From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 9C15628643A for ; Thu, 26 Feb 2026 21:08:31 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1772140111; cv=none; b=TdVrR2jAZ6ZRqnw1v8JPQRoqXfNZ8+EtQxSuQswFQjFM8Cp3t1733h1/It+JKK9C+9go0P3k7Xktk7C1TEdsRYtIt0bOdgI0eIxGrQ61fn5DwWlHx5t/UwgaQO2jlQGj+c9oYM5Wi/OoG8n498jXXv9fDQUnaPYRfhBeSSR3yEY= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1772140111; c=relaxed/simple; bh=lvfOpg7Q8B6PQTUDRETaioIBfNXDdU4p85aEpRkDPOo=; h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; b=M8dcq1+4JSKdhxl1+fqKKxwLj8njKZYyZzxD04sGVCbmKxVnsuSCNSwNdRa2E5vL6X2GMuiBQiJzSzyRXzIB388+cC5MVn88HuJF6CkT1eOqZBP9YJOdWnAlZ8shtxkAuY9p+lIdfXepDw910c2VUzpGKPUm1xIDrMb5kzpxFd0= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=okPxQoNN; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="okPxQoNN" Received: by smtp.kernel.org (Postfix) with ESMTPSA id B353BC116C6; Thu, 26 Feb 2026 21:08:30 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1772140111; bh=lvfOpg7Q8B6PQTUDRETaioIBfNXDdU4p85aEpRkDPOo=; h=Date:From:To:Cc:Subject:References:In-Reply-To:From; b=okPxQoNNaXjtAHqbKapEVhYnnFPHYkR3E2EUG40wOSSEOLr4PJaNr1MRVGPG0qfG8 mBOH8D1uR19BK5b8TbcQRhDsWJx5vCtcOCPVOjLwxo4hDhgG6FLwmEhilXtdOsMkSW vp+KM+cFo6ZxSiHQQtHsNkVhPCoR6BSsHtwaN7BtymqDcnDFoQ+2eYvWFuUU8TRInk ZzyU5XdhN+nsFL9FP0pWzTv2pAvdiGzdXnK90vkTMRHhbRajsyoRewD1QxjZ0vGRbk Q39H0419rUtEoySHeTIty+ybr0a71yLnBXAFS/jOM5cfaDe36b0cO2Wu1xvvnIbkuK 0Udtksr66NM7g== Date: Thu, 26 Feb 2026 22:08:28 +0100 From: Lorenzo Bianconi To: Felix Fietkau , Ryder Lee , Shayne Chen , Sean Wang , Matthias Brugger , AngeloGioacchino Del Regno , StanleyYP Wang , Peter Chiu , MeiChia Chiu , Leon Yen , Deren Wu , Quan Zhou , Mingyen Hsieh Cc: Johannes Berg , Howard Hsu , Bo Jiao , linux-wireless@vger.kernel.org, linux-arm-kernel@lists.infradead.org, linux-mediatek@lists.infradead.org, Hao Zhang , Nelson Yu Subject: Re: [PATCH wireless 0/3] wifi: mt76: Fix possible out-of-bound accesses in mt76 driver Message-ID: References: <20260226-mt76-addba-req-oob-access-v1-0-b0f6d1ad4850@kernel.org> Precedence: bulk X-Mailing-List: linux-wireless@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="S9cDFWTiBubiysDv" Content-Disposition: inline In-Reply-To: <20260226-mt76-addba-req-oob-access-v1-0-b0f6d1ad4850@kernel.org> --S9cDFWTiBubiysDv Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable > Check mgmt frame length before accessing header fields in order to avoid > a possible oob access for injected frames. Hi Felix, do you think these patches can go directly into the wireless tree or do you prefer to get them into your tree? Regards, Lorenzo >=20 > --- > Lorenzo Bianconi (3): > wifi: mt76: mt7996: Fix possible oob access in mt7996_mac_write_txw= i_80211() > wifi: mt76: mt7925: Fix possible oob access in mt7925_mac_write_txw= i_80211() > wifi: mt76: Fix possible oob access in mt76_connac2_mac_write_txwi_= 80211() >=20 > drivers/net/wireless/mediatek/mt76/mt76_connac_mac.c | 1 + > drivers/net/wireless/mediatek/mt76/mt7925/mac.c | 1 + > drivers/net/wireless/mediatek/mt76/mt7996/mac.c | 1 + > 3 files changed, 3 insertions(+) > --- > base-commit: 8bf22c33e7a172fbc72464f4cc484d23a6b412ba > change-id: 20260226-mt76-addba-req-oob-access-848280920814 >=20 > Best regards, > --=20 > Lorenzo Bianconi >=20 --S9cDFWTiBubiysDv Content-Type: application/pgp-signature; name=signature.asc -----BEGIN PGP SIGNATURE----- iHUEABYKAB0WIQTquNwa3Txd3rGGn7Y6cBh0uS2trAUCaaC2TAAKCRA6cBh0uS2t rHhKAQCot+MHK/5KIrSE0/KTRx1gyVUHvLhpk9gAlg/5EadIsAEA2JrMGDHYx42t r5l7H27eW/uMNIW4K/jrBJ25uZ+dtA4= =PxUT -----END PGP SIGNATURE----- --S9cDFWTiBubiysDv--