Commit baa87990 authored by Ma Ke's avatar Ma Ke Committed by Zheng Yejian
Browse files

wifi: mt76: mt7996: fix NULL pointer dereference in mt7996_mcu_sta_bfer_he 

stable inclusion
from stable-v6.6.54
commit 8e4b60ae8a047ad2fb175fcfdd54feee80983a45
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYPJK
CVE: CVE-2024-47681

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=8e4b60ae8a047ad2fb175fcfdd54feee80983a45



--------------------------------

commit f503ae90c7355e8506e68498fe84c1357894cd5b upstream.

Fix the NULL pointer dereference in mt7996_mcu_sta_bfer_he
routine adding an sta interface to the mt7996 driver.

Found by code review.

Cc: stable@vger.kernel.org
Fixes: 98686cd2 ("wifi: mt76: mt7996: add driver for MediaTek Wi-Fi 7 (802.11be) devices")
Signed-off-by: default avatarMa Ke <make24@iscas.ac.cn>
Link: https://patch.msgid.link/20240813081242.3991814-1-make24@iscas.ac.cn


Signed-off-by: default avatarFelix Fietkau <nbd@nbd.name>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: default avatarZhangPeng <zhangpeng362@huawei.com>
Signed-off-by: default avatarZheng Yejian <zhengyejian1@huawei.com>
parent ed7fbeaf

drivers/net/wireless/mediatek/mt76/mt7996/mcu.c

+3 −0
Original line number Diff line number Diff line
@@ -1303,6 +1303,9 @@ mt7996_mcu_sta_bfer_he(struct ieee80211_sta *sta, struct ieee80211_vif *vif, 
	u8 nss_mcs = mt7996_mcu_get_sta_nss(mcs_map);

	u8 snd_dim, sts;



	if (!vc)

		return;



	bf->tx_mode = MT_PHY_TYPE_HE_SU;



	mt7996_mcu_sta_sounding_rate(bf);