From: Felix Fietkau <nbd@nbd.name>
To: linux-wireless@vger.kernel.org
Subject: [PATCH 10/10] wifi: mt76: mt7996: fix out-of-bounds link array access in mt7996_tx()
Date: Sat, 1 Aug 2026 14:53:34 +0000 [thread overview]
Message-ID: <20260801145334.1166751-10-nbd@nbd.name> (raw)
In-Reply-To: <20260801145334.1166751-1-nbd@nbd.name>
When mac80211 leaves the link unspecified, mt7996_tx() substitutes the
primary link id of the station or vif. That value is
IEEE80211_LINK_UNSPECIFIED (0xf) until the first link has been added,
and it is then used unchecked to index vif->link_conf[],
mvif->mt76.link[] and sta->link[], all of which hold
IEEE80211_MLD_MAX_NUM_LINKS (15) entries.
Clamp the primary link id to the default link before using it, and use
the clamped value for the link_sta fallback as well.
Fixes: 1609b014aa29 ("wifi: mt76: mt7996: Overwrite unspecified link_id in mt7996_tx()")
Signed-off-by: Felix Fietkau <nbd@nbd.name>
---
.../net/wireless/mediatek/mt76/mt7996/main.c | 20 ++++++++++++-------
1 file changed, 13 insertions(+), 7 deletions(-)
diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/main.c b/drivers/net/wireless/mediatek/mt76/mt7996/main.c
index 54e79bd25995..e218856b0c45 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7996/main.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7996/main.c
@@ -1515,20 +1515,26 @@ static void mt7996_tx(struct ieee80211_hw *hw,
struct ieee80211_vif *vif = info->control.vif;
struct mt7996_vif *mvif = vif ? (void *)vif->drv_priv : NULL;
struct mt76_wcid *wcid = &dev->mt76.global_wcid;
+ u8 deflink_id = IEEE80211_LINK_UNSPECIFIED;
u8 link_id = u32_get_bits(info->control.flags,
IEEE80211_TX_CTRL_MLO_LINK);
rcu_read_lock();
+ if (msta)
+ deflink_id = msta->deflink_id;
+ else if (mvif)
+ deflink_id = mvif->mt76.deflink_id;
+
+ /* the primary link is unset until the first link has been added */
+ if (deflink_id >= IEEE80211_MLD_MAX_NUM_LINKS)
+ deflink_id = 0;
+
/* Use primary link_id if the value from mac80211 is set to
* IEEE80211_LINK_UNSPECIFIED.
*/
- if (link_id == IEEE80211_LINK_UNSPECIFIED) {
- if (msta)
- link_id = msta->deflink_id;
- else if (mvif)
- link_id = mvif->mt76.deflink_id;
- }
+ if (link_id == IEEE80211_LINK_UNSPECIFIED)
+ link_id = deflink_id;
if (vif && ieee80211_vif_is_mld(vif)) {
struct ieee80211_bss_conf *link_conf;
@@ -1538,7 +1544,7 @@ static void mt7996_tx(struct ieee80211_hw *hw,
link_sta = rcu_dereference(sta->link[link_id]);
if (!link_sta)
- link_sta = rcu_dereference(sta->link[msta->deflink_id]);
+ link_sta = rcu_dereference(sta->link[deflink_id]);
if (link_sta) {
memcpy(hdr->addr1, link_sta->addr, ETH_ALEN);
--
2.53.0
prev parent reply other threads:[~2026-08-01 14:53 UTC|newest]
Thread overview: 10+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-08-01 14:53 [PATCH 01/10] wifi: mt76: add PS buffering support for HW-managed TIM drivers Felix Fietkau
2026-08-01 14:53 ` [PATCH 02/10] wifi: mt76: mt7915: handle MCU PS sync events Felix Fietkau
2026-08-01 14:53 ` [PATCH 03/10] wifi: mt76: mt7996: handle UNI " Felix Fietkau
2026-08-01 14:53 ` [PATCH 04/10] wifi: mt76: set the EOSP bit in the QoS header of the last released frame Felix Fietkau
2026-08-01 14:53 ` [PATCH 05/10] wifi: mt76: mt7603: fix U-APSD service period termination Felix Fietkau
2026-08-01 14:53 ` [PATCH 06/10] wifi: mt76: mt7603: tell mac80211 when the PS queue has run empty Felix Fietkau
2026-08-01 14:53 ` [PATCH 07/10] wifi: mt76: mt7603: restore hardware PS buffering after a service period Felix Fietkau
2026-08-01 14:53 ` [PATCH 08/10] wifi: mt76: mt7603: file buffered frames under the TID reported to mac80211 Felix Fietkau
2026-08-01 14:53 ` [PATCH 09/10] wifi: mt76: reject out-of-range link ids in mt76_vif_link() Felix Fietkau
2026-08-01 14:53 ` Felix Fietkau [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260801145334.1166751-10-nbd@nbd.name \
--to=nbd@nbd.name \
--cc=linux-wireless@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox