Lorenzo Bianconi 7b692dff8d wifi: mt76: Fix possible oob access in mt76_connac2_mac_write_txwi_80211() ...

[ Upstream commit 4e10a730d1 ]

Check frame length before accessing the mgmt fields in
mt76_connac2_mac_write_txwi_80211 in order to avoid a possible oob
access.

Fixes: 577dbc6c65 ("mt76: mt7915: enable offloading of sequence number assignment")
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Link: https://patch.msgid.link/20260226-mt76-addba-req-oob-access-v1-3-b0f6d1ad4850@kernel.org
[fix check to also cover mgmt->u.action.u.addba_req.capab,
correct Fixes tag]
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>

2026-03-13 17:20:42 +01:00

..

mt76x0

wifi: mt76: mt76_eeprom_override to int

2025-11-13 15:34:24 -05:00

mt76x2

wifi: mt76: mt76_eeprom_override to int

2025-11-13 15:34:24 -05:00

mt7603

wifi: mt76: mt76_eeprom_override to int

2025-11-13 15:34:24 -05:00

mt7615

wifi: mt76: mt7925: add handler to hif suspend/resume event

2026-01-08 10:15:02 +01:00

mt7915

wifi: mt76: mt76_eeprom_override to int

2025-11-13 15:34:24 -05:00

mt7921

wifi: mt76: mt7925: add handler to hif suspend/resume event

2026-01-08 10:15:02 +01:00

mt7925

wifi: mt76: mt7925: Fix possible oob access in mt7925_mac_write_txwi_80211()

2026-03-13 17:20:42 +01:00

mt7996

wifi: mt76: mt7996: Fix possible oob access in mt7996_mac_write_txwi_80211()

2026-03-13 17:20:41 +01:00

agg-rx.c

…

debugfs.c

…

dma.c

…

dma.h

…

eeprom.c

wifi: mt76: Fix DTS power-limits on little endian systems

2026-01-08 10:14:14 +01:00

Kconfig

…

mac80211.c

wifi: mt76: free pending offchannel tx frames on wcid cleanup

2025-09-09 18:58:06 +02:00

Makefile

…

mcu.c

…

mmio.c

…

mt76_connac2_mac.h

…

mt76_connac3_mac.c

…

mt76_connac3_mac.h

wifi: mt76: mt7996: revise TXS size

2025-05-29 11:02:10 +02:00

mt76_connac_mac.c

wifi: mt76: Fix possible oob access in mt76_connac2_mac_write_txwi_80211()

2026-03-13 17:20:42 +01:00

mt76_connac_mcu.c

wifi: mt76: mt7925: add handler to hif suspend/resume event

2026-01-08 10:15:02 +01:00

mt76_connac_mcu.h

wifi: mt76: mt7925: add handler to hif suspend/resume event

2026-01-08 10:15:02 +01:00

mt76_connac.h

…

mt76.h

wifi: mt76: mt76_eeprom_override to int

2025-11-13 15:34:24 -05:00

mt76x02_beacon.c

…

mt76x02_debugfs.c

…

mt76x02_dfs.c

…

mt76x02_dfs.h

…

mt76x02_dma.h

…

mt76x02_eeprom.c

…

mt76x02_eeprom.h

…

mt76x02_mac.c

…

mt76x02_mac.h

…

mt76x02_mcu.c

…

mt76x02_mcu.h

…

mt76x02_mmio.c

…

mt76x02_phy.c

…

mt76x02_phy.h

…

mt76x02_regs.h

…

mt76x02_trace.c

…

mt76x02_trace.h

…

mt76x02_txrx.c

…

mt76x02_usb_core.c

…

mt76x02_usb_mcu.c

…

mt76x02_usb.h

…

mt76x02_util.c

…

mt76x02.h

…

mt792x_acpi_sar.c

…

mt792x_acpi_sar.h

…

mt792x_core.c

…

mt792x_debugfs.c

…

mt792x_dma.c

…

mt792x_mac.c

…

mt792x_regs.h

…

mt792x_trace.c

…

mt792x_trace.h

…

mt792x_usb.c

…

mt792x.h

wifi: mt76: mt7925: add handler to hif suspend/resume event

2026-01-08 10:15:02 +01:00

pci.c

…

sdio_txrx.c

…

sdio.c

…

sdio.h

…

testmode.c

…

testmode.h

…

trace.c

…

trace.h

…

tx.c

wifi: mt76: fix linked list corruption

2025-09-09 18:58:06 +02:00

usb_trace.c

…

usb_trace.h

…

usb.c

…

util.c

…

util.h

…

wed.c

…