[5.10,073/130] mt76: mt7915: fix NULL pointer dereference in mt7915_get_phy_mode

From: Lorenzo Bianconi <lorenzo@kernel.org>

From: Lorenzo Bianconi <lorenzo@kernel.org>

commit 6e53d6d26920d5221d3f4d4f5ffdd629ea69aa5c upstream.

Fix the following NULL pointer dereference in mt7915_get_phy_mode
routine adding an ibss interface to the mt7915 driver.

[  101.137097] wlan0: Trigger new scan to find an IBSS to join
[  102.827039] wlan0: Creating new IBSS network, BSSID 26:a4:50:1a:6e:69
[  103.064756] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000
[  103.073670] Mem abort info:
[  103.076520]   ESR = 0x96000005
[  103.079614]   EC = 0x25: DABT (current EL), IL = 32 bits
[  103.084934]   SET = 0, FnV = 0
[  103.088042]   EA = 0, S1PTW = 0
[  103.091215] Data abort info:
[  103.094104]   ISV = 0, ISS = 0x00000005
[  103.098041]   CM = 0, WnR = 0
[  103.101044] user pgtable: 4k pages, 39-bit VAs, pgdp=00000000460b1000
[  103.107565] [0000000000000000] pgd=0000000000000000, p4d=0000000000000000, pud=0000000000000000
[  103.116590] Internal error: Oops: 96000005 [#1] SMP
[  103.189066] CPU: 1 PID: 333 Comm: kworker/u4:3 Not tainted 5.10.75 #0
[  103.195498] Hardware name: MediaTek MT7622 RFB1 board (DT)
[  103.201124] Workqueue: phy0 ieee80211_iface_work [mac80211]
[  103.206695] pstate: 20000005 (nzCv daif -PAN -UAO -TCO BTYPE=--)
[  103.212705] pc : mt7915_get_phy_mode+0x68/0x120 [mt7915e]
[  103.218103] lr : mt7915_mcu_add_bss_info+0x11c/0x760 [mt7915e]
[  103.223927] sp : ffffffc011cdb9e0
[  103.227235] x29: ffffffc011cdb9e0 x28: ffffff8006563098
[  103.232545] x27: ffffff8005f4da22 x26: ffffff800685ac40
[  103.237855] x25: 0000000000000001 x24: 000000000000011f
[  103.243165] x23: ffffff8005f4e260 x22: ffffff8006567918
[  103.248475] x21: ffffff8005f4df80 x20: ffffff800685ac58
[  103.253785] x19: ffffff8006744400 x18: 0000000000000000
[  103.259094] x17: 0000000000000000 x16: 0000000000000001
[  103.264403] x15: 000899c3a2d9d2e4 x14: 000899bdc3c3a1c8
[  103.269713] x13: 0000000000000000 x12: 0000000000000000
[  103.275024] x11: ffffffc010e30c20 x10: 0000000000000000
[  103.280333] x9 : 0000000000000050 x8 : ffffff8006567d88
[  103.285642] x7 : ffffff8006563b5c x6 : ffffff8006563b44
[  103.290952] x5 : 0000000000000002 x4 : 0000000000000001
[  103.296262] x3 : 0000000000000001 x2 : 0000000000000001
[  103.301572] x1 : 0000000000000000 x0 : 0000000000000011
[  103.306882] Call trace:
[  103.309328]  mt7915_get_phy_mode+0x68/0x120 [mt7915e]
[  103.314378]  mt7915_bss_info_changed+0x198/0x200 [mt7915e]
[  103.319941]  ieee80211_bss_info_change_notify+0x128/0x290 [mac80211]
[  103.326360]  __ieee80211_sta_join_ibss+0x308/0x6c4 [mac80211]
[  103.332171]  ieee80211_sta_create_ibss+0x8c/0x10c [mac80211]
[  103.337895]  ieee80211_ibss_work+0x3dc/0x614 [mac80211]
[  103.343185]  ieee80211_iface_work+0x388/0x3f0 [mac80211]
[  103.348495]  process_one_work+0x288/0x690
[  103.352499]  worker_thread+0x70/0x464
[  103.356157]  kthread+0x144/0x150
[  103.359380]  ret_from_fork+0x10/0x18
[  103.362952] Code: 394008c3 52800220 394000e4 7100007f (39400023)

Fixes: 37f4ca907c46 ("mt76: mt7915: register per-phy HE capabilities for each interface")
Fixes: e57b7901469f ("mt76: add mac80211 driver for MT7915 PCIe-based chipsets")
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Acked-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/ddae419a740f1fb9e48afd432035e9f394f512ee.1637239456.git.lorenzo@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/wireless/mediatek/mt76/mt7915/mcu.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

Message ID	20211206145602.196339370@linuxfoundation.org
State	New
Headers	show Return-Path: <stable-owner@kernel.org> From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>, stable@vger.kernel.org, Lorenzo Bianconi <lorenzo@kernel.org>, Felix Fietkau <nbd@nbd.name>, Kalle Valo <kvalo@codeaurora.org> Subject: [PATCH 5.10 073/130] mt76: mt7915: fix NULL pointer dereference in mt7915_get_phy_mode Date: Mon, 6 Dec 2021 15:56:30 +0100 Message-Id: <20211206145602.196339370@linuxfoundation.org> In-Reply-To: <20211206145559.607158688@linuxfoundation.org> References: <20211206145559.607158688@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk
Series	None \| expand [5.10,002/130] can: j1939: j1939_tp_cmd_recv(): check the dst address of TP.CM_BAM [5.10,003/130] ovl: simplify file splice [5.10,004/130] ovl: fix deadlock in splice write [5.10,005/130] gfs2: release iopen glock early in evict [5.10,006/130] gfs2: Fix length of holes reported at end-of-file [5.10,007/130] powerpc/pseries/ddw: Revert "Extend upper limit for huge DMA window for persistent... [5.10,008/130] drm/sun4i: fix unmet dependency on RESET_CONTROLLER for PHY_SUN6I_MIPI_DPHY [5.10,009/130] mac80211: do not access the IV when it was stripped [5.10,010/130] net/smc: Transfer remaining wait queue entries during fallback [5.10,011/130] atlantic: Fix OOB read and write in hw_atl_utils_fw_rpc_wait [5.10,012/130] net: return correct error code [5.10,013/130] platform/x86: thinkpad_acpi: Add support for dual fan control [5.10,014/130] platform/x86: thinkpad_acpi: Fix WWAN device disabled issue after S3 deep [5.10,015/130] s390/setup: avoid using memblock_enforce_memory_limit [5.10,016/130] btrfs: check-integrity: fix a warning on write caching disabled disk [5.10,017/130] thermal: core: Reset previous low and high trip during thermal zone init [5.10,018/130] scsi: iscsi: Unblock session then wake up error handler [5.10,019/130] drm/amd/amdkfd: Fix kernel panic when reset failed and been triggered again [5.10,020/130] drm/amd/amdgpu: fix potential memleak [5.10,021/130] ata: ahci: Add Green Sardine vendor ID as board_ahci_mobile [5.10,022/130] ethernet: hisilicon: hns: hns_dsaf_misc: fix a possible array overflow in hns_dsaf... [5.10,023/130] ipv6: check return value of ipv6_skip_exthdr [5.10,024/130] net: tulip: de4x5: fix the problem that the array lp->phy[8] may be out of bound [5.10,025/130] net: ethernet: dec: tulip: de4x5: fix possible array overflows in type3_infoblock() [5.10,026/130] perf inject: Fix ARM SPE handling [5.10,027/130] perf hist: Fix memory leak of a perf_hpp_fmt [5.10,028/130] perf report: Fix memory leaks around perf_tip() [5.10,029/130] net/smc: Avoid warning of possible recursive locking [5.10,030/130] ACPI: Add stubs for wakeup handler functions [5.10,031/130] vrf: Reset IPCB/IP6CB when processing outbound pkts in vrf dev xmit [5.10,032/130] kprobes: Limit max data_size of the kretprobe instances [5.10,033/130] rt2x00: do not mark device gone on EPROTO errors during start [5.10,034/130] ipmi: Move remove_work to dedicated workqueue [5.10,035/130] cpufreq: Fix get_cpu_device() failure in add_cpu_dev_symlink() [5.10,036/130] s390/pci: move pseudo-MMIO to prevent MIO overlap [5.10,037/130] fget: check that the fd still exists after getting a ref to it [5.10,038/130] sata_fsl: fix UAF in sata_fsl_port_stop when rmmod sata_fsl [5.10,039/130] sata_fsl: fix warning in remove_proc_entry when rmmod sata_fsl [5.10,040/130] ipv6: fix memory leak in fib6_rule_suppress [5.10,041/130] drm/amd/display: Allow DSC on supported MST branch devices [5.10,042/130] KVM: Disallow user memslot with size that exceeds "unsigned long" [5.10,043/130] KVM: nVMX: Flush current VPID (L1 vs. L2) for KVM_REQ_TLB_FLUSH_GUEST [5.10,044/130] KVM: x86: Use a stable condition around all VT-d PI paths [5.10,045/130] KVM: arm64: Avoid setting the upper 32 bits of TCR_EL2 and CPTR_EL2 to 1 [5.10,046/130] KVM: X86: Use vcpu->arch.walk_mmu for kvm_mmu_invlpg() [5.10,047/130] tracing/histograms: String compares should not care about signed values [5.10,048/130] drm/amdkfd: separate kfd_iommu_resume from kfd_resume [5.10,049/130] drm/amdgpu: add amdgpu_amdkfd_resume_iommu [5.10,050/130] drm/amdgpu: move iommu_resume before ip init/resume [5.10,051/130] drm/amdgpu: init iommu after amdkfd device init [5.10,052/130] drm/amdkfd: fix boot failure when iommu is disabled in Picasso. [5.10,053/130] wireguard: selftests: increase default dmesg log size [5.10,054/130] wireguard: allowedips: add missing __rcu annotation to satisfy sparse [5.10,055/130] wireguard: selftests: actually test for routing loops [5.10,056/130] wireguard: selftests: rename DEBUG_PI_LIST to DEBUG_PLIST [5.10,057/130] wireguard: device: reset peer src endpoint when netns exits [5.10,058/130] wireguard: receive: use ring buffer for incoming handshakes [5.10,059/130] wireguard: receive: drop handshakes if queue lock is contended [5.10,060/130] wireguard: ratelimiter: use kvcalloc() instead of kvzalloc() [5.10,061/130] i2c: stm32f7: flush TX FIFO upon transfer errors [5.10,062/130] i2c: stm32f7: recover the bus on access timeout [5.10,063/130] i2c: stm32f7: stop dma transfer in case of NACK [5.10,064/130] i2c: cbus-gpio: set atomic transfer callback [5.10,065/130] natsemi: xtensa: fix section mismatch warnings [5.10,066/130] tcp: fix page frag corruption on page fault [5.10,067/130] net: qlogic: qlcnic: Fix a NULL pointer dereference in qlcnic_83xx_add_rings() [5.10,068/130] net: mpls: Fix notifications when deleting a device [5.10,069/130] siphash: use _unaligned version by default [5.10,070/130] arm64: ftrace: add missing BTIs [5.10,071/130] net/mlx4_en: Fix an use-after-free bug in mlx4_en_try_alloc_resources() [5.10,072/130] selftests: net: Correct case name [5.10,073/130] mt76: mt7915: fix NULL pointer dereference in mt7915_get_phy_mode [5.10,074/130] ASoC: tegra: Fix wrong value type in ADMAIF [5.10,075/130] ASoC: tegra: Fix wrong value type in I2S [5.10,076/130] ASoC: tegra: Fix wrong value type in DMIC [5.10,077/130] ASoC: tegra: Fix wrong value type in DSPK [5.10,078/130] ASoC: tegra: Fix kcontrol put callback in ADMAIF [5.10,079/130] ASoC: tegra: Fix kcontrol put callback in I2S [5.10,080/130] ASoC: tegra: Fix kcontrol put callback in DMIC [5.10,081/130] ASoC: tegra: Fix kcontrol put callback in DSPK [5.10,082/130] ASoC: tegra: Fix kcontrol put callback in AHUB [5.10,083/130] rxrpc: Fix rxrpc_peer leak in rxrpc_look_up_bundle() [5.10,084/130] rxrpc: Fix rxrpc_local leak in rxrpc_lookup_peer() [5.10,085/130] ALSA: intel-dsp-config: add quirk for CML devices based on ES8336 codec [5.10,086/130] net: usb: lan78xx: lan78xx_phy_init(): use PHY_POLL instead of "0" if no IRQ is av... [5.10,087/130] net: marvell: mvpp2: Fix the computation of shared CPUs [5.10,088/130] dpaa2-eth: destroy workqueue at the end of remove function [5.10,089/130] net: annotate data-races on txq->xmit_lock_owner [5.10,090/130] ipv4: convert fib_num_tclassid_users to atomic_t [5.10,091/130] net/smc: fix wrong list_del in smc_lgr_cleanup_early [5.10,092/130] net/rds: correct socket tunable error in rds_tcp_tune() [5.10,093/130] net/smc: Keep smc_close_final rc during active close [5.10,094/130] drm/msm/a6xx: Allocate enough space for GMU registers [5.10,095/130] drm/msm: Do hw_init() before capturing GPU state [5.10,096/130] atlantic: Increase delay for fw transactions [5.10,097/130] atlatnic: enable Nbase-t speeds with base-t [5.10,098/130] atlantic: Fix to display FW bundle version instead of FW mac version. [5.10,099/130] atlantic: Add missing DIDs and fix 115c. [5.10,100/130] Remove Half duplex mode speed capabilities. [5.10,101/130] atlantic: Fix statistics logic for production hardware [5.10,102/130] atlantic: Remove warn trace message. [5.10,103/130] KVM: x86/pmu: Fix reserved bits for AMD PerfEvtSeln register [5.10,104/130] KVM: VMX: Set failure code in prepare_vmcs02() [5.10,105/130] x86/sev: Fix SEV-ES INS/OUTS instructions for word, dword, and qword [5.10,106/130] x86/entry: Use the correct fence macro after swapgs in kernel CR3 [5.10,107/130] x86/xen: Add xenpv_restore_regs_and_return_to_usermode() [5.10,108/130] sched/uclamp: Fix rq->uclamp_max not set on first enqueue [5.10,109/130] x86/pv: Switch SWAPGS to ALTERNATIVE [5.10,110/130] x86/entry: Add a fence for kernel entry SWAPGS in paranoid_entry() [5.10,111/130] parisc: Fix KBUILD_IMAGE for self-extracting kernel [5.10,112/130] parisc: Fix "make install" on newer debian releases [5.10,113/130] vgacon: Propagate console boot parameters before calling `vc_resize [5.10,114/130] xhci: Fix commad ring abort, write all 64 bits to CRCR register. [5.10,115/130] USB: NO_LPM quirk Lenovo Powered USB-C Travel Hub [5.10,116/130] usb: typec: tcpm: Wait in SNK_DEBOUNCED until disconnect [5.10,117/130] x86/tsc: Add a timer to make sure TSC_adjust is always checked [5.10,118/130] x86/tsc: Disable clocksource watchdog for TSC on qualified platorms [5.10,119/130] x86/64/mm: Map all kernel memory into trampoline_pgd [5.10,120/130] tty: serial: msm_serial: Deactivate RX DMA for polling support [5.10,121/130] serial: pl011: Add ACPI SBSA UART match id [5.10,122/130] serial: tegra: Change lower tolerance baud rate limit for tegra20 and tegra30 [5.10,123/130] serial: core: fix transmit-buffer reset and memleak [5.10,124/130] serial: 8250_pci: Fix ACCES entries in pci_serial_quirks array [5.10,125/130] serial: 8250_pci: rewrite pericom_do_set_divisor() [5.10,126/130] serial: 8250: Fix RTS modem control while in rs485 mode [5.10,127/130] iwlwifi: mvm: retry init flow if failed [5.10,128/130] parisc: Mark cr16 CPU clocksource unstable on all SMP machines [5.10,129/130] net/tls: Fix authentication failure in CCM mode [5.10,130/130] ipmi: msghandler: Make symbol remove_work_wq static

[5.10,073/130] mt76: mt7915: fix NULL pointer dereference in mt7915_get_phy_mode

Commit Message

Patch