diff mbox series

wifi: mt76: mt7925: Fix invalid chandef access.

Message ID 20240320192723.3440938-1-greearb@candelatech.com
State New
Headers show
Series wifi: mt76: mt7925: Fix invalid chandef access. | expand

Commit Message

Ben Greear March 20, 2024, 7:27 p.m. UTC
From: Ben Greear <greearb@candelatech.com>

mt76.ctx can be null, and that causes chandef to be null.
Use logic found in similar code paths to use chandef
from the phy object in case ctx is NULL.

With this, my system no longer crashes, but STA will still not
associate.

Signed-off-by: Ben Greear <greearb@candelatech.com>
---
 drivers/net/wireless/mediatek/mt76/mt7925/mcu.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

Comments

Lorenzo Bianconi March 20, 2024, 11:03 p.m. UTC | #1
> From: Ben Greear <greearb@candelatech.com>
> 
> mt76.ctx can be null, and that causes chandef to be null.
> Use logic found in similar code paths to use chandef
> from the phy object in case ctx is NULL.
> 
> With this, my system no longer crashes, but STA will still not
> associate.

Hi Ben,

can you please add 'Fixes' tag to help people backporting the fix?
I think it is:
Fixes: c948b5da6bbe ("wifi: mt76: mt7925: add Mediatek Wi-Fi7 driver for mt7925 chips")

Regards,
Lorenzo

> 
> Signed-off-by: Ben Greear <greearb@candelatech.com>
> ---
>  drivers/net/wireless/mediatek/mt76/mt7925/mcu.c | 6 ++++--
>  1 file changed, 4 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c
> index bd37cb8d734b..feb818411a25 100644
> --- a/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c
> +++ b/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c
> @@ -1502,7 +1502,8 @@ mt7925_mcu_sta_phy_tlv(struct sk_buff *skb,
>  		       struct ieee80211_vif *vif, struct ieee80211_sta *sta)
>  {
>  	struct mt792x_vif *mvif = (struct mt792x_vif *)vif->drv_priv;
> -	struct cfg80211_chan_def *chandef = &mvif->mt76.ctx->def;
> +	struct mt76_phy *mphy = mvif->phy->mt76;
> +	struct cfg80211_chan_def *chandef = mvif->mt76.ctx ? &mvif->mt76.ctx->def : &mphy->chandef;
>  	struct sta_rec_phy *phy;
>  	struct tlv *tlv;
>  	u8 af = 0, mm = 0;
> @@ -1569,7 +1570,8 @@ mt7925_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb,
>  			     struct ieee80211_vif *vif, struct ieee80211_sta *sta)
>  {
>  	struct mt792x_vif *mvif = (struct mt792x_vif *)vif->drv_priv;
> -	struct cfg80211_chan_def *chandef = &mvif->mt76.ctx->def;
> +	struct mt76_phy *mphy = mvif->phy->mt76;
> +	struct cfg80211_chan_def *chandef = mvif->mt76.ctx ? &mvif->mt76.ctx->def : &mphy->chandef;
>  	enum nl80211_band band = chandef->chan->band;
>  	struct sta_rec_ra_info *ra_info;
>  	struct tlv *tlv;
> -- 
> 2.42.0
> 
>
Ben Greear March 27, 2024, 4:49 p.m. UTC | #2
On 3/20/24 16:03, Lorenzo Bianconi wrote:
>> From: Ben Greear <greearb@candelatech.com>
>>
>> mt76.ctx can be null, and that causes chandef to be null.
>> Use logic found in similar code paths to use chandef
>> from the phy object in case ctx is NULL.
>>
>> With this, my system no longer crashes, but STA will still not
>> associate.
> 
> Hi Ben,
> 
> can you please add 'Fixes' tag to help people backporting the fix?
> I think it is:
> Fixes: c948b5da6bbe ("wifi: mt76: mt7925: add Mediatek Wi-Fi7 driver for mt7925 chips")

I'm not able to reproduce the crash on upstream drivers, the crash only happened when
I had a local patch that caused it to not associate.

I still think the patch should go upstream as there may be other paths to hit the bug,
but maybe it doesn't need to be backported?

Let me know if you still want me to do the Fixes thing.

Thanks,
Ben

> 
> Regards,
> Lorenzo
> 
>>
>> Signed-off-by: Ben Greear <greearb@candelatech.com>
>> ---
>>   drivers/net/wireless/mediatek/mt76/mt7925/mcu.c | 6 ++++--
>>   1 file changed, 4 insertions(+), 2 deletions(-)
>>
>> diff --git a/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c
>> index bd37cb8d734b..feb818411a25 100644
>> --- a/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c
>> +++ b/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c
>> @@ -1502,7 +1502,8 @@ mt7925_mcu_sta_phy_tlv(struct sk_buff *skb,
>>   		       struct ieee80211_vif *vif, struct ieee80211_sta *sta)
>>   {
>>   	struct mt792x_vif *mvif = (struct mt792x_vif *)vif->drv_priv;
>> -	struct cfg80211_chan_def *chandef = &mvif->mt76.ctx->def;
>> +	struct mt76_phy *mphy = mvif->phy->mt76;
>> +	struct cfg80211_chan_def *chandef = mvif->mt76.ctx ? &mvif->mt76.ctx->def : &mphy->chandef;
>>   	struct sta_rec_phy *phy;
>>   	struct tlv *tlv;
>>   	u8 af = 0, mm = 0;
>> @@ -1569,7 +1570,8 @@ mt7925_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb,
>>   			     struct ieee80211_vif *vif, struct ieee80211_sta *sta)
>>   {
>>   	struct mt792x_vif *mvif = (struct mt792x_vif *)vif->drv_priv;
>> -	struct cfg80211_chan_def *chandef = &mvif->mt76.ctx->def;
>> +	struct mt76_phy *mphy = mvif->phy->mt76;
>> +	struct cfg80211_chan_def *chandef = mvif->mt76.ctx ? &mvif->mt76.ctx->def : &mphy->chandef;
>>   	enum nl80211_band band = chandef->chan->band;
>>   	struct sta_rec_ra_info *ra_info;
>>   	struct tlv *tlv;
>> -- 
>> 2.42.0
>>
>>
diff mbox series

Patch

diff --git a/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c
index bd37cb8d734b..feb818411a25 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c
@@ -1502,7 +1502,8 @@  mt7925_mcu_sta_phy_tlv(struct sk_buff *skb,
 		       struct ieee80211_vif *vif, struct ieee80211_sta *sta)
 {
 	struct mt792x_vif *mvif = (struct mt792x_vif *)vif->drv_priv;
-	struct cfg80211_chan_def *chandef = &mvif->mt76.ctx->def;
+	struct mt76_phy *mphy = mvif->phy->mt76;
+	struct cfg80211_chan_def *chandef = mvif->mt76.ctx ? &mvif->mt76.ctx->def : &mphy->chandef;
 	struct sta_rec_phy *phy;
 	struct tlv *tlv;
 	u8 af = 0, mm = 0;
@@ -1569,7 +1570,8 @@  mt7925_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb,
 			     struct ieee80211_vif *vif, struct ieee80211_sta *sta)
 {
 	struct mt792x_vif *mvif = (struct mt792x_vif *)vif->drv_priv;
-	struct cfg80211_chan_def *chandef = &mvif->mt76.ctx->def;
+	struct mt76_phy *mphy = mvif->phy->mt76;
+	struct cfg80211_chan_def *chandef = mvif->mt76.ctx ? &mvif->mt76.ctx->def : &mphy->chandef;
 	enum nl80211_band band = chandef->chan->band;
 	struct sta_rec_ra_info *ra_info;
 	struct tlv *tlv;