From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-yx1-f41.google.com (mail-yx1-f41.google.com [74.125.224.41]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C269528BAB9 for ; Mon, 6 Apr 2026 18:44:50 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=74.125.224.41 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1775501092; cv=none; b=FsSOrqJ7IlQvBg+4+fAKtiGGQm4cqC/XfhdC9do0wolRGAO0VFus76j7XcYpOtKDmKseHSQ8kWA5WUwvgznJok+xeJzSTwlzm3UcIOm3Co6vY38i1LOFWmfWi4zNsdEeCXZ1188oySoVOuNsGR6Fe6LZOei6I8Tc0TMstooRtfo= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1775501092; c=relaxed/simple; bh=1wFdMyFvSWKZhsBw4bUJanuljFszLvuCcEbWOUJntAY=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=AwPtkW5ATg3dFp9FgOdeqNEgo9DCPpgnRvGkDMj349TYC9aTwoA8NKh1Em8w9SpUXPSmBsWwtqNA+vUYespzpsqYstluInJfyU+am+zqy+1vGD+s+3NDBD/X4DWJYPDd4nu5BAVNA1L84PLBNv6qdyn2/pPSNocDVvJA1S/lNzs= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=dHlKfhBB; arc=none smtp.client-ip=74.125.224.41 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="dHlKfhBB" Received: by mail-yx1-f41.google.com with SMTP id 956f58d0204a3-6501418152cso3954669d50.0 for ; Mon, 06 Apr 2026 11:44:50 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1775501090; x=1776105890; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=s1TFbzSmIgRxkU6nP06w6dExgV+CzgxbPMmRj78Eh2I=; b=dHlKfhBBpPNnvSukZX8+8/9ZaHHJBxkkfGgpaaWQ2EMgkh4ZP5hB4TGWQBk6lBmAJ4 TtnrYOmc3zcRSpEra9wAJ2iOZiGt2YYs346c/QXd6lXIqc0aukb9U1kP6QOK9oIFm1lA 4URXfiUTROE8tAqhN2kRDkTcDtLF0wpqxUVpXWxX2sEZz99NnHsoNWT+3NkY2ZSSW71v YIVHqkX8gIJbC6se1GhsB9PF1oqcxoqGN5RSzKnSWP0clepx4+lrQ8z6VkNXIurgtfZD g9DOs75Y0ovnsd3uL6KM3LaGFeLpMw+d0gR53f+7/rNYn7JrtY8bvw/mD0Gd/iyOaU8T IiSg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1775501090; x=1776105890; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=s1TFbzSmIgRxkU6nP06w6dExgV+CzgxbPMmRj78Eh2I=; b=BkCt5lTt/YCuJ9ffKnVq/FQQ0zc/WDHBKQv2VbCKZNAMVP5HBfY5gumc3zPdnBgJxZ rLa4JounosDf76WyDbNkklqhtfx6aV7MtKDWWd+z2U76F8dCia8trllK06RLmFecocbJ dHcFT3OIyvnQucdqQE87+oFF7Xgcj8YXvx3ZQLI0HZMOvQlLOyW9xuF7YxG31ohCrt5N AXVFiElskuvncP8yis/JpjQElgl65M96j1fYa9K4B99HXPTVCiACpHU/88Ezvnpcg5R4 1vpfhb3EeiIl3E34He+XHs46/Dyifdt8/rL8nCwxxrsr3FeZPL+zA7H8QL2VpMEygjI7 DmlQ== X-Forwarded-Encrypted: i=1; AJvYcCWARPP6YBlCJDgSXNP35KXAKQRpJVoZ0BIKA0FUKpNFtpKXWcjWJ1+ciCB9lx2NDnT+rIia6tuzUK73K5o=@vger.kernel.org X-Gm-Message-State: AOJu0YyXTSzYi94TUSbYP9FtTUPDUntlGOhIQdfsNIT9ENx9UPiIPYgX 2GQ9PvQ/fjmidNNo0czoFt8HXtB1pAEzn2Cvr/VH9Lx30QopX/3YJ64fEbTy1cDr X-Gm-Gg: AeBDieuE1T7++fmwbfjCbNRJUUAxyW5mIsI1Jj4czZ9PZ6P/5G8avMQF1AtmlY5vVjA Uu1EkAHMBKTEXLZdsKAu0nM/M3EnddKA+ADg7uhd6RS45Ta6qx7yLUUhmJoVE1V+rWAGNLtR53o JsAQmldAEzhU1PGq8M6JTcM3pdGZdwnOUFQOMPJpIVfLl7G2gbjxZ7jVDRGN3yRhxAYAQHTwb/M nxEXO380D40qqT0iqDu1fx5n/h8+LcCcp01hUULgCs9KVYXdraYddulIfOGwcDxKUwlcL5+ZW9v SZijir1VMT8w8pam5VIsfVoYTW3Opx9471Z70bhjUdR6BAOJvn16fuOqHVEDvNFUwQ18T4tmGMS doRT9/8s8YbSKZydfztRc39QqLcDW1BVZRL6oMd+UmAcxYfsuREEmbLg2VGBXXl4Hh9laW1y0ya nBDb1WH5Zag3W/6zAljWGFv/JKY037enyud3B814hQY27TD7qQnVo9iLuc/JhL X-Received: by 2002:a05:690e:d48:b0:64c:a6c8:5300 with SMTP id 956f58d0204a3-6504886b02emr11564131d50.34.1775501089848; Mon, 06 Apr 2026 11:44:49 -0700 (PDT) Received: from DEV.lan (c-75-74-152-49.hsd1.fl.comcast.net. [75.74.152.49]) by smtp.gmail.com with ESMTPSA id 956f58d0204a3-6503a9a9271sm6342830d50.15.2026.04.06.11.44.48 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 06 Apr 2026 11:44:49 -0700 (PDT) From: Joshua Klinesmith To: nbd@nbd.name, lorenzo@kernel.org, ryder.lee@mediatek.com Cc: shayne.chen@mediatek.com, sean.wang@mediatek.com, linux-wireless@vger.kernel.org, linux-kernel@vger.kernel.org, Joshua Klinesmith Subject: [PATCH 0/2] wifi: mt76: validate WCID index before WTBL lookup Date: Mon, 6 Apr 2026 14:44:04 -0400 Message-ID: <20260406184406.8152-1-joshuaklinesmith@gmail.com> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit The mt7915 and mt7996 drivers do not validate WCID indices extracted from hardware TX free events and TX status reports before using them for WTBL MMIO register accesses. The hardware WCID field is 10 bits wide (max 1023) but the actual WTBL capacity is only 288 (MT7915), 544 (MT7916), or variable (MT7996). An out-of-range index causes a kernel data abort. Reverse engineering of the MediaTek WA co-processor firmware (NDS32/FreeRTOS) confirmed that the firmware validates WCID for its internal table (< 786) but still emits out-of-range values in DMA descriptors sent to the host driver. The mt7615, mt7921, and mt7925 drivers already have these bounds checks. This series adds the same validation to mt7915 and mt7996. Joshua Klinesmith (2): wifi: mt76: mt7915: validate WCID index before WTBL lookup wifi: mt76: mt7996: validate WCID index before WTBL lookup drivers/net/wireless/mediatek/mt76/mt7915/mac.c | 6 ++++++ drivers/net/wireless/mediatek/mt76/mt7996/mac.c | 6 ++++++ 2 files changed, 12 insertions(+)