developer | 43a264f | 2024-03-26 14:09:54 +0800 | [diff] [blame] | 1 | From cd699c6764e92f89aef0c75fa0c5a5c69402bcf6 Mon Sep 17 00:00:00 2001 |
developer | d243af0 | 2023-12-21 14:49:33 +0800 | [diff] [blame] | 2 | From: MeiChia Chiu <meichia.chiu@mediatek.com> |
| 3 | Date: Thu, 26 Oct 2023 10:08:10 +0800 |
developer | 43a264f | 2024-03-26 14:09:54 +0800 | [diff] [blame] | 4 | Subject: [PATCH 13/17] mtk: wifi: mt76: mt7996: Fixed null pointer dereference |
developer | d243af0 | 2023-12-21 14:49:33 +0800 | [diff] [blame] | 5 | issue |
| 6 | |
| 7 | Without this patch, when the station is still in Authentication stage and |
| 8 | sends a "Notify bandwidth change action frame" to AP at the same time, |
| 9 | there will be a race condition that causes a crash to occur because the AP |
| 10 | access "msta->vif" that has not been fully initialized. |
| 11 | |
| 12 | Signed-off-by: Bo Jiao <Bo.Jiao@mediatek.com> |
| 13 | Signed-off-by: Money Wang <money.wang@mediatek.com> |
| 14 | Signed-off-by: MeiChia Chiu <meichia.chiu@mediatek.com> |
| 15 | --- |
| 16 | mt7996/main.c | 7 +++++++ |
| 17 | 1 file changed, 7 insertions(+) |
| 18 | |
| 19 | diff --git a/mt7996/main.c b/mt7996/main.c |
developer | ebda901 | 2024-02-22 13:42:45 +0800 | [diff] [blame] | 20 | index 625f87b4..ad2c6a9d 100644 |
developer | d243af0 | 2023-12-21 14:49:33 +0800 | [diff] [blame] | 21 | --- a/mt7996/main.c |
| 22 | +++ b/mt7996/main.c |
| 23 | @@ -1063,9 +1063,16 @@ static void mt7996_sta_rc_update(struct ieee80211_hw *hw, |
| 24 | struct ieee80211_sta *sta, |
| 25 | u32 changed) |
| 26 | { |
| 27 | + struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv; |
| 28 | struct mt7996_phy *phy = mt7996_hw_phy(hw); |
| 29 | struct mt7996_dev *dev = phy->dev; |
| 30 | |
| 31 | + if (!msta->vif) { |
| 32 | + dev_warn(dev->mt76.dev, "Un-initialized STA %pM wcid %d in rc_work\n", |
| 33 | + sta->addr, msta->wcid.idx); |
| 34 | + return; |
| 35 | + } |
| 36 | + |
| 37 | mt7996_sta_rc_work(&changed, sta); |
| 38 | ieee80211_queue_work(hw, &dev->rc_work); |
| 39 | } |
| 40 | -- |
| 41 | 2.18.0 |
| 42 | |