gitops/mt76
1
0
Fork 0
mirror of https://github.com/outbackdingo/mt76.git synced 2026-10-24 05:16:57 +00:00
Code Issues Packages Projects Releases Wiki Activity

wifi: mt76: mt7996: validate RX band_idx before dereferencing phys[]

Browse Source 
band_idx comes from a 2-bit descriptor field (0-3) and was used directly
to index dev->mt76.phys[] (size __MT_MAX_BAND == 3) and dereference the
result. A corrupt or reserved descriptor value could index out of bounds
or hit a NULL phy on parts with fewer bands. Reject invalid band indices,
mirroring mt7996_rx_get_wcid().

Fixes: 98686cd21624 ("wifi: mt76: mt7996: add driver for MediaTek Wi-Fi 7 (802.11be) devices")
Link: https://patch.msgid.link/[email protected]
Signed-off-by: Felix Fietkau <[email protected]>
This commit is contained in:
Felix Fietkau
2026-07-22 10:51:04 +02:00
parent 620e45de30
commit fc74da790f
1 changed files with 6 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
mt7996/mac.c
+6
View File
@@ -441,7 +441,13 @@ mt7996_mac_fill_rx(struct mt7996_dev *dev, enum mt76_rxq_id q,
memset(status, 0, sizeof(*status));
band_idx = FIELD_GET(MT_RXD1_NORMAL_BAND_IDX, rxd1);
if (!mt7996_band_valid(dev, band_idx))
return -EINVAL;
mphy = dev->mt76.phys[band_idx];
if (!mphy)
return -EINVAL;
phy = mphy->priv;
status->phy_idx = mphy->band_idx;