Passing a BSS conf pointer to mt76_connac2_mac_tx_rate_val() currently has two inconsistencies. When called from mt76_connac2_mac_write_txwi(), BSS conf is got by dereferencing a vif pointer. A NULL vif isn't accounted for though the function itself supposes it to be NULL and tries to handle this case in previous checks. This looks like a cosmetic change since the drivers calling the function (namely, mt7915 and mt7921) set WANT_MONITOR_VIF flag so judging by info->control.vif initialization inside ieee80211_tx_*() routines it can't actually come as NULL here. The same holds for the BSS conf pointer handling inside mt76_connac2_mac_tx_rate_val(). It is dereferenced before being checked for NULL. The function supposes to handle the case so reorder the check and dereference of the pointer. Again, this looks like a syntax issue only. Found by Linux Verification Center (linuxtesting.org) with SVACE static analysis tool. Co-developed-by: Matvey Kovalev Signed-off-by: Matvey Kovalev Signed-off-by: Fedor Pchelkin --- .../wireless/mediatek/mt76/mt76_connac_mac.c | 19 +++++++++++-------- 1 file changed, 11 insertions(+), 8 deletions(-) diff --git a/drivers/net/wireless/mediatek/mt76/mt76_connac_mac.c b/drivers/net/wireless/mediatek/mt76/mt76_connac_mac.c index 7af6a578562f..3304b5971be0 100644 --- a/drivers/net/wireless/mediatek/mt76/mt76_connac_mac.c +++ b/drivers/net/wireless/mediatek/mt76/mt76_connac_mac.c @@ -297,16 +297,18 @@ u16 mt76_connac2_mac_tx_rate_val(struct mt76_phy *mphy, struct ieee80211_bss_conf *conf, bool beacon, bool mcast) { - struct mt76_vif_link *mvif = mt76_vif_conf_link(mphy->dev, conf->vif, conf); - struct cfg80211_chan_def *chandef = mvif->ctx ? - &mvif->ctx->def : &mphy->chandef; - u8 nss = 0, mode = 0, band = chandef->chan->band; - int rateidx = 0, mcast_rate; - int offset = 0; + u8 nss = 0, mode = 0, band = NL80211_BAND_2GHZ; + int rateidx = 0, offset = 0, mcast_rate; + struct cfg80211_chan_def *chandef; + struct mt76_vif_link *mvif; if (!conf) goto legacy; + mvif = mt76_vif_conf_link(mphy->dev, conf->vif, conf); + chandef = mvif->ctx ? &mvif->ctx->def : &mphy->chandef; + band = chandef->chan->band; + if (is_mt7921(mphy->dev)) { rateidx = ffs(conf->basic_rates) - 1; goto legacy; @@ -584,8 +586,9 @@ void mt76_connac2_mac_write_txwi(struct mt76_dev *dev, __le32 *txwi, struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data; bool multicast = ieee80211_is_data(hdr->frame_control) && is_multicast_ether_addr(hdr->addr1); - u16 rate = mt76_connac2_mac_tx_rate_val(mphy, &vif->bss_conf, beacon, - multicast); + u16 rate = mt76_connac2_mac_tx_rate_val(mphy, + vif ? &vif->bss_conf : NULL, + beacon, multicast); u32 val = MT_TXD6_FIXED_BW; /* hardware won't add HTC for mgmt/ctrl frame */ -- 2.51.0