wifi: mt76: mt7996: fix possible NULL-pointer deref in mt7996_mcu_sta_bfer_eht()

mt76_connac_get_eht_phy_cap routine can theoretically return NULL so
check cap pointer before dereferencing it.

Fixes: ba01944adee9f ("wifi: mt76: mt7996: add EHT beamforming support")
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Link: https://patch.msgid.link/20260621-mt76_connac_get_he_phy_cap-fix-v1-4-ed4ccf7a0363@kernel.org
Signed-off-by: Felix Fietkau <nbd@nbd.name>

diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
index c868b135689448e07ea2395d4baeac57c91121f7..2e83f4b79c8704f710d1c8ba1c28578421330c8b 100644 (file)
--- a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
@@ -1924,14 +1924,18 @@ mt7996_mcu_sta_bfer_eht(struct ieee80211_link_sta *link_sta,
        struct ieee80211_sta_eht_cap *pc = &link_sta->eht_cap;
        struct ieee80211_eht_cap_elem_fixed *pe = &pc->eht_cap_elem;
        struct ieee80211_eht_mcs_nss_supp *eht_nss = &pc->eht_mcs_nss_supp;
-       const struct ieee80211_sta_eht_cap *vc =
-               mt76_connac_get_eht_phy_cap(phy->mt76, vif);
-       const struct ieee80211_eht_cap_elem_fixed *ve = &vc->eht_cap_elem;
        u8 nss_mcs = u8_get_bits(eht_nss->bw._80.rx_tx_mcs9_max_nss,
                                 IEEE80211_EHT_MCS_NSS_RX) - 1;
+       const struct ieee80211_eht_cap_elem_fixed *ve;
+       const struct ieee80211_sta_eht_cap *vc;
        u8 snd_dim, sts;
 
+       vc = mt76_connac_get_eht_phy_cap(phy->mt76, vif);
+       if (!vc)
+               return;
+
        bf->tx_mode = MT_PHY_TYPE_EHT_MU;
+       ve = &vc->eht_cap_elem;
 
        mt7996_mcu_sta_sounding_rate(bf, phy);