Files
mt76/mt7996
Felix Fietkau 06b69763f2 wifi: mt76: mt7996: fix infinite loop in PS sync event parsing
A zero-length TLV makes the parser loop spin forever, since neither
skb_pull() nor the remaining length advance, hanging the RX NAPI thread
until RCU reports a stall.

Reject TLVs shorter than their header, and validate the per-tag payload
lengths before dereferencing them.

Fixes: https://github.com/openwrt/mt76/issues/1109
Signed-off-by: Felix Fietkau <[email protected]>
2026-07-27 17:01:10 +02:00
..
2026-06-30 09:55:10 +02:00