[PATCH] wifi: mt76: mt792x: fix NULL pointer dereference in mt792x_init_acpi_sar_power

[PATCH] wifi: mt76: mt792x: fix NULL pointer dereference in mt792x_init_acpi_sar_power

[Marco Scardovi]

In mt792x_init_acpi_sar_power(), capa is obtained from
phy->mt76->hw->wiphy->sar_capa. On systems where ACPI SAR tables exist
(such as ASUS ROG laptops) but wiphy->sar_capa has not yet been
initialized (for instance, when a regulatory notifier triggers
mt7921_set_tx_sar_pwr() before the asynchronous dev->init_work
completes mt76_register_device()), capa is NULL.

Attempting to read capa->num_freq_ranges leads to a NULL pointer
dereference at offset 0x04:

  BUG: kernel NULL pointer dereference, address: 0000000000000004
  RIP: 0010:mt792x_init_acpi_sar_power+0x40/0x1ef [mt792x_lib]
  Call Trace:
   <TASK>
   mt792x_init_acpi_sar_power+0x40/0x1ef [mt792x_lib]
   mt7921_set_tx_sar_pwr+0x3b/0x70 [mt7921_common]
   mt7921_regd_notifier_work+0x1b/0x30 [mt7921_common]
   ...

Add a check for !capa and !phy->mt76->frp before dereferencing,
matching the existing defensive pattern in mt76/mac80211.c.

Fixes: f965333e491e ("mt76: mt7921: introduce ACPI SAR support")
Signed-off-by: Marco Scardovi <scardracs@disroot.org>
---
 drivers/net/wireless/mediatek/mt76/mt792x_acpi_sar.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/net/wireless/mediatek/mt76/mt792x_acpi_sar.c b/drivers/net/wireless/mediatek/mt76/mt792x_acpi_sar.c
index 946dd7956e4a..fbc2f9706dd4 100644
--- a/drivers/net/wireless/mediatek/mt76/mt792x_acpi_sar.c
+++ b/drivers/net/wireless/mediatek/mt76/mt792x_acpi_sar.c
@@ -326,6 +326,9 @@ int mt792x_init_acpi_sar_power(struct mt792x_phy *phy, bool set_default)
 	if (!phy->acpisar || !((struct mt792x_acpi_sar *)phy->acpisar)->dyn)
 		return 0;
 
+	if (!capa || !phy->mt76->frp)
+		return 0;
+
 	/* When ACPI SAR enabled in HW, we should apply rules for .frp
 	 * 1. w/o .sar_specs : set ACPI SAR power as the defatul value
 	 * 2. w/  .sar_specs : set power with min(.sar_specs, ACPI_SAR)
-- 
2.55.0

Re: [PATCH] wifi: mt76: mt792x: fix NULL pointer dereference in mt792x_init_acpi_sar_power

[Devin Wittmayer]

On Fri, 4 Sep 2026 18:18:26 +0200, Marco Scardovi wrote:
> Fixes: f965333e491e ("mt76: mt7921: introduce ACPI SAR support")

There is a patch for this from 25 August:

  https://lore.kernel.org/linux-wireless/20260825181712.28548-1-lucid_duck@justthetip.ca/

Klara Modin reported it, David Gow confirmed the fix on a Framework 13.

One note on the Fixes tag. The crash needs a regulatory update to run
before registration, and that only started with these:

  9b80bd9cab40  2026-06-09  mt7921 regulatory wiphy self manager
  e9f3f1cc133f  2026-06-09  mt7925 regulatory wiphy self manager

Before those it just set flags, so the 2022 commit would reach stable
kernels that never had the bug.

Your trace enters through the regulatory notifier, mine through
firmware init. I could not find mt7921_regd_notifier_work in mt76
here, so if you have a second trigger I would like to see it.

Thanks for taking this one on.

Devin

Re: [PATCH] wifi: mt76: mt792x: fix NULL pointer dereference in mt792x_init_acpi_sar_power

[Marco Scardovi]

In data sabato 5 settembre 2026 01:48:38 Ora legale dell’Europa centrale, 
Devin Wittmayer ha scritto:
> On Fri, 4 Sep 2026 18:18:26 +0200, Marco Scardovi wrote:
> > Fixes: f965333e491e ("mt76: mt7921: introduce ACPI SAR support")
> 
> There is a patch for this from 25 August:
> 
>  
> https://lore.kernel.org/linux-wireless/20260825181712.28548-1-lucid_duck@ju
> stthetip.ca/
> 
> Klara Modin reported it, David Gow confirmed the fix on a Framework 13.
> 
Hi Devin,

sorry, I didn't notice that a thread was already opened so I supposed no
one reported it at all.
> One note on the Fixes tag. The crash needs a regulatory update to run
> before registration, and that only started with these:
> 
>   9b80bd9cab40  2026-06-09  mt7921 regulatory wiphy self manager
>   e9f3f1cc133f  2026-06-09  mt7925 regulatory wiphy self manager
> 
> Before those it just set flags, so the 2022 commit would reach stable
> kernels that never had the bug.
> 
You are right on that, I'll pay more attention next time
> Your trace enters through the regulatory notifier, mine through
> firmware init. I could not find mt7921_regd_notifier_work in mt76
> here, so if you have a second trigger I would like to see it.
> 
The whole patch is as you see it but: I didn't add anything more.
Tbh I was working on a whole different sub but the OS refused to start
because of this one so I came up with the absolute minimum patch to
make it working
> Thanks for taking this one on.
> 
> Devin
At this point you can count this patch as void. Thank you for your time,
Marco