From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-dy1-f174.google.com (mail-dy1-f174.google.com [74.125.82.174]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A6111318EDD for ; Fri, 16 Jan 2026 01:05:33 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=74.125.82.174 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768525542; cv=none; b=Ka4JltWBNfAyHDpAlSWa6mSiFUXTR3sCiu9/xYErRD+jAU/P2IRKHS2RmggS5hVEC9vv0d7QcLXrqedxTfncRbEEWbVGIfDJ9AwJ7EYfAzQIWOKfaQ+jVAD1rBCwnhMSFT5xjPXK5gghz1O2W4NxAzqvq2mYpRDVbw33qcPkf2M= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768525542; c=relaxed/simple; bh=bTIw3jO9OrGp1Jt+Zshd1N+f6Fcp97wlvVOjLk0G0yM=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=sQXtnpXYWb/EazHn3rrH5+Rk2/eR6ZzurPG4QI0Mcj4Il24jGjKlT20GHo+auclY4CTea56Xo0Z4I9Yb3fxQGd8jltfwkX+iJ4FFuvG5yImoCBPyFCceRDvXldALp6C7rzvvIUNhvNzuTFkrMD7LdS5f0gfX6LA1Odfh6WFdxHc= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=zacbowling.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=Mk5HIebQ; arc=none smtp.client-ip=74.125.82.174 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=zacbowling.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="Mk5HIebQ" Received: by mail-dy1-f174.google.com with SMTP id 5a478bee46e88-2b6ae4c2012so847259eec.0 for ; Thu, 15 Jan 2026 17:05:33 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1768525531; x=1769130331; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:sender:from:to:cc:subject:date :message-id:reply-to; bh=FyvHxTD9jYvJ1aFDphS8iH5fAIcPW7RDWbIxYHLNdZg=; b=Mk5HIebQ1Sbc/KZAZV+5cA+izf6L6MG6b7DzbrZP/2v3ymefRE6KMHz4m6nWCZ7FbA 7HMo7u+3RUQjEc4SW6IVKvBEkRnWoAV8ETIzoaTMJXasWAUogcEo8Y57XyVomwk3PipB QmAzL3IcpzyhVJQE0pvXE8z1ENeUAf65aQ1Kx/+SZ1b/LSn+5VD0m8CiYItOU/xI0kmG t/Dn3uNim6wRBwZHKjpEYsqkuTw1YgN7SxN+XQn7Pu0Q3ZGJeLVtCdluHjgEhoiWK+RN T+On2SzOp3tSB+Hy5svYHmava1AS8ebdSIxEwv49+GcCEI+U9bFUtGcee+bNKkw8k7DQ bKkQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1768525531; x=1769130331; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:sender:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=FyvHxTD9jYvJ1aFDphS8iH5fAIcPW7RDWbIxYHLNdZg=; b=tDxhDRiUMN6HG0gAIJ8m0K1E7l9rNSDEaE40dVuH58s8qNiwrVCEoAuZVEDLjqMqrg zYjmOqTa2chaac5GGSKwOs2+R1VK4Ii4gBrunukGvYGoRDbJtZpLwMXNt+OnKF6wB8K6 cqGFJ+lc45tKtbso8oCwX9TfVQgHqBKKYkNpP+7lBGEgdFANpEUzR5VLgdTWVyWPMsDs oKYNvNhMrF/2lNGTiABTVgOdYJUwbEnogn62fWPaYAlkMLiJ7KqPkP5lTo5a8nPPS3O2 9G/6gwdOFfUrhid+Q4C1PGsEqzK5N1caFlm4B7qcfEPHFHBrIBdB/mDOXCpatVHVHgHI 862g== X-Forwarded-Encrypted: i=1; AJvYcCW1BLoy+4/NjzgXRzrKkYEd8IuG6WJW1c99vHMrCaKgJEEve/3cm0MOggdu59Nzglvh48gzGAWWvJL15jo=@vger.kernel.org X-Gm-Message-State: AOJu0Yzg5C4DDDUARBZKRwnOAlGFnCPkaB8p+LFTVTMZV0GO/xpWc4cU gbLI8QSBcyN9Ztp+gd0nkBy+hhftVqynC14V+j9ufP0wpDS+Igt1A8sn X-Gm-Gg: AY/fxX4O5gqa6u5aIKSdnaV+3UR6R6jD15ebZDZnXmoydLVuBUbBPx8bO5XGKnoKQPv cI8N7hT70N3NPl21bQ4t9c2zxzPyDVIT3hr/nHgvlkbrN9VUVD+0DCrfoDQ/sUW4tjD6REeXzTj DDrwUc4L7YXoQSHqEBH4qAS7UGJBeJ+djkU9dVzb8h3RIFjWTYJ109YmznuT4qv1n+ZSPwhuX8f NPbxwwJj2YIE40f00rl6bgj53EFR/DsxwK5LrGcP1ge+2w6AcwZZc0z2V9chnK8b7reqXiCxDMz ajLLqnfYYjhXUi2RHitwJG1ynwSgCBCE/ef9/G/9lacZ9cUTQJiJHy4g0Ke1Psra9btCGn6G4rB Ptn20wWKrstt/34anqxRNXA2iu5Du9RigkuKAgmW1lRvGa5/0SKzgD5Daoj7BTTB1Qp0+wE9bp1 lltNjlUN1fHIyUBOMWFk49JYIqMiUpiDBfxvbhl4w9UUkn/Lbwo/MWKHbgs5c0UA== X-Received: by 2002:a05:7301:3f07:b0:2ae:60f7:7f42 with SMTP id 5a478bee46e88-2b6b3f05f0fmr774432eec.11.1768525529188; Thu, 15 Jan 2026 17:05:29 -0800 (PST) Received: from zcache.home.zacbowling.com ([2001:5a8:60d:bc9:f1d2:502c:a6ff:5556]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-2b6b367cbc9sm1019884eec.32.2026.01.15.17.05.27 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 15 Jan 2026 17:05:28 -0800 (PST) Sender: Zac Bowling From: Zac To: sean.wang@kernel.org Cc: deren.wu@mediatek.com, kvalo@kernel.org, linux-kernel@vger.kernel.org, linux-mediatek@lists.infradead.org, linux-wireless@vger.kernel.org, lorenzo@kernel.org, nbd@nbd.name, linux@frame.work, ryder.lee@mediatek.com, sean.wang@mediatek.com, Zac Bowling , Zac Bowling Subject: [PATCH v4 04/21] wifi: mt76: mt7925: add NULL checks in MCU STA TLV functions Date: Thu, 15 Jan 2026 17:05:02 -0800 Message-ID: <20260116010519.37001-5-zac@zacbowling.com> X-Mailer: git-send-email 2.52.0 In-Reply-To: <20260116010519.37001-1-zac@zacbowling.com> References: <20260116010519.37001-1-zac@zacbowling.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit From: Zac Bowling Add NULL pointer checks for link_conf and mconf in: - mt7925_mcu_sta_phy_tlv(): builds PHY capability TLV for station record - mt7925_mcu_sta_rate_ctrl_tlv(): builds rate control TLV for station record Both functions call mt792x_vif_to_bss_conf() and mt792x_vif_to_link() which can return NULL during MLO link state transitions when the link configuration in mac80211 is not yet synchronized with the driver's link tracking. Without these checks, the driver will crash with a NULL pointer dereference when accessing link_conf->chanreq.oper or link_conf->basic_rates. Found through static analysis (clang-tidy pattern matching for unchecked return values from functions known to return NULL). Reported-by: Zac Bowling Fixes: c948b5da6bbe ("wifi: mt76: mt7925: add Mediatek Wi-Fi7 driver for mt7925 chips") Signed-off-by: Zac Bowling --- drivers/net/wireless/mediatek/mt76/mt7925/mcu.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c index cf0fdea45c..d61a7fbda7 100644 --- a/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c +++ b/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c @@ -1773,6 +1773,10 @@ mt7925_mcu_sta_phy_tlv(struct sk_buff *skb, link_conf = mt792x_vif_to_bss_conf(vif, link_sta->link_id); mconf = mt792x_vif_to_link(mvif, link_sta->link_id); + + if (!link_conf || !mconf) + return; + chandef = mconf->mt76.ctx ? &mconf->mt76.ctx->def : &link_conf->chanreq.oper; @@ -1851,6 +1855,10 @@ mt7925_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, link_conf = mt792x_vif_to_bss_conf(vif, link_sta->link_id); mconf = mt792x_vif_to_link(mvif, link_sta->link_id); + + if (!link_conf || !mconf) + return; + chandef = mconf->mt76.ctx ? &mconf->mt76.ctx->def : &link_conf->chanreq.oper; band = chandef->chan->band; -- 2.52.0