wifi: mt76: mt7996: check pointer returned by mt76_connac_get_he_phy_cap()

mt76_connac_get_he_phy_cap routine can theoretically return NULL so
check cap pointer before dereferencing it.

Fixes: 98686cd21624c ("wifi: mt76: mt7996: add driver for MediaTek Wi-Fi 7 (802.11be) devices")
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Link: https://patch.msgid.link/20260621-mt76_connac_get_he_phy_cap-fix-v1-3-ed4ccf7a0363@kernel.org
Signed-off-by: Felix Fietkau <nbd@nbd.name>

diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
index f119f023bcd57929d5f191908ff99ef4bf62f42a..c868b135689448e07ea2395d4baeac57c91121f7 100644 (file)
--- a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
@@ -935,6 +935,8 @@ mt7996_mcu_bss_he_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
        struct tlv *tlv;
 
        cap = mt76_connac_get_he_phy_cap(phy->mt76, vif);
+       if (!cap)
+               return;
 
        tlv = mt7996_mcu_add_uni_tlv(skb, UNI_BSS_INFO_HE_BASIC, sizeof(*he));
 
@@ -1855,17 +1857,18 @@ mt7996_mcu_sta_bfer_he(struct ieee80211_link_sta *link_sta,
 {
        struct ieee80211_sta_he_cap *pc = &link_sta->he_cap;
        struct ieee80211_he_cap_elem *pe = &pc->he_cap_elem;
-       const struct ieee80211_sta_he_cap *vc =
-               mt76_connac_get_he_phy_cap(phy->mt76, vif);
-       const struct ieee80211_he_cap_elem *ve = &vc->he_cap_elem;
        u16 mcs_map = le16_to_cpu(pc->he_mcs_nss_supp.rx_mcs_80);
        u8 nss_mcs = mt7996_mcu_get_sta_nss(mcs_map);
+       const struct ieee80211_he_cap_elem *ve;
+       const struct ieee80211_sta_he_cap *vc;
        u8 snd_dim, sts;
 
+       vc = mt76_connac_get_he_phy_cap(phy->mt76, vif);
        if (!vc)
                return;
 
        bf->tx_mode = MT_PHY_TYPE_HE_SU;
+       ve = &vc->he_cap_elem;
 
        mt7996_mcu_sta_sounding_rate(bf, phy);