* [PATCH] mt76: fix buffer overrun in pkt buffer
@ 2026-10-20 3:22 anthony.liu
2026-10-30 4:57 ` Dan Carpenter
0 siblings, 1 reply; 2+ messages in thread
From: anthony.liu @ 2026-10-20 3:22 UTC (permalink / raw)
To: nbd, lorenzo
Cc: Leon.Yen, Quan.Zhou, Ryder.lee, Sean.Wang, emery.hsin, jb.tsai,
kun.wu, linux-mediatek, linux-wireless, litien.chang, Anthony Liu,
kernel test robot, Dan Carpenter
From: Anthony Liu <anthony.liu@mediatek.com>
The last patch (d4e5ca3483a0) addresses mt7928 F/W 4 byte-aligment
requirement by reducing pkt buffer by 2 bytes, causing the chance
of buffer overrun.
This patch reduces incoming skb length limit accordingly.
Fixes: d4e5ca3483a0 ("wifi: mt76: mt7928: makes struct beacon_tlv 4-byte aligned.")
Signed-off-by: Anthony Liu <anthony.liu@mediatek.com>
Reported-by: kernel test robot <lkp@intel.com>
Reported-by: Dan Carpenter <error27@gmail.com>
Closes: https://lore.kernel.org/r/202610172141.mmRmGqow-lkp@intel.com/
diff --git a/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c
index 26cdb3f0a98a..131585b3359d 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c
@@ -2479,7 +2479,7 @@ mt7925_mcu_uni_add_beacon_offload(struct mt792x_dev *dev,
return -EINVAL;
}
- if (skb->len > 512) {
+ if (skb->len > 510) {
dev_err(dev->mt76.dev, "beacon size limit exceed\n");
dev_kfree_skb(skb);
return -EINVAL;
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH] mt76: fix buffer overrun in pkt buffer
2026-10-20 3:22 [PATCH] mt76: fix buffer overrun in pkt buffer anthony.liu
@ 2026-10-30 4:57 ` Dan Carpenter
0 siblings, 0 replies; 2+ messages in thread
From: Dan Carpenter @ 2026-10-30 4:57 UTC (permalink / raw)
To: anthony.liu
Cc: nbd, lorenzo, Leon.Yen, Quan.Zhou, Ryder.lee, Sean.Wang,
emery.hsin, jb.tsai, kun.wu, linux-mediatek, linux-wireless,
litien.chang, kernel test robot
On Tue, Oct 20, 2026 at 11:22:00AM +0800, anthony.liu@mediatek.com wrote:
> From: Anthony Liu <anthony.liu@mediatek.com>
>
> The last patch (d4e5ca3483a0) addresses mt7928 F/W 4 byte-aligment
> requirement by reducing pkt buffer by 2 bytes, causing the chance
> of buffer overrun.
>
> This patch reduces incoming skb length limit accordingly.
>
> Fixes: d4e5ca3483a0 ("wifi: mt76: mt7928: makes struct beacon_tlv 4-byte aligned.")
> Signed-off-by: Anthony Liu <anthony.liu@mediatek.com>
> Reported-by: kernel test robot <lkp@intel.com>
> Reported-by: Dan Carpenter <error27@gmail.com>
> Closes: https://lore.kernel.org/r/202610172141.mmRmGqow-lkp@intel.com/
>
> diff --git a/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c
> index 26cdb3f0a98a..131585b3359d 100644
> --- a/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c
> +++ b/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c
> @@ -2479,7 +2479,7 @@ mt7925_mcu_uni_add_beacon_offload(struct mt792x_dev *dev,
> return -EINVAL;
> }
>
> - if (skb->len > 512) {
> + if (skb->len > 510) {
I would probably use:
if (skb->len > sizeof(req.beacon_tlv.pkt)) {
but, we do need to apply this patch in linux-next.
regards,
dan carpenter
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2026-10-30 4:57 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-10-20 3:22 [PATCH] mt76: fix buffer overrun in pkt buffer anthony.liu
2026-10-30 4:57 ` Dan Carpenter
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox