Skip to content

Commit f319dc1

Browse files
committed
wifi: mt76: mt7925: add NULL checks for MLO link operations
Add NULL pointer checks for mt792x_sta_to_link() and mt792x_vif_to_link() results in critical paths to prevent kernel crashes during MLO operations. Found by static analysis review.
1 parent 3c23252 commit f319dc1

1 file changed

Lines changed: 8 additions & 0 deletions

File tree

mt7925/main.c

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -856,12 +856,17 @@ static int mt7925_mac_link_sta_add(struct mt76_dev *mdev,
856856

857857
msta = (struct mt792x_sta *)link_sta->sta->drv_priv;
858858
mlink = mt792x_sta_to_link(msta, link_id);
859+
if (!mlink)
860+
return -EINVAL;
859861

860862
idx = mt76_wcid_alloc(dev->mt76.wcid_mask, MT792x_WTBL_STA - 1);
861863
if (idx < 0)
862864
return -ENOSPC;
863865

864866
mconf = mt792x_vif_to_link(mvif, link_id);
867+
if (!mconf)
868+
return -EINVAL;
869+
865870
mt76_wcid_init(&mlink->wcid, 0);
866871
mlink->wcid.sta = 1;
867872
mlink->wcid.idx = idx;
@@ -1691,6 +1696,9 @@ mt7925_conf_tx(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
16911696
[IEEE80211_AC_BK] = 1,
16921697
};
16931698

1699+
if (!mconf)
1700+
return -EINVAL;
1701+
16941702
/* firmware uses access class index */
16951703
mconf->queue_params[mq_to_aci[queue]] = *params;
16961704

0 commit comments

Comments
 (0)