[PATCH] wifi: mt76: mt792x: fix NULL pointer dereference in mt792x_init_acpi_sar_power

[Marco Scardovi]

In mt792x_init_acpi_sar_power(), capa is obtained from
phy->mt76->hw->wiphy->sar_capa. On systems where ACPI SAR tables exist
(such as ASUS ROG laptops) but wiphy->sar_capa has not yet been
initialized (for instance, when a regulatory notifier triggers
mt7921_set_tx_sar_pwr() before the asynchronous dev->init_work
completes mt76_register_device()), capa is NULL.

Attempting to read capa->num_freq_ranges leads to a NULL pointer
dereference at offset 0x04:

  BUG: kernel NULL pointer dereference, address: 0000000000000004
  RIP: 0010:mt792x_init_acpi_sar_power+0x40/0x1ef [mt792x_lib]
  Call Trace:
   <TASK>
   mt792x_init_acpi_sar_power+0x40/0x1ef [mt792x_lib]
   mt7921_set_tx_sar_pwr+0x3b/0x70 [mt7921_common]
   mt7921_regd_notifier_work+0x1b/0x30 [mt7921_common]
   ...

Add a check for !capa and !phy->mt76->frp before dereferencing,
matching the existing defensive pattern in mt76/mac80211.c.

Fixes: f965333e491e ("mt76: mt7921: introduce ACPI SAR support")
Signed-off-by: Marco Scardovi <scardracs@xxxxxxxxxxx>
---
 drivers/net/wireless/mediatek/mt76/mt792x_acpi_sar.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/net/wireless/mediatek/mt76/mt792x_acpi_sar.c b/drivers/net/wireless/mediatek/mt76/mt792x_acpi_sar.c
index 946dd7956e4a..fbc2f9706dd4 100644
--- a/drivers/net/wireless/mediatek/mt76/mt792x_acpi_sar.c
+++ b/drivers/net/wireless/mediatek/mt76/mt792x_acpi_sar.c
@@ -326,6 +326,9 @@ int mt792x_init_acpi_sar_power(struct mt792x_phy *phy, bool set_default)
 	if (!phy->acpisar || !((struct mt792x_acpi_sar *)phy->acpisar)->dyn)
 		return 0;
 
+	if (!capa || !phy->mt76->frp)
+		return 0;
+
 	/* When ACPI SAR enabled in HW, we should apply rules for .frp
 	 * 1. w/o .sar_specs : set ACPI SAR power as the defatul value
 	 * 2. w/  .sar_specs : set power with min(.sar_specs, ACPI_SAR)
-- 
2.55.0