gitops/mt76
1
0
Fork 0
mirror of https://github.com/outbackdingo/mt76.git synced 2026-10-24 21:36:52 +00:00
Code Issues Packages Projects Releases Wiki Activity

wifi: mt76: mt7996: bound RRO session id before indexing addr_elem[]

Browse Source 
seq_id from the WED RRO indication is a 12-bit field (0-4095), but only
values up to MT7996_RRO_MAX_SESSION map into wed_rro.addr_elem[], which
has MT7996_RRO_ADDR_ELEM_LEN (128) entries. A larger session id computes
an out-of-bounds element index that is then read and, on a signature
mismatch, written. Reject an out-of-range session id.

Fixes: a09d2f9d69af ("wifi: mt76: Convert mt76_wed_rro_ind to LE")
Signed-off-by: Felix Fietkau <[email protected]>
This commit is contained in:
Felix Fietkau
2026-08-01 17:46:21 +02:00
parent 5367804a6a
commit 686b509b9f
1 changed files with 3 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
mt7996/mac.c
+3
View File
@@ -1941,6 +1941,9 @@ void mt7996_rro_rx_process(struct mt76_dev *mdev, void *data)
struct mt7996_msdu_page *p = NULL;
int i, seq_num = 0;
if (seq_id > MT7996_RRO_MAX_SESSION)
return;
for (i = 0; i < ind_count; i++) {
struct mt7996_wed_rro_addr *e;
struct mt76_rx_status *status;