| Message ID | 20250218024849.1993192-1-mingyen.hsieh@mediatek.com (mailing list archive) |
|---|---|
| State | Superseded |
| Delegated to: | Felix Fietkau |
| Headers | show |
| Series | [net-next] wifi: mt76: mt7921: fix kernel panic due to null pointer dereference | expand |
Mingyen Hsieh <mingyen.hsieh@mediatek.com> wrote: > From: Ming Yen Hsieh <mingyen.hsieh@mediatek.com> > > This patch addresses a kernel panic caused by a null pointer dereference in the Imperative mood. Just "Address a kernel panic ..." > `mt792x_rx_get_wcid` function. The issue arises because the `deflink` structure > is not properly initialized with the `sta` context. This patch ensures that the > `deflink` structure is correctly linked to the `sta` context, preventing the > null pointer dereference. > > [ 32.098574] BUG: kernel NULL pointer dereference, address: 0000000000000400 > [ 32.098620] #PF: supervisor read access in kernel mode > [ 32.098634] #PF: error_code(0x0000) - not-present page > [ 32.098647] PGD 0 P4D 0 > [ 32.098665] Oops: Oops: 0000 [#1] PREEMPT SMP NOPTI > [ 32.098683] CPU: 0 UID: 0 PID: 470 Comm: mt76-usb-rx phy Not tainted 6.12.13-gentoo-dist #1 > [ 32.098703] Hardware name: /AMD HUDSON-M1, BIOS 4.6.4 11/15/2011 > [ 32.098717] RIP: 0010:mt792x_rx_get_wcid+0x48/0x140 [mt792x_lib] > [ 32.098776] RSP: 0018:ffffa147c055fd98 EFLAGS: 00010202 > [ 32.098792] RAX: 0000000000000000 RBX: ffff8e9ecb652000 RCX: 0000000000000000 > [ 32.098806] RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffff8e9ecb652000 > [ 32.098819] RBP: 0000000000000685 R08: ffff8e9ec6570000 R09: 0000000000000000 > [ 32.098832] R10: ffff8e9ecd2ca000 R11: ffff8e9f22a217c0 R12: 0000000038010119 > [ 32.098845] R13: 0000000080843801 R14: ffff8e9ec6570000 R15: ffff8e9ecb652000 > [ 32.098860] FS: 0000000000000000(0000) GS:ffff8e9f22a00000(0000) knlGS:0000000000000000 > [ 32.098876] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 > [ 32.098889] CR2: 0000000000000400 CR3: 000000000d2ea000 CR4: 00000000000006f0 > [ 32.098903] Call Trace: > [ 32.098918] <TASK> > [ 32.098932] ? __die_body.cold+0x19/0x27 > [ 32.098955] ? page_fault_oops+0x15a/0x2f0 > [ 32.098975] ? search_module_extables+0x19/0x60 > [ 32.098995] ? search_bpf_extables+0x5f/0x80 > [ 32.099012] ? exc_page_fault+0x7e/0x180 > [ 32.099030] ? asm_exc_page_fault+0x26/0x30 > [ 32.099054] ? mt792x_rx_get_wcid+0x48/0x140 [mt792x_lib] > [ 32.099084] mt7921_queue_rx_skb+0x1c6/0xaa0 [mt7921_common] > [ 32.099114] mt76u_alloc_queues+0x784/0x810 [mt76_usb] > [ 32.099140] ? __pfx___mt76_worker_fn+0x10/0x10 [mt76] > [ 32.099172] __mt76_worker_fn+0x4f/0x80 [mt76] > [ 32.099203] kthread+0xd2/0x100 > [ 32.099221] ? __pfx_kthread+0x10/0x10 > [ 32.099237] ret_from_fork+0x34/0x50 > [ 32.099254] ? __pfx_kthread+0x10/0x10 > [ 32.099269] ret_from_fork_asm+0x1a/0x30 > [ 32.099290] </TASK> > [ 32.099719] ---[ end trace 0000000000000000 ]--- No need boot time since they are useless to core trace.
diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/main.c b/drivers/net/wireless/mediatek/mt76/mt7921/main.c index 13e58c328aff..78b77a54d195 100644 --- a/drivers/net/wireless/mediatek/mt76/mt7921/main.c +++ b/drivers/net/wireless/mediatek/mt76/mt7921/main.c @@ -811,6 +811,7 @@ int mt7921_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif, msta->deflink.wcid.phy_idx = mvif->bss_conf.mt76.band_idx; msta->deflink.wcid.tx_info |= MT_WCID_TX_INFO_SET; msta->deflink.last_txs = jiffies; + msta->deflink.sta = msta; ret = mt76_connac_pm_wake(&dev->mphy, &dev->pm); if (ret)