diff options
| author | Fedor Pchelkin <pchelkin@ispras.ru> | 2025-10-27 14:18:40 +0300 |
|---|---|---|
| committer | Felix Fietkau <nbd@nbd.name> | 2025-11-24 16:37:55 +0300 |
| commit | 5ef6de7bad7255621f5f542d8d313b93662b7524 (patch) | |
| tree | 8cba4862d1c282f00a351b294e898cc2fb098fe3 /drivers/net/wireless | |
| parent | cdb2941a516cf06929293604e2e0f4c1d6f3541e (diff) | |
| download | linux-5ef6de7bad7255621f5f542d8d313b93662b7524.tar.xz | |
wifi: mt76: adjust BSS conf pointer handling
Passing a BSS conf pointer to mt76_connac2_mac_tx_rate_val() currently has
two inconsistencies.
When called from mt76_connac2_mac_write_txwi(), BSS conf is got by
dereferencing a vif pointer. A NULL vif isn't accounted for though the
function itself supposes it to be NULL and tries to handle this case in
previous checks. This looks like a cosmetic change since the drivers
calling the function (namely, mt7915 and mt7921) set WANT_MONITOR_VIF flag
so judging by info->control.vif initialization inside ieee80211_tx_*()
routines it can't actually come as NULL here.
The same holds for the BSS conf pointer handling inside
mt76_connac2_mac_tx_rate_val(). It is dereferenced before being checked
for NULL. The function supposes to handle the case so reorder the check
and dereference of the pointer. Again, this looks like a syntax issue
only.
Found by Linux Verification Center (linuxtesting.org) with SVACE static
analysis tool.
Co-developed-by: Matvey Kovalev <matvey.kovalev@ispras.ru>
Signed-off-by: Matvey Kovalev <matvey.kovalev@ispras.ru>
Signed-off-by: Fedor Pchelkin <pchelkin@ispras.ru>
Link: https://patch.msgid.link/20251027111843.38975-2-pchelkin@ispras.ru
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Diffstat (limited to 'drivers/net/wireless')
| -rw-r--r-- | drivers/net/wireless/mediatek/mt76/mt76_connac_mac.c | 19 |
1 files changed, 11 insertions, 8 deletions
diff --git a/drivers/net/wireless/mediatek/mt76/mt76_connac_mac.c b/drivers/net/wireless/mediatek/mt76/mt76_connac_mac.c index 7af6a578562f..3304b5971be0 100644 --- a/drivers/net/wireless/mediatek/mt76/mt76_connac_mac.c +++ b/drivers/net/wireless/mediatek/mt76/mt76_connac_mac.c @@ -297,16 +297,18 @@ u16 mt76_connac2_mac_tx_rate_val(struct mt76_phy *mphy, struct ieee80211_bss_conf *conf, bool beacon, bool mcast) { - struct mt76_vif_link *mvif = mt76_vif_conf_link(mphy->dev, conf->vif, conf); - struct cfg80211_chan_def *chandef = mvif->ctx ? - &mvif->ctx->def : &mphy->chandef; - u8 nss = 0, mode = 0, band = chandef->chan->band; - int rateidx = 0, mcast_rate; - int offset = 0; + u8 nss = 0, mode = 0, band = NL80211_BAND_2GHZ; + int rateidx = 0, offset = 0, mcast_rate; + struct cfg80211_chan_def *chandef; + struct mt76_vif_link *mvif; if (!conf) goto legacy; + mvif = mt76_vif_conf_link(mphy->dev, conf->vif, conf); + chandef = mvif->ctx ? &mvif->ctx->def : &mphy->chandef; + band = chandef->chan->band; + if (is_mt7921(mphy->dev)) { rateidx = ffs(conf->basic_rates) - 1; goto legacy; @@ -584,8 +586,9 @@ void mt76_connac2_mac_write_txwi(struct mt76_dev *dev, __le32 *txwi, struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data; bool multicast = ieee80211_is_data(hdr->frame_control) && is_multicast_ether_addr(hdr->addr1); - u16 rate = mt76_connac2_mac_tx_rate_val(mphy, &vif->bss_conf, beacon, - multicast); + u16 rate = mt76_connac2_mac_tx_rate_val(mphy, + vif ? &vif->bss_conf : NULL, + beacon, multicast); u32 val = MT_TXD6_FIXED_BW; /* hardware won't add HTC for mgmt/ctrl frame */ |