From: Sean Wang <sean.wang@kernel.org>
To: nbd@nbd.name, lorenzo.bianconi@redhat.com
Cc: linux-wireless@vger.kernel.org,
linux-mediatek@lists.infradead.org,
Sean Wang <sean.wang@mediatek.com>
Subject: [PATCH 08/19] wifi: mt76: mt7925: validate mlink in sta_hdr_trans_tlv()
Date: Fri, 6 Mar 2026 17:22:27 -0600 [thread overview]
Message-ID: <20260306232238.2039675-9-sean.wang@kernel.org> (raw)
In-Reply-To: <20260306232238.2039675-1-sean.wang@kernel.org>
From: Sean Wang <sean.wang@mediatek.com>
Replace the dead wcid NULL check in mt7925_mcu_sta_hdr_trans_tlv() with
a WARN_ON_ONCE() guard on mlink before dereferencing mlink->wcid.
wcid is always derived from mlink, so mlink is the only meaningful
object to validate here.
Signed-off-by: Sean Wang <sean.wang@mediatek.com>
---
drivers/net/wireless/mediatek/mt76/mt7925/mcu.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c
index c474dd358650..03515b891643 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c
@@ -1082,11 +1082,11 @@ mt7925_mcu_sta_hdr_trans_tlv(struct sk_buff *skb,
else
hdr_trans->from_ds = true;
- wcid = &mlink->wcid;
-
- if (!wcid)
+ if (WARN_ON_ONCE(!mlink))
return;
+ wcid = &mlink->wcid;
+
hdr_trans->dis_rx_hdr_tran = !test_bit(MT_WCID_FLAG_HDR_TRANS, &wcid->flags);
if (test_bit(MT_WCID_FLAG_4ADDR, &wcid->flags)) {
hdr_trans->to_ds = true;
--
2.43.0
next prev parent reply other threads:[~2026-03-06 23:23 UTC|newest]
Thread overview: 22+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-03-06 23:22 [PATCH 00/19] wifi: mt76: mt7925: fix up MLO link lifetime and error handling Sean Wang
2026-03-06 23:22 ` [PATCH 01/19] wifi: mt76: mt7925: pass mlink to sta_amsdu_tlv() Sean Wang
2026-03-06 23:22 ` [PATCH 02/19] wifi: mt76: mt7925: pass WCID indices to bss_basic_tlv() Sean Wang
2026-03-07 13:45 ` kernel test robot
2026-03-07 17:59 ` kernel test robot
2026-03-06 23:22 ` [PATCH 03/19] wifi: mt76: mt7925: pass mlink and mconf to sta_mld_tlv() Sean Wang
2026-03-06 23:22 ` [PATCH 04/19] wifi: mt76: mt7925: pass mlink to mcu_sta_update() Sean Wang
2026-03-06 23:22 ` [PATCH 05/19] wifi: mt76: mt7925: resolve primary mlink via def_wcid Sean Wang
2026-03-06 23:22 ` [PATCH 06/19] wifi: mt76: mt7925: pass mlink to mac_link_sta_remove() Sean Wang
2026-03-06 23:22 ` [PATCH 07/19] wifi: mt76: mt7925: pass mlink to sta_hdr_trans_tlv() Sean Wang
2026-03-06 23:22 ` Sean Wang [this message]
2026-03-06 23:22 ` [PATCH 09/19] wifi: mt76: mt7925: pass mlink to wtbl_update_hdr_trans() Sean Wang
2026-03-06 23:22 ` [PATCH 10/19] wifi: mt76: mt7925: pass mlink to set_link_key() Sean Wang
2026-03-06 23:22 ` [PATCH 11/19] wifi: mt76: mt7925: resolve link after acquiring mt76 mutex Sean Wang
2026-03-06 23:22 ` [PATCH 12/19] wifi: mt76: mt7925: pass mconf and mlink to wtbl_update_hdr_trans() Sean Wang
2026-03-06 23:22 ` [PATCH 13/19] wifi: mt76: mt7925: make WCID cleanup unconditional in sta_remove_links() Sean Wang
2026-03-06 23:22 ` [PATCH 14/19] wifi: mt76: mt7925: unwind WCID setup on link STA add failure Sean Wang
2026-03-06 23:22 ` [PATCH 15/19] wifi: mt76: mt7925: drop WCID reinit after publish Sean Wang
2026-03-06 23:22 ` [PATCH 16/19] wifi: mt76: mt7925: move WCID teardown into link_sta_remove() Sean Wang
2026-03-06 23:22 ` [PATCH 17/19] wifi: mt76: mt7925: switch link STA allocation to RCU lifetime Sean Wang
2026-03-06 23:22 ` [PATCH 18/19] wifi: mt76: mt7925: publish msta->link after successful link add Sean Wang
2026-03-06 23:22 ` [PATCH 19/19] wifi: mt76: mt7925: host-only unwind published links on add failure Sean Wang
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260306232238.2039675-9-sean.wang@kernel.org \
--to=sean.wang@kernel.org \
--cc=linux-mediatek@lists.infradead.org \
--cc=linux-wireless@vger.kernel.org \
--cc=lorenzo.bianconi@redhat.com \
--cc=nbd@nbd.name \
--cc=sean.wang@mediatek.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox