diff options
| author |   Pengpeng Hou <pengpeng@iscas.ac.cn> | 2026-03-23 16:08:45 +0800 |
|---|---|---|
| committer |   Johannes Berg <johannes.berg@intel.com> | 2026-03-24 15:32:31 +0100 |
| commit | 0fd56fad9c56356e7fa7a7c52e7ecbf807a44eb0 (patch) | |
| tree | e80de5de65d19170c0ab9af875154fce2a3cfd33 /rust/kernel/ssh:/git@git.zx2c4.com | |
| parent | wifi: wilc1000: fix u8 overflow in SSID scan buffer size calculation (diff) | |
wifi: wl1251: validate packet IDs before indexing tx_frames
wl1251_tx_packet_cb() uses the firmware completion ID directly to index
the fixed 16-entry wl->tx_frames[] array. The ID is a raw u8 from the
completion block, and the callback does not currently verify that it
fits the array before dereferencing it.
Reject completion IDs that fall outside wl->tx_frames[] and keep the
existing NULL check in the same guard. This keeps the fix local to the
trust boundary and avoids touching the rest of the completion flow.
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Link: https://patch.msgid.link/20260323080845.40033-1-pengpeng@iscas.ac.cn
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Diffstat (limited to 'rust/kernel/ssh:/git@git.zx2c4.com')
0 files changed, 0 insertions, 0 deletions