[PATCH v5] wifi: mt76: Fix NULL Dereference caused by mt76_connac_get_he_phy_cap()

[PATCH v5] wifi: mt76: Fix NULL Dereference caused by mt76_connac_get_he_phy_cap()

[Gax-c]

From: Zichen Xie <zichenxie0106@gmail.com>

mt76_connac_get_he_phy_cap() may return a NULL pointer,
leading to NULL Pointer Dereference.
Add a NULL check for the returned pointer.

Fixes: a5c372f77aa7 ("wifi: mt76: mt7925: extend mt7925_mcu_bss_he_tlv for per-link BSS")
Fixes: e6d557a78b60 ("mt76: mt7915: rely on mt76_connac_get_phy utilities")
Fixes: 98686cd21624 ("wifi: mt76: mt7996: add driver for MediaTek Wi-Fi 7 (802.11be) devices")
Signed-off-by: Zichen Xie <zichenxie0106@gmail.com>
---
 drivers/net/wireless/mediatek/mt76/mt7915/mcu.c | 5 +++++
 drivers/net/wireless/mediatek/mt76/mt7925/mcu.c | 2 ++
 drivers/net/wireless/mediatek/mt76/mt7996/mcu.c | 2 ++
 3 files changed, 9 insertions(+)

diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c
index 87d0dd040001..762be3a37228 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c
@@ -551,6 +551,8 @@ mt7915_mcu_bss_he_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
 	struct tlv *tlv;
 
 	cap = mt76_connac_get_he_phy_cap(phy->mt76, vif);
+	if (!cap)
+		return;
 
 	tlv = mt76_connac_mcu_add_tlv(skb, BSS_INFO_HE_BASIC, sizeof(*he));
 
@@ -1145,6 +1147,9 @@ mt7915_mcu_sta_bfer_he(struct ieee80211_sta *sta, struct ieee80211_vif *vif,
 	u8 nss_mcs = mt7915_mcu_get_sta_nss(mcs_map);
 	u8 snd_dim, sts;
 
+	if (!vc)
+		return;
+
 	bf->tx_mode = MT_PHY_TYPE_HE_SU;
 
 	mt7915_mcu_sta_sounding_rate(bf);
diff --git a/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c
index 748ea6adbc6b..55e4cda2f20f 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c
@@ -2508,6 +2508,8 @@ mt7925_mcu_bss_he_tlv(struct sk_buff *skb, struct ieee80211_bss_conf *link_conf,
 	struct tlv *tlv;
 
 	cap = mt76_connac_get_he_phy_cap(phy->mt76, link_conf->vif);
+	if (!cap)
+		return;
 
 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_BSS_INFO_HE_BASIC, sizeof(*he));
 
diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
index 6c445a9dbc03..55bb2d0e67e5 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
@@ -798,6 +798,8 @@ mt7996_mcu_bss_he_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
 	struct tlv *tlv;
 
 	cap = mt76_connac_get_he_phy_cap(phy->mt76, vif);
+	if (!cap)
+		return;
 
 	tlv = mt7996_mcu_add_uni_tlv(skb, UNI_BSS_INFO_HE_BASIC, sizeof(*he));
 
-- 
2.25.1

Re: [PATCH v5] wifi: mt76: Fix NULL Dereference caused by mt76_connac_get_he_phy_cap()

[Markus Elfring]

> mt76_connac_get_he_phy_cap() may return a NULL pointer,
> leading to NULL Pointer Dereference.
…

             multiple questionable accesses?

How do you think about to use the term “null pointer dereference”
for the final commit message (including the summary phrase)?


Were any static source code analysis tools involved in the detection
of presented change possibilities?


…
> ---
>  drivers/net/wireless/mediatek/mt76/mt7915/mcu.c | 5 +++++
…

Did you overlook to add patch version descriptions behind the marker line?
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/Documentation/process/submitting-patches.rst?h=v6.12-rc1#n723

Regards,
Markus

Re: [PATCH v5] wifi: mt76: Fix NULL Dereference caused by mt76_connac_get_he_phy_cap()

[Matthias Brugger]

On 03/10/2024 20:09, Gax-c wrote:
> From: Zichen Xie <zichenxie0106@gmail.com>
> 
> mt76_connac_get_he_phy_cap() may return a NULL pointer,
> leading to NULL Pointer Dereference.
> Add a NULL check for the returned pointer.
> 
> Fixes: a5c372f77aa7 ("wifi: mt76: mt7925: extend mt7925_mcu_bss_he_tlv for per-link BSS")
> Fixes: e6d557a78b60 ("mt76: mt7915: rely on mt76_connac_get_phy utilities")
> Fixes: 98686cd21624 ("wifi: mt76: mt7996: add driver for MediaTek Wi-Fi 7 (802.11be) devices")
> Signed-off-by: Zichen Xie <zichenxie0106@gmail.com>
> ---
>   drivers/net/wireless/mediatek/mt76/mt7915/mcu.c | 5 +++++
>   drivers/net/wireless/mediatek/mt76/mt7925/mcu.c | 2 ++
>   drivers/net/wireless/mediatek/mt76/mt7996/mcu.c | 2 ++
>   3 files changed, 9 insertions(+)
> 
> diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c
> index 87d0dd040001..762be3a37228 100644
> --- a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c
> +++ b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c
> @@ -551,6 +551,8 @@ mt7915_mcu_bss_he_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
>   	struct tlv *tlv;
>   
>   	cap = mt76_connac_get_he_phy_cap(phy->mt76, vif);
> +	if (!cap)
> +		return;
>   
>   	tlv = mt76_connac_mcu_add_tlv(skb, BSS_INFO_HE_BASIC, sizeof(*he));
>   
> @@ -1145,6 +1147,9 @@ mt7915_mcu_sta_bfer_he(struct ieee80211_sta *sta, struct ieee80211_vif *vif,
>   	u8 nss_mcs = mt7915_mcu_get_sta_nss(mcs_map);
>   	u8 snd_dim, sts;
>   
> +	if (!vc)
> +		return;
> +

That will already blow up at line:
         const struct ieee80211_he_cap_elem *ve = &vc->he_cap_elem;

This needs some more code changes.

Regards,
Matthias

>   	bf->tx_mode = MT_PHY_TYPE_HE_SU;
>   
>   	mt7915_mcu_sta_sounding_rate(bf);
> diff --git a/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c
> index 748ea6adbc6b..55e4cda2f20f 100644
> --- a/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c
> +++ b/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c
> @@ -2508,6 +2508,8 @@ mt7925_mcu_bss_he_tlv(struct sk_buff *skb, struct ieee80211_bss_conf *link_conf,
>   	struct tlv *tlv;
>   
>   	cap = mt76_connac_get_he_phy_cap(phy->mt76, link_conf->vif);
> +	if (!cap)
> +		return;
>   
>   	tlv = mt76_connac_mcu_add_tlv(skb, UNI_BSS_INFO_HE_BASIC, sizeof(*he));
>   
> diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
> index 6c445a9dbc03..55bb2d0e67e5 100644
> --- a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
> +++ b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
> @@ -798,6 +798,8 @@ mt7996_mcu_bss_he_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
>   	struct tlv *tlv;
>   
>   	cap = mt76_connac_get_he_phy_cap(phy->mt76, vif);
> +	if (!cap)
> +		return;
>   
>   	tlv = mt7996_mcu_add_uni_tlv(skb, UNI_BSS_INFO_HE_BASIC, sizeof(*he));
>   

Re: [PATCH v5] wifi: mt76: Fix NULL Dereference caused by mt76_connac_get_he_phy_cap()

[Zichen Xie]

IMHO, using operator "&" for a NULL dereferenced pointer won't cause a
crash. 've' will only be assigned to a invalid address.

So we can put off the NULL check after
'const struct ieee80211_he_cap_elem *ve = &vc->he_cap_elem;'

Best Regards,
Zichen

On Mon, Oct 7, 2024 at 9:23 AM Matthias Brugger <matthias.bgg@gmail.com> wrote:
>
>
>
> On 03/10/2024 20:09, Gax-c wrote:
> > From: Zichen Xie <zichenxie0106@gmail.com>
> >
> > mt76_connac_get_he_phy_cap() may return a NULL pointer,
> > leading to NULL Pointer Dereference.
> > Add a NULL check for the returned pointer.
> >
> > Fixes: a5c372f77aa7 ("wifi: mt76: mt7925: extend mt7925_mcu_bss_he_tlv for per-link BSS")
> > Fixes: e6d557a78b60 ("mt76: mt7915: rely on mt76_connac_get_phy utilities")
> > Fixes: 98686cd21624 ("wifi: mt76: mt7996: add driver for MediaTek Wi-Fi 7 (802.11be) devices")
> > Signed-off-by: Zichen Xie <zichenxie0106@gmail.com>
> > ---
> >   drivers/net/wireless/mediatek/mt76/mt7915/mcu.c | 5 +++++
> >   drivers/net/wireless/mediatek/mt76/mt7925/mcu.c | 2 ++
> >   drivers/net/wireless/mediatek/mt76/mt7996/mcu.c | 2 ++
> >   3 files changed, 9 insertions(+)
> >
> > diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c
> > index 87d0dd040001..762be3a37228 100644
> > --- a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c
> > +++ b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c
> > @@ -551,6 +551,8 @@ mt7915_mcu_bss_he_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
> >       struct tlv *tlv;
> >
> >       cap = mt76_connac_get_he_phy_cap(phy->mt76, vif);
> > +     if (!cap)
> > +             return;
> >
> >       tlv = mt76_connac_mcu_add_tlv(skb, BSS_INFO_HE_BASIC, sizeof(*he));
> >
> > @@ -1145,6 +1147,9 @@ mt7915_mcu_sta_bfer_he(struct ieee80211_sta *sta, struct ieee80211_vif *vif,
> >       u8 nss_mcs = mt7915_mcu_get_sta_nss(mcs_map);
> >       u8 snd_dim, sts;
> >
> > +     if (!vc)
> > +             return;
> > +
>
> That will already blow up at line:
>          const struct ieee80211_he_cap_elem *ve = &vc->he_cap_elem;
>
> This needs some more code changes.
>
> Regards,
> Matthias
>
> >       bf->tx_mode = MT_PHY_TYPE_HE_SU;
> >
> >       mt7915_mcu_sta_sounding_rate(bf);
> > diff --git a/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c
> > index 748ea6adbc6b..55e4cda2f20f 100644
> > --- a/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c
> > +++ b/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c
> > @@ -2508,6 +2508,8 @@ mt7925_mcu_bss_he_tlv(struct sk_buff *skb, struct ieee80211_bss_conf *link_conf,
> >       struct tlv *tlv;
> >
> >       cap = mt76_connac_get_he_phy_cap(phy->mt76, link_conf->vif);
> > +     if (!cap)
> > +             return;
> >
> >       tlv = mt76_connac_mcu_add_tlv(skb, UNI_BSS_INFO_HE_BASIC, sizeof(*he));
> >
> > diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
> > index 6c445a9dbc03..55bb2d0e67e5 100644
> > --- a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
> > +++ b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
> > @@ -798,6 +798,8 @@ mt7996_mcu_bss_he_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
> >       struct tlv *tlv;
> >
> >       cap = mt76_connac_get_he_phy_cap(phy->mt76, vif);
> > +     if (!cap)
> > +             return;
> >
> >       tlv = mt7996_mcu_add_uni_tlv(skb, UNI_BSS_INFO_HE_BASIC, sizeof(*he));
> >

Re: [PATCH v5] wifi: mt76: Fix NULL Dereference caused by mt76_connac_get_he_phy_cap()

[Matthias Brugger]

On 07/10/2024 17:36, Zichen Xie wrote:
> IMHO, using operator "&" for a NULL dereferenced pointer won't cause a
> crash. 've' will only be assigned to a invalid address.
> 

Please don't top post.

> So we can put off the NULL check after
> 'const struct ieee80211_he_cap_elem *ve = &vc->he_cap_elem;'
> 

You are right, nevertheless for better code readability I'd still advise to 
change the code so that vc is checked for NULL before any use of struct vc.

Regards,
Matthias

> Best Regards,
> Zichen
> 
> On Mon, Oct 7, 2024 at 9:23 AM Matthias Brugger <matthias.bgg@gmail.com> wrote:
>>
>>
>>
>> On 03/10/2024 20:09, Gax-c wrote:
>>> From: Zichen Xie <zichenxie0106@gmail.com>
>>>
>>> mt76_connac_get_he_phy_cap() may return a NULL pointer,
>>> leading to NULL Pointer Dereference.
>>> Add a NULL check for the returned pointer.
>>>
>>> Fixes: a5c372f77aa7 ("wifi: mt76: mt7925: extend mt7925_mcu_bss_he_tlv for per-link BSS")
>>> Fixes: e6d557a78b60 ("mt76: mt7915: rely on mt76_connac_get_phy utilities")
>>> Fixes: 98686cd21624 ("wifi: mt76: mt7996: add driver for MediaTek Wi-Fi 7 (802.11be) devices")
>>> Signed-off-by: Zichen Xie <zichenxie0106@gmail.com>
>>> ---
>>>    drivers/net/wireless/mediatek/mt76/mt7915/mcu.c | 5 +++++
>>>    drivers/net/wireless/mediatek/mt76/mt7925/mcu.c | 2 ++
>>>    drivers/net/wireless/mediatek/mt76/mt7996/mcu.c | 2 ++
>>>    3 files changed, 9 insertions(+)
>>>
>>> diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c
>>> index 87d0dd040001..762be3a37228 100644
>>> --- a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c
>>> +++ b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c
>>> @@ -551,6 +551,8 @@ mt7915_mcu_bss_he_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
>>>        struct tlv *tlv;
>>>
>>>        cap = mt76_connac_get_he_phy_cap(phy->mt76, vif);
>>> +     if (!cap)
>>> +             return;
>>>
>>>        tlv = mt76_connac_mcu_add_tlv(skb, BSS_INFO_HE_BASIC, sizeof(*he));
>>>
>>> @@ -1145,6 +1147,9 @@ mt7915_mcu_sta_bfer_he(struct ieee80211_sta *sta, struct ieee80211_vif *vif,
>>>        u8 nss_mcs = mt7915_mcu_get_sta_nss(mcs_map);
>>>        u8 snd_dim, sts;
>>>
>>> +     if (!vc)
>>> +             return;
>>> +
>>
>> That will already blow up at line:
>>           const struct ieee80211_he_cap_elem *ve = &vc->he_cap_elem;
>>
>> This needs some more code changes.
>>
>> Regards,
>> Matthias
>>
>>>        bf->tx_mode = MT_PHY_TYPE_HE_SU;
>>>
>>>        mt7915_mcu_sta_sounding_rate(bf);
>>> diff --git a/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c
>>> index 748ea6adbc6b..55e4cda2f20f 100644
>>> --- a/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c
>>> +++ b/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c
>>> @@ -2508,6 +2508,8 @@ mt7925_mcu_bss_he_tlv(struct sk_buff *skb, struct ieee80211_bss_conf *link_conf,
>>>        struct tlv *tlv;
>>>
>>>        cap = mt76_connac_get_he_phy_cap(phy->mt76, link_conf->vif);
>>> +     if (!cap)
>>> +             return;
>>>
>>>        tlv = mt76_connac_mcu_add_tlv(skb, UNI_BSS_INFO_HE_BASIC, sizeof(*he));
>>>
>>> diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
>>> index 6c445a9dbc03..55bb2d0e67e5 100644
>>> --- a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
>>> +++ b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
>>> @@ -798,6 +798,8 @@ mt7996_mcu_bss_he_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
>>>        struct tlv *tlv;
>>>
>>>        cap = mt76_connac_get_he_phy_cap(phy->mt76, vif);
>>> +     if (!cap)
>>> +             return;
>>>
>>>        tlv = mt7996_mcu_add_uni_tlv(skb, UNI_BSS_INFO_HE_BASIC, sizeof(*he));
>>>

Re: [PATCH v5] wifi: mt76: Fix NULL Dereference caused by mt76_connac_get_he_phy_cap()

[Zichen Xie]

On 2024/10/7 14:13, Matthias Brugger wrote:
>
>
> On 07/10/2024 17:36, Zichen Xie wrote:
>> IMHO, using operator "&" for a NULL dereferenced pointer won't cause a
>> crash. 've' will only be assigned to a invalid address.
>>
>
> Please don't top post.
>
>> So we can put off the NULL check after
>> 'const struct ieee80211_he_cap_elem *ve = &vc->he_cap_elem;'
>>
>
> You are right, nevertheless for better code readability I'd still 
> advise to change the code so that vc is checked for NULL before any 
> use of struct vc.

The code snippets here does the same thing like me.

https://elixir.bootlin.com/linux/v6.12-rc2/source/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c#L1547

Should I also repair it for readability?


>
> Regards,
> Matthias
>
>> Best Regards,
>> Zichen
>>
>> On Mon, Oct 7, 2024 at 9:23 AM Matthias Brugger 
>> <matthias.bgg@gmail.com> wrote:
>>>
>>>
>>>
>>> On 03/10/2024 20:09, Gax-c wrote:
>>>> From: Zichen Xie <zichenxie0106@gmail.com>
>>>>
>>>> mt76_connac_get_he_phy_cap() may return a NULL pointer,
>>>> leading to NULL Pointer Dereference.
>>>> Add a NULL check for the returned pointer.
>>>>
>>>> Fixes: a5c372f77aa7 ("wifi: mt76: mt7925: extend 
>>>> mt7925_mcu_bss_he_tlv for per-link BSS")
>>>> Fixes: e6d557a78b60 ("mt76: mt7915: rely on mt76_connac_get_phy 
>>>> utilities")
>>>> Fixes: 98686cd21624 ("wifi: mt76: mt7996: add driver for MediaTek 
>>>> Wi-Fi 7 (802.11be) devices")
>>>> Signed-off-by: Zichen Xie <zichenxie0106@gmail.com>
>>>> ---
>>>>    drivers/net/wireless/mediatek/mt76/mt7915/mcu.c | 5 +++++
>>>>    drivers/net/wireless/mediatek/mt76/mt7925/mcu.c | 2 ++
>>>>    drivers/net/wireless/mediatek/mt76/mt7996/mcu.c | 2 ++
>>>>    3 files changed, 9 insertions(+)
>>>>
>>>> diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c 
>>>> b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c
>>>> index 87d0dd040001..762be3a37228 100644
>>>> --- a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c
>>>> +++ b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c
>>>> @@ -551,6 +551,8 @@ mt7915_mcu_bss_he_tlv(struct sk_buff *skb, 
>>>> struct ieee80211_vif *vif,
>>>>        struct tlv *tlv;
>>>>
>>>>        cap = mt76_connac_get_he_phy_cap(phy->mt76, vif);
>>>> +     if (!cap)
>>>> +             return;
>>>>
>>>>        tlv = mt76_connac_mcu_add_tlv(skb, BSS_INFO_HE_BASIC, 
>>>> sizeof(*he));
>>>>
>>>> @@ -1145,6 +1147,9 @@ mt7915_mcu_sta_bfer_he(struct ieee80211_sta 
>>>> *sta, struct ieee80211_vif *vif,
>>>>        u8 nss_mcs = mt7915_mcu_get_sta_nss(mcs_map);
>>>>        u8 snd_dim, sts;
>>>>
>>>> +     if (!vc)
>>>> +             return;
>>>> +
>>>
>>> That will already blow up at line:
>>>           const struct ieee80211_he_cap_elem *ve = &vc->he_cap_elem;
>>>
>>> This needs some more code changes.
>>>
>>> Regards,
>>> Matthias
>>>
>>>>        bf->tx_mode = MT_PHY_TYPE_HE_SU;
>>>>
>>>>        mt7915_mcu_sta_sounding_rate(bf);
>>>> diff --git a/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c 
>>>> b/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c
>>>> index 748ea6adbc6b..55e4cda2f20f 100644
>>>> --- a/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c
>>>> +++ b/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c
>>>> @@ -2508,6 +2508,8 @@ mt7925_mcu_bss_he_tlv(struct sk_buff *skb, 
>>>> struct ieee80211_bss_conf *link_conf,
>>>>        struct tlv *tlv;
>>>>
>>>>        cap = mt76_connac_get_he_phy_cap(phy->mt76, link_conf->vif);
>>>> +     if (!cap)
>>>> +             return;
>>>>
>>>>        tlv = mt76_connac_mcu_add_tlv(skb, UNI_BSS_INFO_HE_BASIC, 
>>>> sizeof(*he));
>>>>
>>>> diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c 
>>>> b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
>>>> index 6c445a9dbc03..55bb2d0e67e5 100644
>>>> --- a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
>>>> +++ b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
>>>> @@ -798,6 +798,8 @@ mt7996_mcu_bss_he_tlv(struct sk_buff *skb, 
>>>> struct ieee80211_vif *vif,
>>>>        struct tlv *tlv;
>>>>
>>>>        cap = mt76_connac_get_he_phy_cap(phy->mt76, vif);
>>>> +     if (!cap)
>>>> +             return;
>>>>
>>>>        tlv = mt7996_mcu_add_uni_tlv(skb, UNI_BSS_INFO_HE_BASIC, 
>>>> sizeof(*he));
>>>>