Felix Fietkau 686b509b9f wifi: mt76: mt7996: bound RRO session id before indexing addr_elem[] ...

seq_id from the WED RRO indication is a 12-bit field (0-4095), but only
values up to MT7996_RRO_MAX_SESSION map into wed_rro.addr_elem[], which
has MT7996_RRO_ADDR_ELEM_LEN (128) entries. A larger session id computes
an out-of-bounds element index that is then read and, on a signature
mismatch, written. Reject an out-of-range session id.

Fixes: a09d2f9d69af ("wifi: mt76: Convert mt76_wed_rro_ind to LE")
Signed-off-by: Felix Fietkau <[email protected]>

2026-08-01 17:46:21 +02:00

..

coredump.c

wifi: mt76: mt7915: guard firmware memory dump write on disabled memdump

2026-08-01 17:46:21 +02:00

coredump.h

wifi: mt76: relicense to BSD-3-Clause-Clear

2025-10-13 11:11:19 +02:00

debugfs.c

wifi: mt76: mt7996: HW ATF support

2026-06-30 09:55:10 +02:00

dma.c

wifi: mt76: mt7996: Fix NULL pointer dereference in mt7996_init_tx_queues()

2026-05-28 11:16:16 +02:00

eeprom.c

wifi: mt76: mt7996: validate default EEPROM firmware size

2026-07-21 12:38:45 +02:00

eeprom.h

wifi: mt76: relicense to BSD-3-Clause-Clear

2025-10-13 11:11:19 +02:00

init.c

wifi: mt76: mt7996: add mcu command to set bssid mapping address

2026-07-24 14:45:39 +02:00

Kconfig

wifi: mt76: mt7996: Add NPU offload support to MT7996 driver

2025-10-30 11:54:43 +00:00

mac.c

wifi: mt76: mt7996: bound RRO session id before indexing addr_elem[]

2026-08-01 17:46:21 +02:00

mac.h

wifi: mt76: mt7996: offload radar threshold initialization

2026-01-27 10:02:43 +00:00

main.c

wifi: mt76: mt7996: fix out-of-bounds link array access in mt7996_tx()

2026-08-01 17:45:48 +02:00

Makefile

wifi: mt76: mt7996: Add NPU offload support to MT7996 driver

2025-10-30 11:54:43 +00:00

mcu.c

wifi: mt76: mt7996: validate firmware event lengths before parsing

2026-08-01 17:46:20 +02:00

mcu.h

wifi: mt76: mt7996: leave PS when a 4-address connection is established

2026-07-24 14:45:39 +02:00

mmio.c

wifi: mt76: mt7996: handle UNI PS sync events

2026-05-07 08:39:05 +00:00

mt7996.h

wifi: mt76: mt7996: leave PS when a 4-address connection is established

2026-07-24 14:45:39 +02:00

npu.c

wifi: mt76: mt7996: Store DMA mapped buffer addresses in mt7996_npu_hw_init()

2026-01-27 11:56:18 +00:00

pci.c

wifi: mt76: mt7996: remove redundant pdev->bus check in probe

2026-06-02 11:54:17 +02:00

regs.h

wifi: mt76: mt7996: update WFSYS reset flow for MT7990 chipsets

2026-03-14 08:32:20 +00:00