gitops/mt76
1
0
Fork 0
mirror of https://github.com/outbackdingo/mt76.git synced 2026-10-24 21:36:52 +00:00
Code Issues Packages Projects Releases Wiki Activity

wifi: mt76: mt7925: fix off by one in mt7925_mcu_hw_scan()

Browse Source 
The ssid->ssids[] and sreq->ssids[] arrays have MT7925_RNR_SCAN_MAX_BSSIDS
elements so this >= needs to be > to prevent an out of bounds access.

Fixes: 8284815ca161 ("wifi: mt76: mt7925: add RNR scan support for 6GHz")
Signed-off-by: Dan Carpenter <[email protected]>
Link: https://patch.msgid.link/[email protected]
Signed-off-by: Felix Fietkau <[email protected]>
This commit is contained in:
Dan Carpenter
2025-06-18 16:47:52 +02:00
committed by Felix Fietkau
parent 4bdc4c5f26
commit 321ae47a74
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
mt7925/mcu.c
+2 -2
View File
@@ -2918,7 +2918,7 @@ int mt7925_mcu_hw_scan(struct mt76_phy *phy, struct ieee80211_vif *vif,
for (i = 0; i < sreq->n_ssids; i++) {
if (!sreq->ssids[i].ssid_len)
continue;
if (i > MT7925_RNR_SCAN_MAX_BSSIDS)
if (i >= MT7925_RNR_SCAN_MAX_BSSIDS)
break;
short_ssid[n_ssids] = ~crc32_le(~0, sreq->ssids[i].ssid,
@@ -2937,7 +2937,7 @@ int mt7925_mcu_hw_scan(struct mt76_phy *phy, struct ieee80211_vif *vif,
mt76_connac_mcu_build_rnr_scan_param(mdev, sreq);
for (j = 0; j < mdev->rnr.bssid_num; j++) {
if (j > MT7925_RNR_SCAN_MAX_BSSIDS)
if (j >= MT7925_RNR_SCAN_MAX_BSSIDS)
break;
tlv = mt76_connac_mcu_add_tlv(skb, UNI_SCAN_BSSID,