wifi: mt76: mt7925: fix infinite loop in UNI event TLV parsing

Browse source

The event TLV loops accept a zero-length TLV, which advances neither the
cursor nor the remaining length, so a malformed event hangs the caller.
mt7925_mcu_uni_roc_event() additionally walked past the end of the skb,
since it never checked the declared length against the remainder.

Replace the five open-coded loops with a shared iterator that rejects
lengths below the TLV header and beyond the remaining buffer, and check
the per-tag payload sizes before dereferencing them.

While here, make the RSSI monitor event read from the current TLV rather
than from the start of the list.

Link: https://patch.msgid.link/20260727150434.1778520-15-nbd@nbd.name
Signed-off-by: Felix Fietkau <nbd@nbd.name>

...

This commit is contained in:

Felix Fietkau 2026-07-27 15:04:34 +00:00

parent d8eb7952fa

commit fc7801b7f1

3 changed files with 46 additions and 21 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

10

drivers/net/wireless/mediatek/mt76/mt7925/main.c

View file

38

drivers/net/wireless/mediatek/mt76/mt7925/mcu.c

View file

19

drivers/net/wireless/mediatek/mt76/mt7925/mcu.h

View file