mt76: mt7615: fix NULL pointer deref in mt7615_register_ext_phy

Fix following NULL pointer dereference in mt7615_register_ext_phy routine

[   27.648860] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000060
[   27.657697] Mem abort info:
[   27.660495]   ESR = 0x96000046
[   27.663549]   EC = 0x25: DABT (current EL), IL = 32 bits
[   27.668857]   SET = 0, FnV = 0
[   27.671910]   EA = 0, S1PTW = 0
[   27.675040] Data abort info:
[   27.677918]   ISV = 0, ISS = 0x00000046
[   27.681751]   CM = 0, WnR = 1
[   27.684717] user pgtable: 4k pages, 39-bit VAs, pgdp=000000007d8cc000
[   27.691156] [0000000000000060] pgd=000000007d281003, pud=000000007d281003, pmd=0000000000000000
[   27.699857] Internal error: Oops: 96000046 [#1] SMP
[   27.774939] CPU: 1 PID: 701 Comm: ash Not tainted 5.4.41 #0
[   27.780500] Hardware name: Bananapi BPI-R64 (DT)
[   27.785108] pstate: 60000005 (nZCv daif -PAN -UAO)
[   27.789897] pc : mt7615_register_ext_phy+0x60/0x2c8 [mt7615_common]
[   27.796156] lr : mt7615_init_debugfs+0x99c/0x18e0 [mt7615_common]
[   27.802237] sp : ffffffc0115dbcb0
[   27.805541] x29: ffffffc0115dbcb0 x28: ffffff803e309600
[   27.810843] x27: 0000000000000000 x26: 0000000000000000
[   27.816144] x25: ffffff803d936928 x24: ffffff803d936950
[   27.821447] x23: 0000000000000000 x22: 0000000fffffffe0
[   27.826749] x21: 0000000000000002 x20: ffffff8001e82620
[   27.832050] x19: 0000000000000000 x18: 0000000000000000
[   27.837352] x17: 0000000000000000 x16: 0000000000000000
[   27.842653] x15: 0000000000000000 x14: 0000000000000000
[   27.847955] x13: 0000000000000000 x12: 0000000000000000
[   27.853256] x11: 0000000000000000 x10: 0000000000000040
[   27.858558] x9 : ffffffc0112b3eb0 x8 : ffffffc0112b3ea8
[   27.863859] x7 : ffffff803e400048 x6 : 0000000000000000
[   27.869161] x5 : ffffff803e400000 x4 : 0000000000000000
[   27.874462] x3 : 0000000000000001 x2 : 0000000000007615
[   27.879764] x1 : 0000000000000068 x0 : ffffffc0088ccc58
[   27.885066] Call trace:
[   27.887505]  mt7615_register_ext_phy+0x60/0x2c8 [mt7615_common]
[   27.893416]  mt7615_init_debugfs+0x99c/0x18e0 [mt7615_common]
[   27.899156]  simple_attr_write+0xf0/0x178
[   27.903158]  debugfs_attr_write+0x4c/0x70
[   27.907159]  full_proxy_write+0x60/0x90
[   27.910987]  __vfs_write+0x18/0x40
[   27.914379]  vfs_write+0xb0/0x1b8
[   27.917685]  ksys_write+0x4c/0xc8
[   27.920989]  __arm64_sys_write+0x18/0x20

Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Signed-off-by: Felix Fietkau <nbd@nbd.name>

diff --git a/drivers/net/wireless/mediatek/mt76/mt7615/init.c b/drivers/net/wireless/mediatek/mt76/mt7615/init.c
index 18a570ffb8157e97210bd2cb107936403c3e9931..0d105e4abdfd2aad4d93293f4b41210a854664c3 100644 (file)
--- a/drivers/net/wireless/mediatek/mt76/mt7615/init.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7615/init.c
@@ -372,15 +372,6 @@ int mt7615_register_ext_phy(struct mt7615_dev *dev)
        if (phy)
                return 0;
 
-       INIT_DELAYED_WORK(&phy->mac_work, mt7615_mac_work);
-       INIT_DELAYED_WORK(&phy->scan_work, mt7615_scan_work);
-       skb_queue_head_init(&phy->scan_event_list);
-
-       INIT_WORK(&phy->ps_work, mt7615_ps_work);
-       INIT_WORK(&phy->roc_work, mt7615_roc_work);
-       timer_setup(&phy->roc_timer, mt7615_roc_timer, 0);
-       init_waitqueue_head(&phy->roc_wait);
-
        mt7615_cap_dbdc_enable(dev);
        mphy = mt76_alloc_phy(&dev->mt76, sizeof(*phy), &mt7615_ops);
        if (!mphy)
@@ -393,6 +384,15 @@ int mt7615_register_ext_phy(struct mt7615_dev *dev)
        mphy->antenna_mask = BIT(hweight8(phy->chainmask)) - 1;
        mt7615_init_wiphy(mphy->hw);
 
+       INIT_DELAYED_WORK(&phy->mac_work, mt7615_mac_work);
+       INIT_DELAYED_WORK(&phy->scan_work, mt7615_scan_work);
+       skb_queue_head_init(&phy->scan_event_list);
+
+       INIT_WORK(&phy->ps_work, mt7615_ps_work);
+       INIT_WORK(&phy->roc_work, mt7615_roc_work);
+       timer_setup(&phy->roc_timer, mt7615_roc_timer, 0);
+       init_waitqueue_head(&phy->roc_wait);
+
        mt7615_mac_set_scs(phy, true);
 
        /*