wifi: mt76: mt7921: Place upper limit on station AID

Any station configured with an AID over 20 causes a firmware crash.
This situation occurred in our testing using an AP interface on 7922
hardware, with a modified hostapd, sourced from Mediatek's OpenWRT
feeds.

In stock hostapd, station AIDs begin counting at 1, and this
configuration is prevented with an upper limit on associated stations.
However, the modified hostapd began allocation at 65, which caused the
firmware to crash. This fix does not allow these AIDs to work, but will
prevent the firmware crash.

This crash was only seen on IFTYPE_AP interfaces, and the fix does not
appear to have an effect on IFTYPE_STATION behavior.

Fixes: 5c14a5f944b9 ("mt76: mt7921: introduce mt7921e support")
Signed-off-by: Rory Little <rory@candelatech.com>
Link: https://patch.msgid.link/20250904000711.3033860-1-rory@candelatech.com
Signed-off-by: Felix Fietkau <nbd@nbd.name>

diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/main.c b/drivers/net/wireless/mediatek/mt76/mt7921/main.c
index 5fae9a6e273c02b2db23aa2838f5981ab91b9c27..debecd3dff751cb73c0d9583a82d044e849234b0 100644 (file)
--- a/drivers/net/wireless/mediatek/mt76/mt7921/main.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7921/main.c
@@ -807,6 +807,9 @@ int mt7921_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
        struct mt792x_vif *mvif = (struct mt792x_vif *)vif->drv_priv;
        int ret, idx;
 
+       if (sta->aid > MT7921_MAX_AID)
+               return -ENOENT;
+
        idx = mt76_wcid_alloc(dev->mt76.wcid_mask, MT792x_WTBL_STA - 1);
        if (idx < 0)
                return -ENOSPC;
@@ -850,6 +853,9 @@ int mt7921_mac_sta_event(struct mt76_dev *mdev, struct ieee80211_vif *vif,
        struct mt792x_sta *msta = (struct mt792x_sta *)sta->drv_priv;
        struct mt792x_vif *mvif = (struct mt792x_vif *)vif->drv_priv;
 
+       if (sta->aid > MT7921_MAX_AID)
+               return -ENOENT;
+
        if (ev != MT76_STA_EVENT_ASSOC)
            return 0;
 

diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/mt7921.h b/drivers/net/wireless/mediatek/mt76/mt7921/mt7921.h
index 83fc7f49ff8488f8f5f8de4597565cf7eeecfc93..ad92af98e31453e71d272c60b5facc2a2f97d3b5 100644 (file)
--- a/drivers/net/wireless/mediatek/mt76/mt7921/mt7921.h
+++ b/drivers/net/wireless/mediatek/mt76/mt7921/mt7921.h
@@ -7,6 +7,8 @@
 #include "../mt792x.h"
 #include "regs.h"
 
+#define MT7921_MAX_AID                  20
+
 #define MT7921_TX_RING_SIZE            2048
 #define MT7921_TX_MCU_RING_SIZE                256
 #define MT7921_TX_FWDL_RING_SIZE       128