Files
mt76/mt7996
Felix Fietkau fc74da790f wifi: mt76: mt7996: validate RX band_idx before dereferencing phys[]
band_idx comes from a 2-bit descriptor field (0-3) and was used directly
to index dev->mt76.phys[] (size __MT_MAX_BAND == 3) and dereference the
result. A corrupt or reserved descriptor value could index out of bounds
or hit a NULL phy on parts with fewer bands. Reject invalid band indices,
mirroring mt7996_rx_get_wcid().

Fixes: 98686cd21624 ("wifi: mt76: mt7996: add driver for MediaTek Wi-Fi 7 (802.11be) devices")
Link: https://patch.msgid.link/[email protected]
Signed-off-by: Felix Fietkau <[email protected]>
2026-07-22 10:51:04 +02:00
..
2026-06-30 09:55:10 +02:00
2026-06-30 09:55:10 +02:00