gitops/mt76
1
0
Fork 0
mirror of https://github.com/outbackdingo/mt76.git synced 2026-10-24 13:26:48 +00:00
Code Issues Packages Projects Releases Wiki Activity

wifi: mt76: mt7996: Fix possible OOB access in mt7996_tx()

Browse Source 
Fis possible Out-Of-Boundary access in mt7996_tx routine if link_id is
set to IEEE80211_LINK_UNSPECIFIED

Fixes: 3ce8acb86b661 ("wifi: mt76: mt7996: Update mt7996_tx to MLO support")
Signed-off-by: Lorenzo Bianconi <[email protected]>
Link: https://patch.msgid.link/[email protected]
Signed-off-by: Felix Fietkau <[email protected]>
This commit is contained in:
Lorenzo Bianconi
2025-07-07 18:03:48 +02:00
committed by Felix Fietkau
parent 32f8c5849e
commit ffff9f71e2
1 changed files with 12 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
mt7996/main.c
+11 -4
View File
@@ -1214,10 +1214,17 @@ static void mt7996_tx(struct ieee80211_hw *hw,
if (vif) {
struct mt7996_vif *mvif = (void *)vif->drv_priv;
struct mt76_vif_link *mlink;
struct mt76_vif_link *mlink = &mvif->deflink.mt76;
if (link_id < IEEE80211_LINK_UNSPECIFIED)
mlink = rcu_dereference(mvif->mt76.link[link_id]);
if (mlink && mlink->wcid)
if (!mlink) {
ieee80211_free_txskb(hw, skb);
goto unlock;
}
if (mlink->wcid)
wcid = mlink->wcid;
if (mvif->mt76.roc_phy &&
@@ -1226,7 +1233,7 @@ static void mt7996_tx(struct ieee80211_hw *hw,
if (mphy->roc_link)
wcid = mphy->roc_link->wcid;
} else {
mphy = mt76_vif_link_phy(&mvif->deflink.mt76);
mphy = mt76_vif_link_phy(mlink);
}
}
@@ -1235,7 +1242,7 @@ static void mt7996_tx(struct ieee80211_hw *hw,
goto unlock;
}
if (control->sta) {
if (control->sta && link_id < IEEE80211_LINK_UNSPECIFIED) {
struct mt7996_sta *msta = (void *)control->sta->drv_priv;
struct mt7996_sta_link *msta_link;