[stable backport request] wifi: mt76: mt7921/mt7925: fix NULL dereference in CSA beacon

[stable backport request] wifi: mt76: mt7921/mt7925: fix NULL dereference in CSA beacon

[Ismail Tarim]

Hi,

Please consider backporting the following mainline commit to the stable
trees:

  commit 351dd7d2c80d ("wifi: mt76: mt7921/mt7925: fix NULL dereference in CSA beacon")

The commit carries a Fixes: tag but was not marked Cc: stable, so it has
not been picked up for the stable trees automatically. The tip of
linux-7.1.y still lacks it.

Why it should be applied:

It fixes a NULL pointer dereference in mt7921_channel_switch_rx_beacon()
(and the identical mt7925 path). When an AP sends a Channel Switch
Announcement (CSA) beacon, cfg80211 queues a wiphy work item that later
calls the driver's channel_switch_rx_beacon(); if the station
disconnects or the channel context is torn down in between,
dev->new_ctx has already been cleared to NULL and is then dereferenced
unconditionally. This is triggered by ordinary AP behaviour (channel
switch / DFS), so it is easy to hit in the field, and it hangs the
machine: the crash happens in a workqueue worker that exits with IRQs
disabled, wedging the cfg80211 workqueue and progressively locking up
userspace until a hard reboot. It affects the very common MT7921 /
MT7922 / MT7902 chipsets.

Reproduced on linux-7.1.y (Arch Linux 7.1.3-arch1-1), MT7902
[14c3:7902] driven by mt7921e:

  BUG: kernel NULL pointer dereference, address: 0000000000000000
  RIP: 0010:mt7921_channel_switch_rx_beacon+0x18/0xa0 [mt7921_common]
  Call Trace:
   ieee80211_sta_process_chanswitch+0x682/0xc30 [mac80211]
   ieee80211_rx_mgmt_beacon+0x7ec/0x19c0 [mac80211]
   ieee80211_iface_work+0x4c4/0x630 [mac80211]
   cfg80211_wiphy_work+0x13f/0x1e0 [cfg80211]
   process_one_work+0x19f/0x390
   worker_thread+0x1b1/0x310
   kthread+0xe4/0x120
  note: kworker/u64:15 exited with irqs disabled

The offending code was introduced by
  8aa2f59260eb ("wifi: mt76: mt7921: introduce CSA support")

Please apply 351dd7d2c80d to linux-7.1.y and any other supported stable
tree that contains 8aa2f59260eb.

Thanks,
Ismail Tarim