* Re: [PATCH] mt76: fix buffer overrun in pkt buffer [not found] <20261020032201.568970-1-anthony.liu@mediatek.com> @ 2026-10-30 4:57 ` Dan Carpenter 2026-10-30 9:05 ` [PATCH v2] " Anthony Liu 0 siblings, 1 reply; 3+ messages in thread From: Dan Carpenter @ 2026-10-30 4:57 UTC (permalink / raw) To: anthony.liu Cc: nbd, lorenzo, Leon.Yen, Quan.Zhou, Ryder.lee, Sean.Wang, emery.hsin, jb.tsai, kun.wu, linux-mediatek, linux-wireless, litien.chang, kernel test robot On Tue, Oct 20, 2026 at 11:22:00AM +0800, anthony.liu@mediatek.com wrote: > From: Anthony Liu <anthony.liu@mediatek.com> > > The last patch (d4e5ca3483a0) addresses mt7928 F/W 4 byte-aligment > requirement by reducing pkt buffer by 2 bytes, causing the chance > of buffer overrun. > > This patch reduces incoming skb length limit accordingly. > > Fixes: d4e5ca3483a0 ("wifi: mt76: mt7928: makes struct beacon_tlv 4-byte aligned.") > Signed-off-by: Anthony Liu <anthony.liu@mediatek.com> > Reported-by: kernel test robot <lkp@intel.com> > Reported-by: Dan Carpenter <error27@gmail.com> > Closes: https://lore.kernel.org/r/202610172141.mmRmGqow-lkp@intel.com/ > > diff --git a/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c > index 26cdb3f0a98a..131585b3359d 100644 > --- a/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c > +++ b/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c > @@ -2479,7 +2479,7 @@ mt7925_mcu_uni_add_beacon_offload(struct mt792x_dev *dev, > return -EINVAL; > } > > - if (skb->len > 512) { > + if (skb->len > 510) { I would probably use: if (skb->len > sizeof(req.beacon_tlv.pkt)) { but, we do need to apply this patch in linux-next. regards, dan carpenter ^ permalink raw reply [flat|nested] 3+ messages in thread
* [PATCH v2] mt76: fix buffer overrun in pkt buffer 2026-10-30 4:57 ` [PATCH] mt76: fix buffer overrun in pkt buffer Dan Carpenter @ 2026-10-30 9:05 ` Anthony Liu 2026-10-30 10:18 ` Dan Carpenter 0 siblings, 1 reply; 3+ messages in thread From: Anthony Liu @ 2026-10-30 9:05 UTC (permalink / raw) To: nbd, lorenzo Cc: Sean.Wang, Leon.Yen, Quan.Zhou, Ryder.lee, litien.chang, kun.wu, jb.tsai, emery.hsin, linux-arm-kernel, ingyujang25, shayne.chen, angelogioacchino.delregno, lucid_duck, matthias.bgg, eason.lai, linux-wireless, linux-mediatek, Anthony Liu, kernel test robot, Dan Carpenter The last patch (d4e5ca3483a0) addresses mt7928 F/W 4 byte-aligment requirement by reducing pkt buffer by 2 bytes, causing the chance of buffer overrun. This patch reduces incoming skb length limit accordingly. Fixes: d4e5ca3483a0 ("wifi: mt76: mt7928: makes struct beacon_tlv 4-byte aligned.") Signed-off-by: Anthony Liu <anthony.liu@mediatek.com> Reported-by: kernel test robot <lkp@intel.com> Reported-by: Dan Carpenter <error27@gmail.com> Reviewed-by: Dan Carpenter <error27@gmail.com> Closes: https://lore.kernel.org/r/202610172141.mmRmGqow-lkp@intel.com/ --- drivers/net/wireless/mediatek/mt76/mt7925/mcu.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c index 50f5f57b740e..37aeccb28efb 100644 --- a/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c +++ b/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c @@ -2537,7 +2537,7 @@ mt7925_mcu_uni_add_beacon_offload(struct mt792x_dev *dev, return -EINVAL; } - if (skb->len > 512) { + if (skb->len > sizeof(req.beacon_tlv.pkt)) { dev_err(dev->mt76.dev, "beacon size limit exceed\n"); dev_kfree_skb(skb); return -EINVAL; -- 2.45.2 ^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH v2] mt76: fix buffer overrun in pkt buffer 2026-10-30 9:05 ` [PATCH v2] " Anthony Liu @ 2026-10-30 10:18 ` Dan Carpenter 0 siblings, 0 replies; 3+ messages in thread From: Dan Carpenter @ 2026-10-30 10:18 UTC (permalink / raw) To: Anthony Liu Cc: nbd, lorenzo, Sean.Wang, Leon.Yen, Quan.Zhou, Ryder.lee, litien.chang, kun.wu, jb.tsai, emery.hsin, linux-arm-kernel, ingyujang25, shayne.chen, angelogioacchino.delregno, lucid_duck, matthias.bgg, eason.lai, linux-wireless, linux-mediatek, kernel test robot On Fri, Oct 30, 2026 at 05:05:54PM +0800, Anthony Liu wrote: > The last patch (d4e5ca3483a0) addresses mt7928 F/W 4 byte-aligment > requirement by reducing pkt buffer by 2 bytes, causing the chance > of buffer overrun. > > This patch reduces incoming skb length limit accordingly. > > Fixes: d4e5ca3483a0 ("wifi: mt76: mt7928: makes struct beacon_tlv 4-byte aligned.") > Signed-off-by: Anthony Liu <anthony.liu@mediatek.com> > Reported-by: kernel test robot <lkp@intel.com> > Reported-by: Dan Carpenter <error27@gmail.com> > Reviewed-by: Dan Carpenter <error27@gmail.com> > Closes: https://lore.kernel.org/r/202610172141.mmRmGqow-lkp@intel.com/ > --- Thanks! regards, dan carpenter ^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2026-10-30 10:19 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
[not found] <20261020032201.568970-1-anthony.liu@mediatek.com>
2026-10-30 4:57 ` [PATCH] mt76: fix buffer overrun in pkt buffer Dan Carpenter
2026-10-30 9:05 ` [PATCH v2] " Anthony Liu
2026-10-30 10:18 ` Dan Carpenter
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox