mirror of
https://github.com/outbackdingo/mt76.git
synced 2026-10-24 21:36:52 +00:00
A zero-length TLV makes the parser loop spin forever, since neither skb_pull() nor the remaining length advance, hanging the RX NAPI thread until RCU reports a stall. Reject TLVs shorter than their header, and validate the per-tag payload lengths before dereferencing them. Fixes: https://github.com/openwrt/mt76/issues/1109 Signed-off-by: Felix Fietkau <[email protected]>