Felix Fietkau fc74da790f wifi: mt76: mt7996: validate RX band_idx before dereferencing phys[]
band_idx comes from a 2-bit descriptor field (0-3) and was used directly
to index dev->mt76.phys[] (size __MT_MAX_BAND == 3) and dereference the
result. A corrupt or reserved descriptor value could index out of bounds
or hit a NULL phy on parts with fewer bands. Reject invalid band indices,
mirroring mt7996_rx_get_wcid().

Fixes: 98686cd21624 ("wifi: mt76: mt7996: add driver for MediaTek Wi-Fi 7 (802.11be) devices")
Link: https://patch.msgid.link/[email protected]
Signed-off-by: Felix Fietkau <[email protected]>
2026-07-22 10:51:04 +02:00
2021-04-14 09:12:11 +02:00
2025-10-13 11:11:19 +02:00
2026-05-04 08:37:03 +00:00
2026-07-21 12:09:57 +02:00
2026-07-21 12:09:57 +02:00
S
Description
mac80211 driver for MediaTek MT76x0e, MT76x2e, MT7603, MT7615, MT7628 and MT7688
BSD-3-Clause
105 MiB
Languages
C 99.7%
Perl 0.2%
Makefile 0.1%