Received: by 2002:a05:6a10:f3d0:0:0:0:0 with SMTP id a16csp169637pxv; Wed, 14 Jul 2021 00:57:27 -0700 (PDT) X-Google-Smtp-Source: ABdhPJytERone8aQ0gYAEIkhAkMV0iBYibOz4HMoQzOTkdbfs6iPAa1or5gjMWQSw8y0xgydEaeC X-Received: by 2002:a05:6402:520c:: with SMTP id s12mr12194132edd.357.1626249447468; Wed, 14 Jul 2021 00:57:27 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1626249447; cv=none; d=google.com; s=arc-20160816; b=nI35ZpR43D8moL19/C6vIHzcUvFDIbyICYffsQVo+zj+KIVDEtI5dfBMYcnXa4OORm rakS6sxj0i02fvNfsk96DkMaQ09ZnpAbn1EskzrTHBa4NhGVsHw6yj/TjXw6t9CDnI8R ZKhWHMkHpRgktA2wZDn/EQA7fFfwHs8GxCTbxmJ3Gz2B/ongRzZcWkdjISEe63ZvqYHQ e4IPk10Rr2i+KXD0zG/zI7pcyF004yUUXe7zPepCAXA+gXGw1MEl2k3M3T/Ly/Tf2fA0 g9E8nNorqVUuDxoozxuIyh/JhcJRx0BF/7hIPtSHPP0xd3iI0u+dtTbBvq/Tc+pcyWre OMMg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:mime-version:message-id:date:subject:cc:to:from; bh=paHgj7bsYCWzAp5urhPsQivdcSQg++Lv7MGZM7R8bNY=; b=aPJWp7XYa9aq+YL0EC8Ov6B8y1ORRDeuCiMmE9gLPvjSc1Z6ylYNpyuaktVoO6IENE exwKUiOTDeioJ0R1K5ermxGz9Wi/veGhRUwI8jmp+OOeidooE69x+jlHRY3Z0svNnJpY Sm0fTMY9pzxK4fQdoOyQspIxlR7b/hGCFgtJxIzbc/zt0bwh8MphfNCQ4+x/Ywa6nu2k Lbg8Zz0z7riRPNWbEOmbMv+bLGup1hLHxCPfj2x+BJiBv3p+5SQ/DIaTKL+w4b4pGZsh librmMuNZaC+VB6Z5ue7qpQ3Bt525ZFjuFbYxdYj7u8CVTBpJj8iDj7c2XOnJr3429J4 2dRQ== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of linux-wireless-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-wireless-owner@vger.kernel.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=mediatek.com Return-Path: Received: from vger.kernel.org (vger.kernel.org. [23.128.96.18]) by mx.google.com with ESMTP id a12si1928481edr.3.2021.07.14.00.56.56; Wed, 14 Jul 2021 00:57:27 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-wireless-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18; Authentication-Results: mx.google.com; spf=pass (google.com: domain of linux-wireless-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-wireless-owner@vger.kernel.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=mediatek.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S238374AbhGNH7L (ORCPT + 99 others); Wed, 14 Jul 2021 03:59:11 -0400 Received: from mailgw02.mediatek.com ([210.61.82.184]:38116 "EHLO mailgw02.mediatek.com" rhost-flags-OK-FAIL-OK-FAIL) by vger.kernel.org with ESMTP id S238368AbhGNH7I (ORCPT ); Wed, 14 Jul 2021 03:59:08 -0400 X-UUID: 9ea10c5574094a0b80ba88563dc14036-20210714 X-UUID: 9ea10c5574094a0b80ba88563dc14036-20210714 Received: from mtkcas10.mediatek.inc [(172.21.101.39)] by mailgw02.mediatek.com (envelope-from ) (Generic MTA with TLSv1.2 ECDHE-RSA-AES256-SHA384 256/256) with ESMTP id 1274998151; Wed, 14 Jul 2021 15:56:13 +0800 Received: from mtkcas07.mediatek.inc (172.21.101.84) by mtkmbs05n1.mediatek.inc (172.21.101.15) with Microsoft SMTP Server (TLS) id 15.0.1497.2; Wed, 14 Jul 2021 15:56:11 +0800 Received: from mtksdccf07.mediatek.inc (172.21.84.99) by mtkcas07.mediatek.inc (172.21.101.73) with Microsoft SMTP Server id 15.0.1497.2 via Frontend Transport; Wed, 14 Jul 2021 15:56:11 +0800 From: Ryder Lee To: Felix Fietkau CC: Lorenzo Bianconi , Shayne Chen , Evelyn Tsai , , , Ryder Lee Subject: [PATCH] mt76: mt7915: fix an off-by-one bound check Date: Wed, 14 Jul 2021 15:56:10 +0800 Message-ID: <64d9e342b8ee28a7f1be8c6dc88afed4003d17fd.1626249182.git.ryder.lee@mediatek.com> X-Mailer: git-send-email 2.18.0 MIME-Version: 1.0 Content-Type: text/plain X-MTK: N Precedence: bulk List-ID: X-Mailing-List: linux-wireless@vger.kernel.org The bounds check on datalen is off-by-one, so fix it. Signed-off-by: Ryder Lee --- drivers/net/wireless/mediatek/mt76/mt7915/mcu.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c index 8d646aa3d084..81e4165905dc 100644 --- a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c +++ b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c @@ -776,7 +776,7 @@ static void mt7915_check_he_obss_narrow_bw_ru_iter(struct wiphy *wiphy, rcu_read_lock(); elem = ieee80211_bss_get_elem(bss, WLAN_EID_EXT_CAPABILITY); - if (!elem || elem->datalen < 10 || + if (!elem || elem->datalen <= 10 || !(elem->data[10] & WLAN_EXT_CAPA10_OBSS_NARROW_BW_RU_TOLERANCE_SUPPORT)) data->tolerated = false; -- 2.29.2