[PATCH] wifi: mt76: mt7996: fix NULL pointer dereference in MLD AP recovery

[PATCH] wifi: mt76: mt7996: fix NULL pointer dereference in MLD AP recovery

[Jose Ignacio Tornos Martinez]

During full hardware reset, mt7996_mac_reset_vif_iter() frees non-default
VIF links and mt76_reset_device() clears all WCID entries, but
mvif->valid_links is not cleared.

When ieee80211_reconfig() runs after recovery, it calls
mt76_assign_vif_chanctx() which invokes mt7996_vif_link_add(). Since
valid_links still has the stale bits set, vif_link_add() takes the early
return path and skips WCID initialization (mlink->wcid assignment and
rcu_assign_pointer to the global WCID table). Later,
ieee80211_reconfig_ap_links() calls mt7996_link_info_changed() which
invokes mt7996_mcu_add_sta() with link->mt76.wcid == NULL, causing
a NULL pointer dereference:

  BUG: kernel NULL pointer dereference, address: 00000000000000b8
  RIP: 0010:mt7996_mcu_add_sta+0x2fd/0x630 [mt7996e]
  Call Trace:
   mt7996_link_info_changed+0x105/0x3f0 [mt7996e]
   ieee80211_reconfig_ap_links+0x107/0x1d0 [mac80211]
   ieee80211_reconfig+0x104a/0x1270 [mac80211]
   ieee80211_restart_work+0xf2/0x140 [mac80211]

Fix this by clearing valid_links and resetting deflink_id in
mt7996_mac_reset_vif_iter() so that vif_link_add() takes the full
initialization path during recovery. Also clear the per-device MLD
index masks (mld_idx_mask, mld_remap_idx_mask) in mt7996_mac_full_reset()
to prevent index leaks across resets.

Signed-off-by: Jose Ignacio Tornos Martinez <jtornosm@redhat.com>
---
Note: I will have limited availability from mid-August to
mid-September. I will address any review feedback before then
or promptly after returning.

 drivers/net/wireless/mediatek/mt76/mt7996/mac.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mac.c b/drivers/net/wireless/mediatek/mt76/mt7996/mac.c
index 0eebc8182ca9..463bec7ad732 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7996/mac.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7996/mac.c
@@ -2384,6 +2384,9 @@ mt7996_mac_reset_vif_iter(void *data, u8 *mac, struct ieee80211_vif *vif)
 		kfree_rcu(mlink, rcu_head);
 	}
 	rcu_read_unlock();
+
+	mvif->valid_links = 0;
+	mvif->deflink_id = IEEE80211_LINK_UNSPECIFIED;
 }
 
 static void
@@ -2423,6 +2426,9 @@ mt7996_mac_full_reset(struct mt7996_dev *dev)
 						   mt7996_mac_reset_vif_iter, dev);
 	mt76_reset_device(&dev->mt76);
 
+	dev->mld_idx_mask = 0;
+	dev->mld_remap_idx_mask = 0;
+
 	INIT_LIST_HEAD(&dev->sta_rc_list);
 	INIT_LIST_HEAD(&dev->twt_list);
 
-- 
2.54.0

Re: [PATCH] wifi: mt76: mt7996: fix NULL pointer dereference in MLD AP recovery

[Jose Ignacio Tornos Martinez]

Hi Felix,

Friendly ping on this patch. It fixes a NULL pointer dereference during
MLD AP recovery caused by stale valid_links after full hardware reset.

Any further comments, or anything I can do to move forward?

Thanks

Best regards
José Ignacio