diff options
| author | Leon Yen <leon.yen@mediatek.com> | 2025-10-09 05:01:58 +0300 |
|---|---|---|
| committer | Felix Fietkau <nbd@nbd.name> | 2026-03-23 12:23:00 +0300 |
| commit | 5373f8b19e568b5c217832b9bbef165bd2b2df14 (patch) | |
| tree | 44c3efaa4876b8a86a1ba80df9f2b6d387baa2f6 | |
| parent | 4d0bf21e3e20619d51d06c0c36207aabab8b712c (diff) | |
| download | linux-5373f8b19e568b5c217832b9bbef165bd2b2df14.tar.xz | |
wifi: mt76: mt7921: fix a potential clc buffer length underflow
The buf_len is used to limit the iterations for retrieving the country
power setting and may underflow under certain conditions due to changes
in the power table in CLC.
This underflow leads to an almost infinite loop or an invalid power
setting resulting in driver initialization failure.
Cc: stable@vger.kernel.org
Fixes: fa6ad88e023d ("wifi: mt76: mt7921: fix country count limitation for CLC")
Signed-off-by: Leon Yen <leon.yen@mediatek.com>
Signed-off-by: Ming Yen Hsieh <mingyen.hsieh@mediatek.com>
Link: https://patch.msgid.link/20251009020158.1923429-1-mingyen.hsieh@mediatek.com
Signed-off-by: Felix Fietkau <nbd@nbd.name>
| -rw-r--r-- | drivers/net/wireless/mediatek/mt76/mt7921/mcu.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c index 833d0ab64230..8442dbd2ee23 100644 --- a/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c +++ b/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c @@ -1353,6 +1353,9 @@ int __mt7921_mcu_set_clc(struct mt792x_dev *dev, u8 *alpha2, u16 len = le16_to_cpu(rule->len); u16 offset = len + sizeof(*rule); + if (buf_len < offset) + break; + pos += offset; buf_len -= offset; if (rule->alpha2[0] != alpha2[0] || |