mirror of
https://github.com/outbackdingo/mt76.git
synced 2026-10-24 05:16:57 +00:00
06b69763f2aa9f5e0a9c5cd334813612bd4a2f9c
A zero-length TLV makes the parser loop spin forever, since neither skb_pull() nor the remaining length advance, hanging the RX NAPI thread until RCU reports a stall. Reject TLVs shorter than their header, and validate the per-tag payload lengths before dereferencing them. Fixes: https://github.com/openwrt/mt76/issues/1109 Signed-off-by: Felix Fietkau <[email protected]>
Description
mac80211 driver for MediaTek MT76x0e, MT76x2e, MT7603, MT7615, MT7628 and MT7688
105 MiB
Languages
C
99.7%
Perl
0.2%
Makefile
0.1%