• Sean Wang's avatar
    wifi: mt76: mt7921: fix null pointer access in mt792x_mac_link_bss_remove · 6557a28f
    Sean Wang authored
    Fix null pointer access in mt792x_mac_link_bss_remove.
    
    To prevent null pointer access, we should assign the vif to bss_conf in
    mt7921_add_interface. This ensures that subsequent operations on the BSS
    can properly reference the correct vif.
    
    [  T843] Call Trace:
    [  T843]  <TASK>
    [  T843]  ? __die+0x1e/0x60
    [  T843]  ? page_fault_oops+0x157/0x450
    [  T843]  ? srso_alias_return_thunk+0x5/0xfbef5
    [  T843]  ? srso_alias_return_thunk+0x5/0xfbef5
    [  T843]  ? search_bpf_extables+0x5a/0x80
    [  T843]  ? srso_alias_return_thunk+0x5/0xfbef5
    [  T843]  ? exc_page_fault+0x2bb/0x670
    [  T843]  ? srso_alias_return_thunk+0x5/0xfbef5
    [  T843]  ? lock_timer_base+0x71/0x90
    [  T843]  ? asm_exc_page_fault+0x26/0x30
    [  T843]  ? mt792x_mac_link_bss_remove+0x24/0x110 [mt792x_lib]
    [  T843]  ? mt792x_remove_interface+0x6e/0x90 [mt792x_lib]
    [  T843]  ? ieee80211_do_stop+0x507/0x7e0 [mac80211]
    [  T843]  ? ieee80211_stop+0x53/0x190 [mac80211]
    [  T843]  ? __dev_close_many+0xa5/0x120
    [  T843]  ? __dev_change_flags+0x18c/0x220
    [  T843]  ? dev_change_flags+0x21/0x60
    [  T843]  ? do_setlink+0xdf9/0x11d0
    [  T843]  ? srso_alias_return_thunk+0x5/0xfbef5
    [  T843]  ? srso_alias_return_thunk+0x5/0xfbef5
    [  T843]  ? security_sock_rcv_skb+0x33/0x50
    [  T843]  ? srso_alias_return_thunk+0x5/0xfbef5
    [  T843]  ? srso_alias_return_thunk+0x5/0xfbef5
    [  T843]  ? __nla_validate_parse+0x61/0xd10
    [  T843]  ? srso_alias_return_thunk+0x5/0xfbef5
    [  T843]  ? genl_done+0x53/0x80
    [  T843]  ? srso_alias_return_thunk+0x5/0xfbef5
    [  T843]  ? netlink_dump+0x357/0x410
    [  T843]  ? __rtnl_newlink+0x5d6/0x980
    [  T843]  ? srso_alias_return_thunk+0x5/0xfbef5
    [  T843]  ? genl_family_rcv_msg_dumpit+0xdf/0xf0
    [  T843]  ? srso_alias_return_thunk+0x5/0xfbef5
    [  T843]  ? __kmalloc_cache_noprof+0x44/0x210
    [  T843]  ? rtnl_newlink+0x42/0x60
    [  T843]  ? rtnetlink_rcv_msg+0x152/0x3f0
    [  T843]  ? mptcp_pm_nl_dump_addr+0x180/0x180
    [  T843]  ? rtnl_calcit.isra.0+0x130/0x130
    [  T843]  ? netlink_rcv_skb+0x56/0x100
    [  T843]  ? netlink_unicast+0x199/0x290
    [  T843]  ? netlink_sendmsg+0x21d/0x490
    [  T843]  ? __sock_sendmsg+0x78/0x80
    [  T843]  ? ____sys_sendmsg+0x23f/0x2e0
    [  T843]  ? srso_alias_return_thunk+0x5/0xfbef5
    [  T843]  ? copy_msghdr_from_user+0x68/0xa0
    [  T843]  ? ___sys_sendmsg+0x81/0xd0
    [  T843]  ? srso_alias_return_thunk+0x5/0xfbef5
    [  T843]  ? crng_fast_key_erasure+0xbc/0xf0
    [  T843]  ? srso_alias_return_thunk+0x5/0xfbef5
    [  T843]  ? get_random_bytes_user+0x126/0x140
    [  T843]  ? srso_alias_return_thunk+0x5/0xfbef5
    [  T843]  ? __fdget+0xb1/0xe0
    [  T843]  ? __sys_sendmsg+0x56/0xa0
    [  T843]  ? srso_alias_return_thunk+0x5/0xfbef5
    [  T843]  ? do_syscall_64+0x5f/0x170
    [  T843]  ? entry_SYSCALL_64_after_hwframe+0x55/0x5d
    [  T843]  </TASK>
    
    Fixes: 1541d63c ("wifi: mt76: mt7925: add mt7925_mac_link_bss_remove to remove per-link BSS")
    Reported-by: default avatarBert Karwatzki <spasswolf@web.de>
    Closes: https://lore.kernel.org/linux-wireless/2fee61f8c903d02a900ca3188c3742c7effd102e.camel@web.de/#bSigned-off-by: default avatarSean Wang <sean.wang@mediatek.com>
    Tested-by: default avatarBert Karwatzki <spasswolf@web.de>
    Link: https://patch.msgid.link/20240718234633.12737-1-sean.wang@kernel.orgSigned-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
    6557a28f
main.c 38.8 KB