Felix Fietkau 06b69763f2 wifi: mt76: mt7996: fix infinite loop in PS sync event parsing
A zero-length TLV makes the parser loop spin forever, since neither
skb_pull() nor the remaining length advance, hanging the RX NAPI thread
until RCU reports a stall.

Reject TLVs shorter than their header, and validate the per-tag payload
lengths before dereferencing them.

Fixes: https://github.com/openwrt/mt76/issues/1109
Signed-off-by: Felix Fietkau <[email protected]>
2026-07-27 17:01:10 +02:00
2021-04-14 09:12:11 +02:00
2025-10-13 11:11:19 +02:00
2026-05-04 08:37:03 +00:00
2026-07-21 12:09:57 +02:00
2026-07-21 12:09:57 +02:00
S
Description
mac80211 driver for MediaTek MT76x0e, MT76x2e, MT7603, MT7615, MT7628 and MT7688
BSD-3-Clause
105 MiB
Languages
C 99.7%
Perl 0.2%
Makefile 0.1%