From 63f18baa5bb6d6644a6d25f0ffa2ee587127e957 Mon Sep 17 00:00:00 2001 From: Michael Lo Date: Thu, 12 Jun 2025 14:20:46 +0800 Subject: [PATCH] wifi: mt76: mt7925: fix invalid array index in ssid assignment during hw scan Update the destination index to use 'n_ssids', which is incremented only when a valid SSID is present. Previously, both mt76_connac_mcu_hw_scan() and mt7925_mcu_hw_scan() used the loop index 'i' for the destination array, potentially leaving gaps if any source SSIDs had zero length. Cc: stable@vger.kernel.org Fixes: c948b5da6bbe ("wifi: mt76: mt7925: add Mediatek Wi-Fi7 driver for mt7925 chips") Signed-off-by: Michael Lo Signed-off-by: Ming Yen Hsieh Link: https://patch.msgid.link/20250612062046.160598-1-mingyen.hsieh@mediatek.com Signed-off-by: Felix Fietkau --- mt76_connac_mcu.c | 4 ++-- mt7925/mcu.c | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/mt76_connac_mcu.c b/mt76_connac_mcu.c index fa08e952..16db0f20 100644 --- a/mt76_connac_mcu.c +++ b/mt76_connac_mcu.c @@ -1740,8 +1740,8 @@ int mt76_connac_mcu_hw_scan(struct mt76_phy *phy, struct ieee80211_vif *vif, if (!sreq->ssids[i].ssid_len) continue; - req->ssids[i].ssid_len = cpu_to_le32(sreq->ssids[i].ssid_len); - memcpy(req->ssids[i].ssid, sreq->ssids[i].ssid, + req->ssids[n_ssids].ssid_len = cpu_to_le32(sreq->ssids[i].ssid_len); + memcpy(req->ssids[n_ssids].ssid, sreq->ssids[i].ssid, sreq->ssids[i].ssid_len); n_ssids++; } diff --git a/mt7925/mcu.c b/mt7925/mcu.c index 0375b390..b6365bf9 100644 --- a/mt7925/mcu.c +++ b/mt7925/mcu.c @@ -2871,9 +2871,9 @@ int mt7925_mcu_hw_scan(struct mt76_phy *phy, struct ieee80211_vif *vif, if (i > MT7925_RNR_SCAN_MAX_BSSIDS) break; - short_ssid[i] = ~crc32_le(~0, sreq->ssids[i].ssid, + short_ssid[n_ssids] = ~crc32_le(~0, sreq->ssids[i].ssid, sreq->ssids[i].ssid_len); - ssid->ssids[i].ssid_len = cpu_to_le32(sreq->ssids[i].ssid_len); + ssid->ssids[n_ssids].ssid_len = cpu_to_le32(sreq->ssids[i].ssid_len); memcpy(ssid->ssids[i].ssid, sreq->ssids[i].ssid, sreq->ssids[i].ssid_len); n_ssids++;