Skip to contentSkip to conversation

wifi: mt76: mt7996: avoid NULL pointer dereference in mt7996_set_monitor()

PATCH Superseded Qasim Ijaz 2 participants 2 messages Mar 22, 2025

Subsystems (2)
Arm MediaTek MediaTek MT76 wireless LAN driver
lore
Share & tools
lore

Qasim Ijaz

author
#0 lore raw

PATCH 1/1 wifi: mt76: mt7996: avoid NULL pointer dereference in mt7996_set_monitor()

The function mt7996_set_monitor() dereferences phy before the NULL sanity check.

Fix this to avoid NULL pointer dereference by moving the dereference after the check.

Fixes 69d54ce7491d ("wifi: mt76: mt7996: switch to single multi-radio wiphy")
Signed-off-by Qasim Ijaz <[email protected]>
---
 drivers/net/wireless/mediatek/mt76/mt7996/main.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/net/wireless/mediatek/mt76/mt7996/main.c +3 -1
index 91c64e3a0860..66575698aef1 100644
@@ -414,11 +414,13 @@ static void mt7996_phy_set_rxfilter(struct mt7996_phy *phy)
 
 static void mt7996_set_monitor(struct mt7996_phy *phy, bool enabled)
 {
-	struct mt7996_dev *dev = phy->dev;
+	struct mt7996_dev *dev;
 
 	if (!phy)
 		return;
 
+	dev = phy->dev;
+	
 	if (enabled == !(phy->rxfilter & MT_WF_RFCR_DROP_OTHER_UC))
 		return;
Signature · 1 line
2.39.5
#1 lore raw
Quoted 5 lines

The function mt7996_set_monitor() dereferences phy before the NULL sanity check.

Fix this to avoid NULL pointer dereference by moving the dereference after the check.

Were any known source code analysis tools involved for this software improvement?

Regards,
Markus