Commit 7a53eecd authored by Ryder Lee's avatar Ryder Lee Committed by Felix Fietkau
Browse files

wifi: mt76: mt7915: check the correctness of event data 



The mcu event might not be reliable, so check the correctness of data
before handling it.

Signed-off-by: default avatarRyder Lee <ryder.lee@mediatek.com>
Signed-off-by: default avatarFelix Fietkau <nbd@nbd.name>
parent 783ef7da

drivers/net/wireless/mediatek/mt76/mt7915/mcu.c

+17 −4
Original line number Diff line number Diff line
@@ -232,6 +232,9 @@ mt7915_mcu_rx_csa_notify(struct mt7915_dev *dev, struct sk_buff *skb) 


	c = (struct mt7915_mcu_csa_notify *)skb->data;



	if (c->band_idx > MT_BAND1)

		return;



	if ((c->band_idx && !dev->phy.mt76->band_idx) &&

	    dev->mt76.phys[MT_BAND1])

		mphy = dev->mt76.phys[MT_BAND1];
@@ -252,6 +255,9 @@ mt7915_mcu_rx_thermal_notify(struct mt7915_dev *dev, struct sk_buff *skb) 
	if (t->ctrl.ctrl_id != THERMAL_PROTECT_ENABLE)

		return;



	if (t->ctrl.band_idx > MT_BAND1)

		return;



	if ((t->ctrl.band_idx && !dev->phy.mt76->band_idx) &&

	    dev->mt76.phys[MT_BAND1])

		mphy = dev->mt76.phys[MT_BAND1];
@@ -268,6 +274,9 @@ mt7915_mcu_rx_radar_detected(struct mt7915_dev *dev, struct sk_buff *skb) 


	r = (struct mt7915_mcu_rdd_report *)skb->data;



	if (r->band_idx > MT_BAND1)

		return;



	if ((r->band_idx && !dev->phy.mt76->band_idx) &&

	    dev->mt76.phys[MT_BAND1])

		mphy = dev->mt76.phys[MT_BAND1];
@@ -326,7 +335,11 @@ mt7915_mcu_rx_bcc_notify(struct mt7915_dev *dev, struct sk_buff *skb) 


	b = (struct mt7915_mcu_bcc_notify *)skb->data;



	if ((b->band_idx && !dev->phy.mt76->band_idx) && dev->mt76.phys[MT_BAND1])

	if (b->band_idx > MT_BAND1)

		return;



	if ((b->band_idx && !dev->phy.mt76->band_idx) &&

	    dev->mt76.phys[MT_BAND1])

		mphy = dev->mt76.phys[MT_BAND1];



	ieee80211_iterate_active_interfaces_atomic(mphy->hw,