• Dan Carpenter's avatar
    mt76: mt7915: potential array overflow in mt7915_mcu_tx_rate_report() · eb744e5d
    Dan Carpenter authored
    Smatch complains that "wcidx" value comes from the network and thus
    cannot be trusted.  In this case, it actually seems to come from the
    firmware.  If your wireless firmware is malicious then probably no
    amount of carefulness can protect you.
    
    On the other hand, these days we still try to check the firmware as much
    as possible.  Verifying that the index is within bounds will silence a
    static checker warning.  And it's harmless and a good exercise in kernel
    hardening.  So I suggest that we do add a bounds check.
    
    Fixes: e57b7901 ("mt76: add mac80211 driver for MT7915 PCIe-based chipsets")
    Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
    Signed-off-by: default avatarFelix Fietkau <nbd@nbd.name>
    eb744e5d
mcu.c 78.5 KB