[][MAC80211][WiFi6][mt76][Fix NULL pointer access when setting QoS map]
[Description]
Fix NULL pointer access when setting QoS map.
Specifically, upper-layer modules may set QoS map during VIF creation.
It is possible that QoS-map setting occurs before MT76 VIF data is initialized.
In that case, NULL pointer dereference happens when mt7915_vif->phy is accessed.
[Release-log]
N/A
Change-Id: Ib61fef6853d274ccf7f8124216e1539ec08abdc8
Reviewed-on: https://gerrit.mediatek.inc/c/openwrt/feeds/mtk_openwrt_feeds/+/9339254
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/0018-wifi-mt76-mt7915-fix-inconsistent-QoS-mapping-betwee.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/0018-wifi-mt76-mt7915-fix-inconsistent-QoS-mapping-betwee.patch
index ff22780..c871c60 100644
--- a/autobuild_mac80211_release/package/kernel/mt76/patches/0018-wifi-mt76-mt7915-fix-inconsistent-QoS-mapping-betwee.patch
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/0018-wifi-mt76-mt7915-fix-inconsistent-QoS-mapping-betwee.patch
@@ -1,4 +1,4 @@
-From bdc345a92e1096ef0862e0b3d4157166e23eaffd Mon Sep 17 00:00:00 2001
+From 5fd6278fa4d62c140f40fe2d7ae0bd86074b2d36 Mon Sep 17 00:00:00 2001
From: Benjamin Lin <benjamin-jw.lin@mediatek.com>
Date: Thu, 25 Apr 2024 17:17:13 +0800
Subject: [PATCH] wifi: mt76: mt7915: fix inconsistent QoS mapping between SW
@@ -10,8 +10,8 @@
Signed-off-by: Benjamin Lin <benjamin-jw.lin@mediatek.com>
---
mt76_connac_mcu.h | 1 +
- mt7915/main.c | 40 ++++++++++++++++++++++++++++++++++++++++
- 2 files changed, 41 insertions(+)
+ mt7915/main.c | 44 ++++++++++++++++++++++++++++++++++++++++++++
+ 2 files changed, 45 insertions(+)
diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
index 8899eea..5c25f1a 100644
@@ -26,10 +26,10 @@
enum {
diff --git a/mt7915/main.c b/mt7915/main.c
-index 5ed84bc..0e6d898 100644
+index 5ed84bc..be11e4f 100644
--- a/mt7915/main.c
+++ b/mt7915/main.c
-@@ -1619,6 +1619,45 @@ mt7915_set_frag_threshold(struct ieee80211_hw *hw, u32 val)
+@@ -1619,6 +1619,49 @@ mt7915_set_frag_threshold(struct ieee80211_hw *hw, u32 val)
return 0;
}
@@ -48,6 +48,10 @@
+ .qos_map_enable = qos_map ? true : false,
+ };
+
++ /* Prevent access to members of mt7915_vif before its initialization. */
++ if (!mvif->phy)
++ return -EPERM;
++
+ if (qos_map) {
+ struct cfg80211_dscp_exception *exception = qos_map->dscp_exception;
+ struct cfg80211_dscp_range *range = qos_map->up;
@@ -75,7 +79,7 @@
static int
mt7915_set_radar_background(struct ieee80211_hw *hw,
struct cfg80211_chan_def *chandef)
-@@ -1747,6 +1786,7 @@ const struct ieee80211_ops mt7915_ops = {
+@@ -1747,6 +1790,7 @@ const struct ieee80211_ops mt7915_ops = {
.add_twt_setup = mt7915_mac_add_twt_setup,
.twt_teardown_request = mt7915_twt_teardown_request,
.set_frag_threshold = mt7915_set_frag_threshold,