From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-yw1-f181.google.com (mail-yw1-f181.google.com [209.85.128.181]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id CF02E2DCF61 for ; Mon, 6 Apr 2026 18:46:15 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.181 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1775501177; cv=none; b=ItY2fpN+538mL2RXhQ+NL6rQqVP+Ea0W0yz8yOxAWWyriceKBXExZS9pUJcZy0oeOn4o0T9EZuZ+DFYm8B8I9lq8d3lhZ8jgVmr/4mgd3KoD/zjkq/R0LfpSAr66LEoqp5lcNq7Yk89VE6xQebV9u8isPBYHe0+SMuzREhSNXNs= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1775501177; c=relaxed/simple; bh=oVzhNQ8iUQAvgW7nBUQ1sJuk/qdkORRUMTPxp9R/flE=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=EhM2+dkTFiDINUlHTNS612yMxAsdRQdRp6VGmhw5lXebrXJIbNDYlrovy/Mnr5Hez8dHndIF5LMl/stNFMSGp1+AhFytd04wxow50h7Dac1XIZmAOu0vv5yi5jAaaGpj98OMf9AFG1CWK0vRJVloDOr7iW6YeCjbjbcMBux/PhA= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=bYNfZtLD; arc=none smtp.client-ip=209.85.128.181 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="bYNfZtLD" Received: by mail-yw1-f181.google.com with SMTP id 00721157ae682-79be0de8610so40018577b3.2 for ; Mon, 06 Apr 2026 11:46:15 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1775501175; x=1776105975; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=yscqaJgt4KtnbkPyG+m6kbyDy1nr/tDdA/l1zenQqiU=; b=bYNfZtLD4cbM+9nEz2ZXssBszvOQ47BwOnupCWE1EPWl3K0EKD4ws0vpawtuaeTpjR r4BdZfwVbeSqGXIySfcZgGY8t8pHGE/fHDhRzI7aPI2f/g0HBl1l79w5OKw52dGWpWlU OhNDh4J6H2uh9LFo+0TQrTxkJkhvnvkTho+OoHDeocC/qyTCimS6hctr7YFTLHCXUy86 rjYPkDIM6OG1S2rKOiro3C4G6ED1dBXgPYfjUKVlXSZDx9RmerwhksUF9aQnavHbUG2T N+AWjZzX/dFmV3RGqLEUkesvYiAr0HIU9sPr5yvdhHxyLzkO/H/Q6R3qVnRL/yFp1Z6Q oamw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1775501175; x=1776105975; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=yscqaJgt4KtnbkPyG+m6kbyDy1nr/tDdA/l1zenQqiU=; b=AONh5bs9X42dXJGC+lPlRysucClExoTHE7a4naAef4NNdXjZe9VklcGEDexY28Ia+0 akFQDE+Sl4rABP3nRqUlovjYS/ANSfSg/rIRLeZEGzrSIL9UdZhIbCYbLFJy1OXSXPC3 ooQ0pr1H598D+Tq3b3SAjAgks+z1igYMTf2TEJ0dtFaj4OxVRGeASVfRBrvbLgNDuhQX SF8ZlfyISHPHW8k7vY99ivQBEZ8n4GedJRQ87Ljv1zqnv96PyE9Es61LMvHurUCnXYzc G0Pv/lPkjwW34/YhUF/OmtDp1c2tPLWfbu/11zwSW3nrb+gPRf4bJGOu3RcMB32+fMJW OeEA== X-Forwarded-Encrypted: i=1; AJvYcCVsAgk6u0anBYELWoxQWBMtVUEdtp/mAyfZIpWnOWZ/0TLWu5EbJzXflll3BA2UNlGZ7b/kWhX/ydJdZGo=@vger.kernel.org X-Gm-Message-State: AOJu0YxlbzZ9v5bBxy2Gb316bQ8lj4BTnPbDLj1F80ZA0XD0fL7J74zf 3gSvYjLo5QLHWqPxkUstYz+qaEgJmBcIDALqlGmizeDrcJtHGXUAHgdtdXm7fE5i X-Gm-Gg: AeBDievDZ/JWNOaPUl9otWBpzioV+G63iOepN3a4k8WxW1GXvjrrHBD9j9OG33DNqfe PDpUzinNpB6Yqxtbgibn6jEDyekGpDNesrQ2aArsvrj/aKgMtKRqckPUnbZqlCM0oUIFsu+lo2o OqW8A7ERyneW8DlKwU8+ADowogrdYojeSgv8u+dTT2ttPigiAY6vXStOGOe9yoKcoYt7Vw6i7Na bcyVaLBWsR0TMywsc/pQOSR8ofxvNwOpfVFzpSErppEZpjgypxUP2SVSUThG6J6q0oDVvoakop9 L1b/vVI5ZN1xD+xKrww+IpHUXGdZvxFd5hSddTOBDfxk8VnHbO18bZz0QTkAuPcyKTJ0R8ehF1w m22KWVGB8HUhx1RknQUTVxu/QPJjGIbte9HqE3pXfEzd5JP3NXQ4VXmwI4GZZBmVSjndZSn9yUP 4ioFOG++zmi1m78k0IaDeRxWatpb2G/nnAogW9fyLRoaIxCLpOB8FdSBc70/aQ X-Received: by 2002:a05:690c:e643:b0:79e:8d95:7ecc with SMTP id 00721157ae682-7a4d3bd7dccmr85544677b3.22.1775501174818; Mon, 06 Apr 2026 11:46:14 -0700 (PDT) Received: from DEV.lan (c-75-74-152-49.hsd1.fl.comcast.net. [75.74.152.49]) by smtp.gmail.com with ESMTPSA id 00721157ae682-7a36e8343d3sm56288377b3.16.2026.04.06.11.46.14 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 06 Apr 2026 11:46:14 -0700 (PDT) From: Joshua Klinesmith To: nbd@nbd.name, lorenzo@kernel.org, ryder.lee@mediatek.com Cc: shayne.chen@mediatek.com, sean.wang@mediatek.com, linux-wireless@vger.kernel.org, linux-kernel@vger.kernel.org, Joshua Klinesmith Subject: [PATCH 0/3] wifi: mt76: fix DMA read beyond mapped length Date: Mon, 6 Apr 2026 14:45:53 -0400 Message-ID: <20260406184556.8245-1-joshuaklinesmith@gmail.com> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit tx_prepare_skb() in mt7615, mt7915, and mt7996 overrides buf[1].len to MT_CT_PARSE_LEN (72 bytes) for firmware header parsing, but dma_map_single() in dma.c only maps skb_headlen(skb) bytes. When the SKB is shorter than 72 bytes (e.g. a 54-byte TCP SYN), the DMA descriptor tells the hardware to read past the mapped region. On systems without IOMMU this is silently ignored. On systems with SMMU (e.g. NXP LS1028A), the read past the page boundary triggers an SMMU translation fault. Cap buf[1].len to min(MT_CT_PARSE_LEN, original_mapped_len) in all three drivers. Joshua Klinesmith (3): wifi: mt76: mt7615: fix DMA read beyond mapped length wifi: mt76: mt7915: fix DMA read beyond mapped length wifi: mt76: mt7996: fix DMA read beyond mapped length drivers/net/wireless/mediatek/mt76/mt7615/pci_mac.c | 2 +- drivers/net/wireless/mediatek/mt76/mt7915/mac.c | 2 +- drivers/net/wireless/mediatek/mt76/mt7996/mac.c | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-)