Shengzhuo Wei d8efd84f49 wifi: p54: require a full exp_if record in PDR_INTERFACE_LIST ... The PDR_INTERFACE_LIST loop only checks that the record start is within the entry before reading an entire struct exp_if from it. A truncated trailing record makes the if_id/variant reads cross the entry boundary into the heap beyond the EEPROM buffer (verified with a KASAN reproducer of the loop). The variant also feeds the synth front-end selection, so this is not only a leak. Advance only while a full record still fits in the entry. Fixes: eff1a59c48 ("[P54]: add mac80211-based driver for prism54 softmac hardware") Cc: stable@vger.kernel.org Acked-by: Christian Lamparter <chunkeey@gmail.com> Assisted-by: GLM:5.3 Signed-off-by: Shengzhuo Wei <me@cherr.cc> Link: https://patch.msgid.link/20260831-p54-pda-validation-v2-2-dae566b388c8@cherr.cc Signed-off-by: Johannes Berg <johannes.berg@intel.com>		2026-09-04 10:12:59 +02:00
..
p54	wifi: p54: require a full exp_if record in PDR_INTERFACE_LIST	2026-09-04 10:12:59 +02:00
Kconfig	wifi: remove orphaned orinoco driver	2023-10-30 19:29:52 +02:00
Makefile	wifi: remove orphaned orinoco driver	2023-10-30 19:29:52 +02:00