @@ -2508,6 +2508,8 @@ mt7925_mcu_bss_he_tlv(struct sk_buff *skb, struct ieee80211_bss_conf *link_conf,
> struct tlv *tlv;
>
> cap = mt76_connac_get_he_phy_cap(phy->mt76, link_conf->vif);
> + if (!cap)
> + return;
>
> tlv = mt76_connac_mcu_add_tlv(skb, UNI_BSS_INFO_HE_BASIC, sizeof(*he));
>
> diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
> index 6c445a9dbc03..55bb2d0e67e5 100644
> --- a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
> +++ b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
> @@ -798,6 +798,8 @@ mt7996_mcu_bss_he_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
> struct tlv *tlv;
>
> cap = mt76_connac_get_he_phy_cap(phy->mt76, vif);
> + if (!cap)
> + return;
>
> tlv = mt7996_mcu_add_uni_tlv(skb, UNI_BSS_INFO_HE_BASIC, sizeof(*he));
>
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH v5] wifi: mt76: Fix NULL Dereference caused by mt76_connac_get_he_phy_cap()
2024-10-07 14:23 ` Matthias Brugger
@ 2024-10-07 15:36 ` Zichen Xie
2024-10-07 19:13 ` Matthias Brugger
0 siblings, 1 reply; 6+ messages in thread
From: Zichen Xie @ 2024-10-07 15:36 UTC (permalink / raw)
To: Matthias Brugger
Cc: nbd, lorenzo, ryder.lee, shayne.chen, sean.wang, kvalo,
angelogioacchino.delregno, johannes.berg, quic_adisi, deren.wu,
chui-hao.chiu, mingyen.hsieh, howard-yh.hsu, StanleyYP.Wang,
allen.ye, benjamin-jw.lin, Bo.Jiao, evelyn.tsai, meichia.chiu,
krzk, linux-wireless, linux-arm-kernel, linux-mediatek,
chenyuan0y, zzjas98
IMHO, using operator "&" for a NULL dereferenced pointer won't cause a
crash. 've' will only be assigned to a invalid address.
So we can put off the NULL check after
'const struct ieee80211_he_cap_elem *ve = &vc->he_cap_elem;'
Best Regards,
Zichen
On Mon, Oct 7, 2024 at 9:23 AM Matthias Brugger <matthias.bgg@gmail.com> wrote:
>
>
>
> On 03/10/2024 20:09, Gax-c wrote:
> > From: Zichen Xie <zichenxie0106@gmail.com>
> >
> > mt76_connac_get_he_phy_cap() may return a NULL pointer,
> > leading to NULL Pointer Dereference.
> > Add a NULL check for the returned pointer.
> >
> > Fixes: a5c372f77aa7 ("wifi: mt76: mt7925: extend mt7925_mcu_bss_he_tlv for per-link BSS")
> > Fixes: e6d557a78b60 ("mt76: mt7915: rely on mt76_connac_get_phy utilities")
> > Fixes: 98686cd21624 ("wifi: mt76: mt7996: add driver for MediaTek Wi-Fi 7 (802.11be) devices")
> > Signed-off-by: Zichen Xie <zichenxie0106@gmail.com>
> > ---
> > drivers/net/wireless/mediatek/mt76/mt7915/mcu.c | 5 +++++
> > drivers/net/wireless/mediatek/mt76/mt7925/mcu.c | 2 ++
> > drivers/net/wireless/mediatek/mt76/mt7996/mcu.c | 2 ++
> > 3 files changed, 9 insertions(+)
> >
> > diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c
> > index 87d0dd040001..762be3a37228 100644
> > --- a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c
> > +++ b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c
> > @@ -551,6 +551,8 @@ mt7915_mcu_bss_he_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
> > struct tlv *tlv;
> >
> > cap = mt76_connac_get_he_phy_cap(phy->mt76, vif);
> > + if (!cap)
> > + return;
> >
> > tlv = mt76_connac_mcu_add_tlv(skb, BSS_INFO_HE_BASIC, sizeof(*he));
> >
> > @@ -1145,6 +1147,9 @@ mt7915_mcu_sta_bfer_he(struct ieee80211_sta *sta, struct ieee80211_vif *vif,
> > u8 nss_mcs = mt7915_mcu_get_sta_nss(mcs_map);
> > u8 snd_dim, sts;
> >
> > + if (!vc)
> > + return;
> > +
>
> That will already blow up at line:
> const struct ieee80211_he_cap_elem *ve = &vc->he_cap_elem;
>
> This needs some more code changes.
>
> Regards,
> Matthias
>
> > bf->tx_mode = MT_PHY_TYPE_HE_SU;
> >
> > mt7915_mcu_sta_sounding_rate(bf);
> > diff --git a/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c
> > index 748ea6adbc6b..55e4cda2f20f 100644
> > --- a/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c
> > +++ b/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c
> > @@ -2508,6 +2508,8 @@ mt7925_mcu_bss_he_tlv(struct sk_buff *skb, struct ieee80211_bss_conf *link_conf,
> > struct tlv *tlv;
> >
> > cap = mt76_connac_get_he_phy_cap(phy->mt76, link_conf->vif);
> > + if (!cap)
> > + return;
> >
> > tlv = mt76_connac_mcu_add_tlv(skb, UNI_BSS_INFO_HE_BASIC, sizeof(*he));
> >
> > diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
> > index 6c445a9dbc03..55bb2d0e67e5 100644
> > --- a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
> > +++ b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
> > @@ -798,6 +798,8 @@ mt7996_mcu_bss_he_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
> > struct tlv *tlv;
> >
> > cap = mt76_connac_get_he_phy_cap(phy->mt76, vif);
> > + if (!cap)
> > + return;
> >
> > tlv = mt7996_mcu_add_uni_tlv(skb, UNI_BSS_INFO_HE_BASIC, sizeof(*he));
> >
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH v5] wifi: mt76: Fix NULL Dereference caused by mt76_connac_get_he_phy_cap()
2024-10-07 15:36 ` Zichen Xie
@ 2024-10-07 19:13 ` Matthias Brugger
2024-10-09 2:22 ` Zichen Xie
0 siblings, 1 reply; 6+ messages in thread
From: Matthias Brugger @ 2024-10-07 19:13 UTC (permalink / raw)
To: Zichen Xie
Cc: nbd, lorenzo, ryder.lee, shayne.chen, sean.wang, kvalo,
angelogioacchino.delregno, johannes.berg, quic_adisi, deren.wu,
chui-hao.chiu, mingyen.hsieh, howard-yh.hsu, StanleyYP.Wang,
allen.ye, benjamin-jw.lin, Bo.Jiao, evelyn.tsai, meichia.chiu,
krzk, linux-wireless, linux-arm-kernel, linux-mediatek,
chenyuan0y, zzjas98
On 07/10/2024 17:36, Zichen Xie wrote:
> IMHO, using operator "&" for a NULL dereferenced pointer won't cause a
> crash. 've' will only be assigned to a invalid address.
>
Please don't top post.
> So we can put off the NULL check after
> 'const struct ieee80211_he_cap_elem *ve = &vc->he_cap_elem;'
>
You are right, nevertheless for better code readability I'd still advise to
change the code so that vc is checked for NULL before any use of struct vc.
Regards,
Matthias
> Best Regards,
> Zichen
>
> On Mon, Oct 7, 2024 at 9:23 AM Matthias Brugger <matthias.bgg@gmail.com> wrote:
>>
>>
>>
>> On 03/10/2024 20:09, Gax-c wrote:
>>> From: Zichen Xie <zichenxie0106@gmail.com>
>>>
>>> mt76_connac_get_he_phy_cap() may return a NULL pointer,
>>> leading to NULL Pointer Dereference.
>>> Add a NULL check for the returned pointer.
>>>
>>> Fixes: a5c372f77aa7 ("wifi: mt76: mt7925: extend mt7925_mcu_bss_he_tlv for per-link BSS")
>>> Fixes: e6d557a78b60 ("mt76: mt7915: rely on mt76_connac_get_phy utilities")
>>> Fixes: 98686cd21624 ("wifi: mt76: mt7996: add driver for MediaTek Wi-Fi 7 (802.11be) devices")
>>> Signed-off-by: Zichen Xie <zichenxie0106@gmail.com>
>>> ---
>>> drivers/net/wireless/mediatek/mt76/mt7915/mcu.c | 5 +++++
>>> drivers/net/wireless/mediatek/mt76/mt7925/mcu.c | 2 ++
>>> drivers/net/wireless/mediatek/mt76/mt7996/mcu.c | 2 ++
>>> 3 files changed, 9 insertions(+)
>>>
>>> diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c
>>> index 87d0dd040001..762be3a37228 100644
>>> --- a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c
>>> +++ b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c
>>> @@ -551,6 +551,8 @@ mt7915_mcu_bss_he_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
>>> struct tlv *tlv;
>>>
>>> cap = mt76_connac_get_he_phy_cap(phy->mt76, vif);
>>> + if (!cap)
>>> + return;
>>>
>>> tlv = mt76_connac_mcu_add_tlv(skb, BSS_INFO_HE_BASIC, sizeof(*he));
>>>
>>> @@ -1145,6 +1147,9 @@ mt7915_mcu_sta_bfer_he(struct ieee80211_sta *sta, struct ieee80211_vif *vif,
>>> u8 nss_mcs = mt7915_mcu_get_sta_nss(mcs_map);
>>> u8 snd_dim, sts;
>>>
>>> + if (!vc)
>>> + return;
>>> +
>>
>> That will already blow up at line:
>> const struct ieee80211_he_cap_elem *ve = &vc->he_cap_elem;
>>
>> This needs some more code changes.
>>
>> Regards,
>> Matthias
>>
>>> bf->tx_mode = MT_PHY_TYPE_HE_SU;
>>>
>>> mt7915_mcu_sta_sounding_rate(bf);
>>> diff --git a/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c
>>> index 748ea6adbc6b..55e4cda2f20f 100644
>>> --- a/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c
>>> +++ b/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c
>>> @@ -2508,6 +2508,8 @@ mt7925_mcu_bss_he_tlv(struct sk_buff *skb, struct ieee80211_bss_conf *link_conf,
>>> struct tlv *tlv;
>>>
>>> cap = mt76_connac_get_he_phy_cap(phy->mt76, link_conf->vif);
>>> + if (!cap)
>>> + return;
>>>
>>> tlv = mt76_connac_mcu_add_tlv(skb, UNI_BSS_INFO_HE_BASIC, sizeof(*he));
>>>
>>> diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
>>> index 6c445a9dbc03..55bb2d0e67e5 100644
>>> --- a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
>>> +++ b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
>>> @@ -798,6 +798,8 @@ mt7996_mcu_bss_he_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
>>> struct tlv *tlv;
>>>
>>> cap = mt76_connac_get_he_phy_cap(phy->mt76, vif);
>>> + if (!cap)
>>> + return;
>>>
>>> tlv = mt7996_mcu_add_uni_tlv(skb, UNI_BSS_INFO_HE_BASIC, sizeof(*he));
>>>
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH v5] wifi: mt76: Fix NULL Dereference caused by mt76_connac_get_he_phy_cap()
2024-10-07 19:13 ` Matthias Brugger
@ 2024-10-09 2:22 ` Zichen Xie
0 siblings, 0 replies; 6+ messages in thread
From: Zichen Xie @ 2024-10-09 2:22 UTC (permalink / raw)
To: Matthias Brugger
Cc: nbd, lorenzo, ryder.lee, shayne.chen, sean.wang, kvalo,
angelogioacchino.delregno, johannes.berg, quic_adisi, deren.wu,
chui-hao.chiu, mingyen.hsieh, howard-yh.hsu, StanleyYP.Wang,
allen.ye, benjamin-jw.lin, Bo.Jiao, evelyn.tsai, meichia.chiu,
linux-wireless, linux-arm-kernel, linux-mediatek, chenyuan0y,
zzjas98
On 2024/10/7 14:13, Matthias Brugger wrote:
>
>
> On 07/10/2024 17:36, Zichen Xie wrote:
>> IMHO, using operator "&" for a NULL dereferenced pointer won't cause a
>> crash. 've' will only be assigned to a invalid address.
>>
>
> Please don't top post.
>
>> So we can put off the NULL check after
>> 'const struct ieee80211_he_cap_elem *ve = &vc->he_cap_elem;'
>>
>
> You are right, nevertheless for better code readability I'd still
> advise to change the code so that vc is checked for NULL before any
> use of struct vc.
The code snippets here does the same thing like me.
https://elixir.bootlin.com/linux/v6.12-rc2/source/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c#L1547
Should I also repair it for readability?
>
> Regards,
> Matthias
>
>> Best Regards,
>> Zichen
>>
>> On Mon, Oct 7, 2024 at 9:23 AM Matthias Brugger
>> <matthias.bgg@gmail.com> wrote:
>>>
>>>
>>>
>>> On 03/10/2024 20:09, Gax-c wrote:
>>>> From: Zichen Xie <zichenxie0106@gmail.com>
>>>>
>>>> mt76_connac_get_he_phy_cap() may return a NULL pointer,
>>>> leading to NULL Pointer Dereference.
>>>> Add a NULL check for the returned pointer.
>>>>
>>>> Fixes: a5c372f77aa7 ("wifi: mt76: mt7925: extend
>>>> mt7925_mcu_bss_he_tlv for per-link BSS")
>>>> Fixes: e6d557a78b60 ("mt76: mt7915: rely on mt76_connac_get_phy
>>>> utilities")
>>>> Fixes: 98686cd21624 ("wifi: mt76: mt7996: add driver for MediaTek
>>>> Wi-Fi 7 (802.11be) devices")
>>>> Signed-off-by: Zichen Xie <zichenxie0106@gmail.com>
>>>> ---
>>>> drivers/net/wireless/mediatek/mt76/mt7915/mcu.c | 5 +++++
>>>> drivers/net/wireless/mediatek/mt76/mt7925/mcu.c | 2 ++
>>>> drivers/net/wireless/mediatek/mt76/mt7996/mcu.c | 2 ++
>>>> 3 files changed, 9 insertions(+)
>>>>
>>>> diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c
>>>> b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c
>>>> index 87d0dd040001..762be3a37228 100644
>>>> --- a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c
>>>> +++ b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c
>>>> @@ -551,6 +551,8 @@ mt7915_mcu_bss_he_tlv(struct sk_buff *skb,
>>>> struct ieee80211_vif *vif,
>>>> struct tlv *tlv;
>>>>
>>>> cap = mt76_connac_get_he_phy_cap(phy->mt76, vif);
>>>> + if (!cap)
>>>> + return;
>>>>
>>>> tlv = mt76_connac_mcu_add_tlv(skb, BSS_INFO_HE_BASIC,
>>>> sizeof(*he));
>>>>
>>>> @@ -1145,6 +1147,9 @@ mt7915_mcu_sta_bfer_he(struct ieee80211_sta
>>>> *sta, struct ieee80211_vif *vif,
>>>> u8 nss_mcs = mt7915_mcu_get_sta_nss(mcs_map);
>>>> u8 snd_dim, sts;
>>>>
>>>> + if (!vc)
>>>> + return;
>>>> +
>>>
>>> That will already blow up at line:
>>> const struct ieee80211_he_cap_elem *ve = &vc->he_cap_elem;
>>>
>>> This needs some more code changes.
>>>
>>> Regards,
>>> Matthias
>>>
>>>> bf->tx_mode = MT_PHY_TYPE_HE_SU;
>>>>
>>>> mt7915_mcu_sta_sounding_rate(bf);
>>>> diff --git a/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c
>>>> b/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c
>>>> index 748ea6adbc6b..55e4cda2f20f 100644
>>>> --- a/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c
>>>> +++ b/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c
>>>> @@ -2508,6 +2508,8 @@ mt7925_mcu_bss_he_tlv(struct sk_buff *skb,
>>>> struct ieee80211_bss_conf *link_conf,
>>>> struct tlv *tlv;
>>>>
>>>> cap = mt76_connac_get_he_phy_cap(phy->mt76, link_conf->vif);
>>>> + if (!cap)
>>>> + return;
>>>>
>>>> tlv = mt76_connac_mcu_add_tlv(skb, UNI_BSS_INFO_HE_BASIC,
>>>> sizeof(*he));
>>>>
>>>> diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
>>>> b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
>>>> index 6c445a9dbc03..55bb2d0e67e5 100644
>>>> --- a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
>>>> +++ b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
>>>> @@ -798,6 +798,8 @@ mt7996_mcu_bss_he_tlv(struct sk_buff *skb,
>>>> struct ieee80211_vif *vif,
>>>> struct tlv *tlv;
>>>>
>>>> cap = mt76_connac_get_he_phy_cap(phy->mt76, vif);
>>>> + if (!cap)
>>>> + return;
>>>>
>>>> tlv = mt7996_mcu_add_uni_tlv(skb, UNI_BSS_INFO_HE_BASIC,
>>>> sizeof(*he));
>>>>
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2024-10-09 2:24 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2024-10-03 18:09 [PATCH v5] wifi: mt76: Fix NULL Dereference caused by mt76_connac_get_he_phy_cap() Gax-c
2024-10-05 17:28 ` Markus Elfring
2024-10-07 14:23 ` Matthias Brugger
2024-10-07 15:36 ` Zichen Xie
2024-10-07 19:13 ` Matthias Brugger
2024-10-09 2:22 ` Zichen Xie
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).