From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-yw1-f174.google.com (mail-yw1-f174.google.com [209.85.128.174]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 6A8FE394799 for ; Mon, 6 Apr 2026 18:46:17 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.174 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1775501179; cv=none; b=OWxZcqbJ5EpMtJUV+hIb1098316AcA7ordu3rSZfwaq3rHU6yDr5CGVNq8QvizHyepUrhatVAV9UF2zVbrfYNzBGpiQthSQeQ3Gj25XomKcXMelBMi9ONx4YMsdIvaGbLtElI8Gx+pZmeVGRnNueI3KEsSDFb7VOXfA59aiNCjk= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1775501179; c=relaxed/simple; bh=1BlXWlRN49rlr8956LLGxTQhvicZChrmUTMEfYKLNeU=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=sfypNrDW09n/46oSN6TOmvRe71wQBHxgRHqCpQqLDqKxhP+8MLnSLBZoNSirrIazmIVj8/UF3Ckizm2VDA7D5wk0qge2Ev+0CR7ybRHy+/23M5rui+AMZXRdML1AI9HSryyVgn0OMwIErNp56OlyMyCsG0m9ICTvgQWBMZY8Z3g= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=Zf/dkx2Y; arc=none smtp.client-ip=209.85.128.174 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="Zf/dkx2Y" Received: by mail-yw1-f174.google.com with SMTP id 00721157ae682-7986e538decso42552607b3.1 for ; Mon, 06 Apr 2026 11:46:17 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1775501176; x=1776105976; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=loX0Qy4NihlN+KUtrLsqZhhdHawhctjv5xYILfNriy4=; b=Zf/dkx2Y+KQ1gfePjRUkmcjLJ+d1NvW5qY6GbnVkvqmap3pufd5URfS8nyrLc4JSE0 6Ndce0qTr08zaob6D3Bsj5LfqYGayT6HkUYlG5kYPtCQmJymlxFYvfs28igdmzIXWyFV 7tZaIbfRkh9S37sBnIR5LuyKvqeACDSoObHCPOIaeC0XxQ97HMykl2Fwo0JJRyL+2j7t vgjPRvlBQ5qBfw6pGcayzWs47zxksADpu9AkXcSp22W56bZVuf6SR4491S88CoOFqL1s h4QF5bBkWLWvN5pve0N7LcwGggQZqUeUXx7JgnXi3bsqnGGPXvOWRud2onu+E2coNdyn CmyQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1775501176; x=1776105976; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=loX0Qy4NihlN+KUtrLsqZhhdHawhctjv5xYILfNriy4=; b=Kf7TsrQzS2qqeyX2q3v1N5a05inXCwCCbm1QKT3yr5d0lX8DSZ0LIitlRJ+A3tFDuC pDTXOxZxbeJABY4fWG4RQE57+h1Oy3rH6m3ruNk7DYdWPCgrUTBNjS7nPS+b1xXi1B52 IpXIGgJ68mEqegzJexIgud4NueYTmAWnM84r+dquXeGEAqcbr61xoBad+w6+3+odBndk pGL1Ayh3nslWV1y3cpSyZrMpMLeHG5FYoIme/DyqXrBTqn2rwv5pTxvKVQQxQoeyuD+W TUmrqUFX9iCPN36LXn+d2hPC9hAcLJ0UnBpfZl6kRD797OgFbqh4pMLeneIIvhv9a2MN yCQw== X-Forwarded-Encrypted: i=1; AJvYcCV+LF/Vjk+l24pOOeYyWUB4TRbSKLWKhXPTiBN1JNSXCLM2DmilhXKEGeaBcSk1ElbBsLT83cVV+ICRMqY=@vger.kernel.org X-Gm-Message-State: AOJu0YxSBqseJe+a1xKccnj4adQqpybgYJBYKU2R3y9al1UhK3TpoeEM kDq4XKGMSgv94UpL3M7fKOWLrx/C7Qw+2HctOeyBMHlRxj/B6E02D65V X-Gm-Gg: AeBDieu91Pr9UsPcp4Y4dSuz7b1js2DtM3sIepUVgtVNwnP9qniHIZROHBGCetje4fc TE7lQw1pCXa8OMk0klzvmkSsMlrlwBsiczDpPC4416rCf1L3CBHlzyU/lP0rUXqjBWeuHBOGuM+ pU2liVu4wTFMl7Ha94IXBaiMNW66b25aL264veyvnN/Fmkz2FEE/Dhn+WKed+2iHbfQOkFAKpZG dsz9YTkgnZWv3jBjnYOw7NhZfLzH6N6ODNRukSg4P4WHS7C4qCu2y05w+hiNrN+rjq/8LQPQLoL LpaMMjh7OuzCCFu+0q5XxBEb3/LLfC4OrZlVa2ZKUpKlDwInXwxeaVEHOTLezPGPHcbOf+g1RE0 sjiOIR66NBtQloyoqQ/rqWa+4UBgmhME8r5txoXWpOnfZVzWpqWJFopxxEq/p/1tcbdZw5eMpVm lq7LP9W05UoZbQmxeTRiHIqRJYfBLTcV0vPKfOIX5BDdltaPCnsC1D0iBC9XW7LCu+fArqmEE= X-Received: by 2002:a05:690c:6891:b0:79b:82a1:645d with SMTP id 00721157ae682-7a4d84c2b0cmr136330457b3.29.1775501176499; Mon, 06 Apr 2026 11:46:16 -0700 (PDT) Received: from DEV.lan (c-75-74-152-49.hsd1.fl.comcast.net. [75.74.152.49]) by smtp.gmail.com with ESMTPSA id 00721157ae682-7a36e8343d3sm56288377b3.16.2026.04.06.11.46.15 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 06 Apr 2026 11:46:16 -0700 (PDT) From: Joshua Klinesmith To: nbd@nbd.name, lorenzo@kernel.org, ryder.lee@mediatek.com Cc: shayne.chen@mediatek.com, sean.wang@mediatek.com, linux-wireless@vger.kernel.org, linux-kernel@vger.kernel.org, Joshua Klinesmith , stable@vger.kernel.org Subject: [PATCH 2/3] wifi: mt76: mt7915: fix DMA read beyond mapped length Date: Mon, 6 Apr 2026 14:45:55 -0400 Message-ID: <20260406184556.8245-3-joshuaklinesmith@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260406184556.8245-1-joshuaklinesmith@gmail.com> References: <20260406184556.8245-1-joshuaklinesmith@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Same bug as mt7615: buf[1].len is overridden to MT_CT_PARSE_LEN (72) but the DMA mapping may cover fewer bytes, causing SMMU faults when hardware reads past the mapped region. Cap the firmware parse length to the actual DMA-mapped length. Fixes: c17780e7b21e ("mt76: mt7915: add txfree event v3") Cc: stable@vger.kernel.org Signed-off-by: Joshua Klinesmith --- drivers/net/wireless/mediatek/mt76/mt7915/mac.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/mac.c b/drivers/net/wireless/mediatek/mt76/mt7915/mac.c index cec2c4208255..b66c440dbef3 100644 --- a/drivers/net/wireless/mediatek/mt76/mt7915/mac.c +++ b/drivers/net/wireless/mediatek/mt76/mt7915/mac.c @@ -799,7 +799,7 @@ int mt7915_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr, tx_info->skb = NULL; /* pass partial skb header to fw */ - tx_info->buf[1].len = MT_CT_PARSE_LEN; + tx_info->buf[1].len = min_t(u32, MT_CT_PARSE_LEN, tx_info->buf[1].len); tx_info->buf[1].skip_unmap = true; tx_info->nbuf = MT_CT_DMA_BUF_NUM; -- 2.43.0