From: Felix Fietkau <nbd@nbd.name>
To: linux-wireless@vger.kernel.org
Subject: [PATCH mt76-next 08/29] wifi: mt76: mt7996: reserve space for the CSA-abort countdown TLV
Date: Fri, 24 Jul 2026 12:47:52 +0000 [thread overview]
Message-ID: <20260724124813.3961474-8-nbd@nbd.name> (raw)
In-Reply-To: <20260724124813.3961474-1-nbd@nbd.name>
When a CSA countdown is active, mt7996_mcu_beacon_cntdwn() emits two
bss_bcn_cntdwn_tlv entries (the CSA countdown and the CCA-abort BCC), but
MT7996_BEACON_UPDATE_SIZE only reserved one. With MBSSID enabled and a
near-maximum beacon template the extra 8 bytes could push the offload
command past MT7996_MAX_BSS_OFFLOAD_SIZE and trigger skb_over_panic().
Reserve room for both countdown TLVs.
Fixes: 98686cd21624 ("wifi: mt76: mt7996: add driver for MediaTek Wi-Fi 7 (802.11be) devices")
Signed-off-by: Felix Fietkau <nbd@nbd.name>
---
drivers/net/wireless/mediatek/mt76/mt7996/mcu.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.h b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.h
index 8902e16508b7..c673e986ecb5 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.h
+++ b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.h
@@ -917,7 +917,7 @@ enum {
#define MT7996_BEACON_UPDATE_SIZE (sizeof(struct bss_req_hdr) + \
sizeof(struct bss_bcn_content_tlv) + \
4 + MT_TXD_SIZE + \
- sizeof(struct bss_bcn_cntdwn_tlv) + \
+ sizeof(struct bss_bcn_cntdwn_tlv) * 2 + \
sizeof(struct bss_bcn_mbss_tlv))
#define MT7996_MAX_BSS_OFFLOAD_SIZE 2048
#define MT7996_MAX_BEACON_SIZE (MT7996_MAX_BSS_OFFLOAD_SIZE - \
--
2.53.0
next prev parent reply other threads:[~2026-07-24 12:48 UTC|newest]
Thread overview: 29+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-07-24 12:47 [PATCH mt76-next 01/29] wifi: mt76: fix HE DCM max-RU capability encoding Felix Fietkau
2026-07-24 12:47 ` [PATCH mt76-next 02/29] wifi: mt76: mt7996: bound TLV walk in mt7996_mcu_get_chip_config Felix Fietkau
2026-07-24 12:47 ` [PATCH mt76-next 03/29] wifi: mt76: fix out-of-bounds access in mmio copy helpers Felix Fietkau
2026-07-24 12:47 ` [PATCH mt76-next 04/29] wifi: mt76: mt7915: unwind state on add_interface failure Felix Fietkau
2026-07-24 12:47 ` [PATCH mt76-next 05/29] wifi: mt76: mt7996: hold dev->mt76.mutex while disabling tx worker in SER Felix Fietkau
2026-07-24 12:47 ` [PATCH mt76-next 06/29] wifi: mt76: decode the full VHT Rx STBC capability field Felix Fietkau
2026-07-24 12:47 ` [PATCH mt76-next 07/29] wifi: mt76: fix ER-SU 106-tone RU check in RX rate decode Felix Fietkau
2026-07-24 12:47 ` Felix Fietkau [this message]
2026-07-24 12:47 ` [PATCH mt76-next 09/29] wifi: mt76: mt7996: don't leak MLD group index on remap alloc failure Felix Fietkau
2026-07-24 12:47 ` [PATCH mt76-next 10/29] wifi: mt76: cancel reset and rc work on device unregister Felix Fietkau
2026-07-24 12:47 ` [PATCH mt76-next 11/29] wifi: mt76: report data NSS for STBC frames in RX rate decode Felix Fietkau
2026-07-24 12:47 ` [PATCH mt76-next 12/29] wifi: mt76: mt7915: use little-endian for bss_info_ra wire fields Felix Fietkau
2026-07-24 12:47 ` [PATCH mt76-next 13/29] wifi: mt76: mt7996: add missing rdd_idx check when enabling background radar Felix Fietkau
2026-07-24 12:47 ` [PATCH mt76-next 14/29] wifi: mt76: only consume the WO drop bit on WED v2 devices Felix Fietkau
2026-07-24 12:47 ` [PATCH mt76-next 15/29] wifi: mt76: mt7996: add mcu command to set bssid mapping address Felix Fietkau
2026-07-24 12:48 ` [PATCH mt76-next 16/29] wifi: mt76: mt7996: leave PS when a 4-address connection is established Felix Fietkau
2026-07-24 12:48 ` [PATCH mt76-next 17/29] wifi: mt76: mt7915: unlink TWT flow if the MCU rejects the agreement Felix Fietkau
2026-07-24 12:48 ` [PATCH mt76-next 18/29] wifi: mt76: mt7996: skip key upload when adding an offchannel link Felix Fietkau
2026-07-24 12:48 ` [PATCH mt76-next 19/29] wifi: mt76: mt7996: wake MCU waiters before aborting scan in L1 SER Felix Fietkau
2026-07-24 12:48 ` [PATCH mt76-next 20/29] wifi: mt76: fix queue reg access when building WED and NPU together Felix Fietkau
2026-07-24 12:48 ` [PATCH mt76-next 21/29] wifi: mt76: mt7996: select net_setup_tc handler at runtime Felix Fietkau
2026-07-24 12:48 ` [PATCH mt76-next 22/29] wifi: mt76: fix stuck TX queues after SER with no active interfaces Felix Fietkau
2026-07-24 12:48 ` [PATCH mt76-next 23/29] wifi: mt76: mt7615: fix NULL deref in mt7615_mac_set_rates Felix Fietkau
2026-07-24 12:48 ` [PATCH mt76-next 24/29] mt76: mt7915: trigger L1 SER on PLE MDP RIOC hang Felix Fietkau
2026-07-24 12:48 ` [PATCH mt76-next 25/29] wifi: mt76: mt7996: free vif links after clearing wcid entries on full reset Felix Fietkau
2026-07-24 12:48 ` [PATCH mt76-next 26/29] wifi: mt76: mt7996: clear stale link state " Felix Fietkau
2026-07-24 12:48 ` [PATCH mt76-next 27/29] wifi: mt76: set MT76_SCANNING when starting a hw scan Felix Fietkau
2026-07-24 12:48 ` [PATCH mt76-next 28/29] wifi: mt76: serialize scan-link teardown with dev->mutex Felix Fietkau
2026-07-24 12:48 ` [PATCH mt76-next 29/29] wifi: mt76: mt7996: hold dev->mutex in remove_interface teardown Felix Fietkau
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260724124813.3961474-8-nbd@nbd.name \
--to=nbd@nbd.name \
--cc=linux-wireless@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox