lkml.org 
[lkml]   [2022]   [Jun]   [7]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.18 434/879] mt76: mt7915: fix possible NULL pointer dereference in mt7915_mac_fill_rx_vector
    Date
    From: Lorenzo Bianconi <lorenzo@kernel.org>

    [ Upstream commit 62fdc974894eec80d678523458cf99bbdb887e22 ]

    Fix possible NULL pointer dereference in mt7915_mac_fill_rx_vector
    routine if the chip does not support dbdc and the hw reports band_idx
    set to 1.

    Fixes: 78fc30a21cf11 ("mt76: mt7915: move testmode data from dev to phy")
    Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
    Signed-off-by: Felix Fietkau <nbd@nbd.name>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/net/wireless/mediatek/mt76/mt7915/mac.c | 7 +++++--
    1 file changed, 5 insertions(+), 2 deletions(-)

    diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/mac.c b/drivers/net/wireless/mediatek/mt76/mt7915/mac.c
    index eaa31f5e0b00..fe2b63cf61d8 100644
    --- a/drivers/net/wireless/mediatek/mt76/mt7915/mac.c
    +++ b/drivers/net/wireless/mediatek/mt76/mt7915/mac.c
    @@ -864,8 +864,11 @@ mt7915_mac_fill_rx_vector(struct mt7915_dev *dev, struct sk_buff *skb)
    int i;

    band_idx = le32_get_bits(rxv_hdr[1], MT_RXV_HDR_BAND_IDX);
    - if (band_idx && !phy->band_idx)
    + if (band_idx && !phy->band_idx) {
    phy = mt7915_ext_phy(dev);
    + if (!phy)
    + goto out;
    + }

    rcpi = le32_to_cpu(rxv[6]);
    ib_rssi = le32_to_cpu(rxv[7]);
    @@ -890,8 +893,8 @@ mt7915_mac_fill_rx_vector(struct mt7915_dev *dev, struct sk_buff *skb)

    phy->test.last_freq_offset = foe;
    phy->test.last_snr = snr;
    +out:
    #endif
    -
    dev_kfree_skb(skb);
    }

    --
    2.35.1


    \
     
     \ /
      Last update: 2022-06-08 02:21    [W:4.017 / U:0.216 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site