Pengpeng Hou 0fd56fad9c wifi: wl1251: validate packet IDs before indexing tx_frames ...

wl1251_tx_packet_cb() uses the firmware completion ID directly to index
the fixed 16-entry wl->tx_frames[] array. The ID is a raw u8 from the
completion block, and the callback does not currently verify that it
fits the array before dereferencing it.

Reject completion IDs that fall outside wl->tx_frames[] and keep the
existing NULL check in the same guard. This keeps the fix local to the
trust boundary and avoids touching the rest of the completion flow.

Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Link: https://patch.msgid.link/20260323080845.40033-1-pengpeng@iscas.ac.cn
Signed-off-by: Johannes Berg <johannes.berg@intel.com>

2026-03-24 15:32:31 +01:00

..

wl12xx

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

wl18xx

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

wl1251

wifi: wl1251: validate packet IDs before indexing tx_frames

2026-03-24 15:32:31 +01:00

wlcore

wifi: wlcore: Return -ENOMEM instead of -EAGAIN if there is not enough headroom

2026-03-18 09:05:06 +01:00

Kconfig

…

Makefile

…