Re: [PATCH] wifi: mwifiex: fix NULL dereference when the AP has HT-cap but no HT-oper

[Francesco Dolcini]

On Thu, Jul 16, 2026 at 12:30:42PM +0200, Doruk Tan Ozturk wrote:
> mwifiex_tdls_add_ht_oper() gates its follow-the-AP-bandwidth path on
> bss_desc->bcn_ht_cap being present, but then dereferences a different
> pointer, bss_desc->bcn_ht_oper:
> 
> 	if (ISSUPP_CHANWIDTH40(priv->adapter->hw_dot_11n_dev_cap) &&
> 	    bss_desc->bcn_ht_cap &&
> 	    ISALLOWED_CHANWIDTH40(bss_desc->bcn_ht_oper->ht_param))
> 
> bcn_ht_cap and bcn_ht_oper are populated independently while parsing the
> associated AP's beacon in mwifiex_update_bss_desc_with_ie(): an AP that
> advertises an HT Capabilities element but no HT Operation element leaves
> bcn_ht_cap non-NULL and bcn_ht_oper NULL. Setting up a TDLS link to a
> peer while associated to such an AP then dereferences the NULL
> bcn_ht_oper and crashes the kernel. Every other bcn_ht_oper user in the
> driver NULL-checks it first.
> 
> Guard on the pointer that is actually dereferenced.
> 
> Found by 0sec automated security-research tooling (https://0sec.ai).
> 
> Fixes: 396939f94084 ("mwifiex: add HT operation IE in TDLS setup confirm")
> Cc: stable@xxxxxxxxxxxxxxx
> Assisted-by: 0sec:multi-model
> Signed-off-by: Doruk Tan Ozturk <doruk@xxxxxxx>

Reviewed-by: Francesco Dolcini <francesco.dolcini@xxxxxxxxxxx>