* [PATCH v2] mt76: fix buffer overrun in pkt buffer
[not found] <auQjsDPP1PeJg5sV@stanley.mountain>
@ 2026-10-30 9:05 ` Anthony Liu
2026-10-30 10:18 ` Dan Carpenter
0 siblings, 1 reply; 2+ messages in thread
From: Anthony Liu @ 2026-10-30 9:05 UTC (permalink / raw)
To: nbd, lorenzo
Cc: Sean.Wang, Leon.Yen, Quan.Zhou, Ryder.lee, litien.chang, kun.wu,
jb.tsai, emery.hsin, linux-arm-kernel, ingyujang25, shayne.chen,
angelogioacchino.delregno, lucid_duck, matthias.bgg, eason.lai,
linux-wireless, linux-mediatek, Anthony Liu, kernel test robot,
Dan Carpenter
The last patch (d4e5ca3483a0) addresses mt7928 F/W 4 byte-aligment
requirement by reducing pkt buffer by 2 bytes, causing the chance
of buffer overrun.
This patch reduces incoming skb length limit accordingly.
Fixes: d4e5ca3483a0 ("wifi: mt76: mt7928: makes struct beacon_tlv 4-byte aligned.")
Signed-off-by: Anthony Liu <anthony.liu@mediatek.com>
Reported-by: kernel test robot <lkp@intel.com>
Reported-by: Dan Carpenter <error27@gmail.com>
Reviewed-by: Dan Carpenter <error27@gmail.com>
Closes: https://lore.kernel.org/r/202610172141.mmRmGqow-lkp@intel.com/
---
drivers/net/wireless/mediatek/mt76/mt7925/mcu.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c
index 50f5f57b740e..37aeccb28efb 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c
@@ -2537,7 +2537,7 @@ mt7925_mcu_uni_add_beacon_offload(struct mt792x_dev *dev,
return -EINVAL;
}
- if (skb->len > 512) {
+ if (skb->len > sizeof(req.beacon_tlv.pkt)) {
dev_err(dev->mt76.dev, "beacon size limit exceed\n");
dev_kfree_skb(skb);
return -EINVAL;
--
2.45.2
^ permalink raw reply related [flat|nested] 2+ messages in thread