gitops/mt76
1
0
Fork 0
mirror of https://github.com/outbackdingo/mt76.git synced 2026-10-24 13:26:48 +00:00
Code Issues Packages Projects Releases Wiki Activity

wifi: mt76: mt7996: fix possible NULL pointer dereference in mt7996_mac_write_txwi()

Browse Source 
Fix possible NULL pointer dereference on mvif pointer in
mt7996_mac_write_txwi routine.

Fixes: 15ee62e73705 ("wifi: mt76: mt7996: enable BSS_CHANGED_BASIC_RATES support")
Signed-off-by: Lorenzo Bianconi <[email protected]>
Reviewed-by: Simon Horman <[email protected]>
Signed-off-by: Kalle Valo <[email protected]>
Link: https://lore.kernel.org/r/2637628a84f42ad6d7b774e706f041d5b45c8cb5.1685269638.git.lorenzo@kernel.org
This commit is contained in:
Lorenzo Bianconi
2023-06-22 17:48:56 +02:00
committed by Felix Fietkau
parent 540adbb382
commit 150e2d0ffc
1 changed files with 12 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
mt7996/mac.c
+12 -7
View File
@@ -1003,7 +1003,7 @@ void mt7996_mac_write_txwi(struct mt7996_dev *dev, __le32 *txwi,
{
struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
struct ieee80211_vif *vif = info->control.vif;
struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
struct mt7996_vif *mvif;
struct mt76_phy *mphy = &dev->mphy;
u8 band_idx = (info->hw_queue & MT_TX_HW_QUEUE_PHY) >> 2;
u8 p_fmt, q_idx, omac_idx = 0, wmm_idx = 0;
@@ -1015,7 +1015,8 @@ void mt7996_mac_write_txwi(struct mt7996_dev *dev, __le32 *txwi,
bool inband_disc = !!(changed & (BSS_CHANGED_UNSOL_BCAST_PROBE_RESP |
BSS_CHANGED_FILS_DISCOVERY));
if (vif) {
mvif = vif ? (struct mt7996_vif *)vif->drv_priv : NULL;
if (mvif) {
omac_idx = mvif->mt76.omac_idx;
wmm_idx = mvif->mt76.wmm_idx;
band_idx = mvif->mt76.band_idx;
@@ -1083,12 +1084,16 @@ void mt7996_mac_write_txwi(struct mt7996_dev *dev, __le32 *txwi,
struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
bool mcast = ieee80211_is_data(hdr->frame_control) &&
is_multicast_ether_addr(hdr->addr1);
u8 idx = mvif->basic_rates_idx;
u8 idx = MT7996_BASIC_RATES_TBL;
if (mcast && mvif->mcast_rates_idx)
idx = mvif->mcast_rates_idx;
else if (beacon && mvif->beacon_rates_idx)
idx = mvif->beacon_rates_idx;
if (mvif) {
if (mcast && mvif->mcast_rates_idx)
idx = mvif->mcast_rates_idx;
else if (beacon && mvif->beacon_rates_idx)
idx = mvif->beacon_rates_idx;
else
idx = mvif->basic_rates_idx;
}
txwi[6] |= FIELD_PREP(MT_TXD6_TX_RATE, idx);
txwi[3] |= cpu_to_le32(MT_TXD3_BA_DISABLE);