gitops/mt76
1
0
Fork 0
mirror of https://github.com/outbackdingo/mt76.git synced 2026-10-24 13:26:48 +00:00
Code Issues Packages Projects Releases Wiki Activity

wifi: mt76: mt7925: guard BSS capability lookups

Browse Source 
mt7925 BSS setup may dereference missing channel data or query HE 6 GHz
capabilities for an iftype without HE support.

Guard both lookups before adding NAN paths that can use partially
configured BSS state.

Co-developed-by: Stella Liu <[email protected]>
Signed-off-by: Stella Liu <[email protected]>
Co-developed-by: Jeremy Yu <[email protected]>
Signed-off-by: Jeremy Yu <[email protected]>
Signed-off-by: Sean Wang <[email protected]>
Link: https://patch.msgid.link/[email protected]
Signed-off-by: Felix Fietkau <[email protected]>
This commit is contained in:
Sean Wang
2026-08-25 11:22:55 +02:00
committed by Felix Fietkau
parent a221bf6cd6
commit f9b5f7c0d9
1 changed files with 20 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
mt7925/mcu.c
+18 -4
View File
@@ -2438,11 +2438,18 @@ void mt7925_mcu_bss_rlm_tlv(struct sk_buff *skb, struct mt76_phy *phy,
{ {
struct cfg80211_chan_def *chandef = ctx ? &ctx->def : struct cfg80211_chan_def *chandef = ctx ? &ctx->def :
&link_conf->chanreq.oper; &link_conf->chanreq.oper;
int freq1 = chandef->center_freq1, freq2 = chandef->center_freq2;
enum nl80211_band band = chandef->chan->band;
struct bss_rlm_tlv *req; struct bss_rlm_tlv *req;
enum nl80211_band band;
int freq1, freq2;
struct tlv *tlv; struct tlv *tlv;
if (WARN_ON_ONCE(!chandef || !chandef->chan))
return;
freq1 = chandef->center_freq1;
freq2 = chandef->center_freq2;
band = chandef->chan->band;
tlv = mt76_connac_mcu_add_tlv(skb, UNI_BSS_INFO_RLM, sizeof(*req)); tlv = mt76_connac_mcu_add_tlv(skb, UNI_BSS_INFO_RLM, sizeof(*req));
req = (struct bss_rlm_tlv *)tlv; req = (struct bss_rlm_tlv *)tlv;
req->control_channel = chandef->chan->hw_value; req->control_channel = chandef->chan->hw_value;
@@ -2580,8 +2587,8 @@ mt7925_get_phy_mode_ext(struct mt76_phy *phy, struct ieee80211_vif *vif,
enum nl80211_band band, enum nl80211_band band,
struct ieee80211_link_sta *link_sta) struct ieee80211_link_sta *link_sta)
{ {
struct ieee80211_he_6ghz_capa *he_6ghz_capa; struct ieee80211_he_6ghz_capa *he_6ghz_capa = NULL;
const struct ieee80211_sta_eht_cap *eht_cap; const struct ieee80211_sta_eht_cap *eht_cap = NULL;
__le16 capa = 0; __le16 capa = 0;
u8 mode = 0; u8 mode = 0;
@@ -2589,11 +2596,18 @@ mt7925_get_phy_mode_ext(struct mt76_phy *phy, struct ieee80211_vif *vif,
he_6ghz_capa = &link_sta->he_6ghz_capa; he_6ghz_capa = &link_sta->he_6ghz_capa;
eht_cap = &link_sta->eht_cap; eht_cap = &link_sta->eht_cap;
} else { } else {
const struct ieee80211_sta_he_cap *he_cap;
struct ieee80211_supported_band *sband; struct ieee80211_supported_band *sband;
sband = phy->hw->wiphy->bands[band]; sband = phy->hw->wiphy->bands[band];
he_cap = (band == NL80211_BAND_6GHZ) ?
ieee80211_get_he_iftype_cap(sband, vif->type) : NULL;
if (he_cap) {
capa = ieee80211_get_he_6ghz_capa(sband, vif->type); capa = ieee80211_get_he_6ghz_capa(sband, vif->type);
he_6ghz_capa = (struct ieee80211_he_6ghz_capa *)&capa; he_6ghz_capa = (struct ieee80211_he_6ghz_capa *)&capa;
}
eht_cap = ieee80211_get_eht_iftype_cap(sband, vif->type); eht_cap = ieee80211_get_eht_iftype_cap(sband, vif->type);
} }