github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-09-14 16:10:02 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph
ca800a9302
linux/drivers
History
Linmao Li ca800a9302 wifi: nxpwifi: bound uAP association event IEs to the event buffer 
nxpwifi_uap_event_sta_assoc() exposes the association request IEs that
the firmware reports in the uAP association event, which the driver
copies into the fixed-size event_body[] buffer.

event->len is supplied by firmware and is not validated. A value smaller
than the header underflows the subtraction used for assoc_req_ies_len,
while a larger value can make the IE range extend beyond event_body[].
Subsequent IE parsing can then read past the adapter object.

Validate both bounds before using the firmware-reported length.

nxpwifi was derived from mwifiex before commit f0858bfc7d ("wifi:
mwifiex: bound uAP association event IEs to the event buffer") and
retains the same unchecked length. Apply the equivalent bounds check
here.

Fixes: 73b01e57ed ("wifi: nxp: add nxpwifi driver for IW61x")
Signed-off-by: Linmao Li <lilinmao@kylinos.cn>
Reviewed-by: Jeff Chen <jeff.chen_1@nxp.com>
Link: https://patch.msgid.link/20260729082457.1897303-1-lilinmao@kylinos.cn
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-08-06 14:04:51 +02:00
..
accel accel/amdxdna: Fix use-after-free of mm_struct in job scheduler 2026-07-16 20:05:28 -07:00
accessibility
acpi ACPI support fixes for 7.2-rc2 2026-07-03 15:13:50 -10:00
amba amba: use generic driver_override infrastructure 2026-05-30 22:25:23 +02:00
android rust_binder: clear freeze listener on node removal 2026-07-03 13:54:10 +02:00
ata ata fixes for 7.2-rc4 2026-07-17 17:58:57 -07:00
atm atm: remove unused ATM PHY operations 2026-06-16 08:53:53 -07:00
auxdisplay Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
base regmap: Fix for v7.2 2026-06-26 10:47:26 -07:00
bcma
block block-7.2-20260717 2026-07-19 09:29:42 -07:00
bluetooth Bluetooth: btusb: validate Realtek vendor event length 2026-07-20 17:41:28 -04:00
bus Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
cache Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
cdrom
cdx Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
char tpm: Make the TPM character devices non-seekable 2026-07-12 12:52:34 -07:00
clk Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
clocksource A series of updates for the VDSO: 2026-06-15 13:57:13 +05:30
comedi Linux 7.1-rc6 2026-06-01 18:10:34 +02:00
connector
counter Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
cpufreq cpufreq: Make cpufreq_update_pressure() fall back to cpuinfo.max_freq 2026-07-09 20:31:57 +02:00
cpuidle cpuidle: Allow exit latency to exceed target residency 2026-06-23 14:00:29 +02:00
crypto Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
cxl cxl: Support dpa without a mailbox 2026-06-29 10:55:47 -07:00
dax mm.git review status for mm-hotfixes-stable..mm-stable 2026-06-19 10:14:34 -07:00
dca
devfreq Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
dibs dibs: loopback: validate offset and size in move_data() 2026-07-09 12:44:00 +02:00
dio
dma Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
dma-buf udmabuf: Ensure to perform cache synchronisation in begin_cpu_udmabuf() 2026-07-10 16:26:39 -07:00
dpll Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2026-07-20 09:18:11 +02:00
edac Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
eisa
extcon Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
firewire Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
firmware Mostly driver changes this time: 2026-07-27 16:03:40 -07:00
fpga Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
fsi Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
fwctl
gnss
gpib Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
gpio gpio: mvebu: free generic chips on unbind 2026-07-08 14:05:11 +02:00
gpu drm fixes for 7.2-rc4 2026-07-17 16:56:55 -07:00
greybus
hid Android/IIO bugfixes for 7.2-rc3 2026-07-12 12:37:28 -07:00
hsi Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
hte Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
hv hyperv-next for v7.2-rc1 2026-06-22 08:06:13 -07:00
hwmon hwmon: occ: validate poll response sensor blocks 2026-07-20 07:29:44 -07:00
hwspinlock hwspinlock: qcom: avoid uninitialized struct members 2026-06-08 21:51:12 -05:00
hwtracing Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
i2c i2c: mediatek: fix WRRD for SoCs without auto_restart option 2026-07-15 00:21:51 +02:00
i3c i3c: mipi-i3c-hci: Use named initializers for platform_device_id's .driver_data 2026-06-16 23:19:45 +02:00
idle x86/msr updates for v7.2: 2026-06-15 15:08:14 +05:30
iio Android/IIO bugfixes for 7.2-rc3 2026-07-12 12:37:28 -07:00
infiniband Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2026-07-23 14:07:40 -07:00
input Input updates for v7.2-rc2 2026-07-11 15:42:55 -07:00
interconnect Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
iommu Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
ipack
irqchip Misc irqchip driver fixes: 2026-07-05 05:29:41 -10:00
leds Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
macintosh sched/cputime: Remove superfluous and error prone kcpustat_field() parameter 2026-06-02 21:27:25 +02:00
mailbox Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
mcb
md dm thin metadata: fix superblock refcount leak on snapshot shadow failure 2026-07-11 15:18:51 +02:00
media Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
memory Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
memstick memstick: ms_block: reject a card that reports too many blocks 2026-07-06 17:09:30 +02:00
message
mfd Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
misc Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
mmc Mostly driver changes this time: 2026-07-27 16:03:40 -07:00
most
mtd Among the most important fixes that we have here, there are: 2026-07-17 09:30:17 -07:00
mux Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
net wifi: nxpwifi: bound uAP association event IEs to the event buffer 2026-08-06 14:04:51 +02:00
nfc Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
ntb NTB updates include an EPF bug fix to prevent an invalid unmap during 2026-06-28 07:46:12 -07:00
nubus
nvdimm Updates for the 7.2 release 2026-06-18 16:27:58 -07:00
nvme block-7.2-20260625 2026-06-25 09:56:47 -07:00
nvmem Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
of Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
opp
parisc
parport
pci rtw-next patches for v7.3 2026-08-02 18:50:03 +02:00
pcmcia
peci
perf Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
phy Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
pinctrl gpio fixes for v7.2-rc2 2026-07-03 05:38:12 -10:00
platform platform-drivers-x86 for v7.2-3 2026-07-22 10:36:10 -07:00
pmdomain pmdomain: mediatek: Fix possible nullptr KP in HWV cleanup/on-check 2026-07-13 12:42:17 +02:00
pnp Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
power Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
powercap powercap: intel_rapl: Use sysfs_emit() in cpumask_show() 2026-06-01 19:55:32 +02:00
pps Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
ps3
ptp ptp: netc: explicitly clear TMR_OFF during initialization 2026-07-23 09:16:14 -07:00
pwm Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
rapidio mm.git review status for mm-hotfixes-stable..mm-nonmm-stable 2026-06-21 13:20:19 -07:00
ras - Fix a malformed Kconfig default for the AMD Address Translation Library 2026-06-16 05:31:01 +05:30
regulator regulator: ltc3676: Fix incorrect IRQSTAT bit offsets 2026-07-16 16:19:07 +01:00
remoteproc remoteproc: qcom: pas: Drop start/stop completion from struct qcom_pas 2026-06-08 21:53:51 -05:00
resctrl arm64 updates for 7.2 2026-06-16 05:18:04 +05:30
reset Reset controller fixes for v7.2 2026-07-10 14:15:39 +02:00
rpmsg rpmsg update for v7.2 2026-06-20 23:31:15 -07:00
rtc Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
s390 s390/zcrypt: Remove the empty file 2026-07-08 17:02:47 +02:00
sbus
scsi scsi: hpsa: Fix DMA mapping leak on IOACCEL2 reset path 2026-07-12 22:21:22 -04:00
sh
siox Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
slimbus slimbus: qcom-ngd-ctrl: Avoid ABBA on tx_lock/ctrl->lock 2026-06-05 17:19:51 +02:00
soc soc/tegra: Fixes for v7.2 2026-07-10 14:42:00 +02:00
soundwire Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
spi spi: cadence-quadspi: Fix indirect write timeout when DMA read mode is enabled 2026-07-14 12:54:50 +01:00
spmi Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
ssb
staging wifi: cfg80211: convert cookie output to input parameter 2026-08-02 17:40:08 +02:00
target scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE 2026-07-12 22:21:22 -04:00
tc
tee soc: drivers for 7.2 2026-06-17 11:21:40 -07:00
thermal Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
thunderbolt USB/Thunderbolt driver changes for 7.2-rc1 2026-06-22 12:09:47 -07:00
tty TTY/Serial fixes for 7.2-rc3 2026-07-12 12:29:38 -07:00
ufs scsi: ufs: core: tracing: Do not dereference pointers in TP_printk() 2026-07-08 21:51:36 -04:00
uio Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
usb usb: atm: ueagle-atm: reject descriptors that confuse probe and disconnect 2026-07-23 08:26:15 -07:00
vdpa Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
vfio vfio/pci: Expose latched module parameter policy in debugfs 2026-06-29 14:26:31 -06:00
vhost vhost-net: fix TX stall when vhost owns virtio-net header 2026-07-21 13:25:34 +02:00
video Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
virt Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
virtio mm: page_reporting: allow driver to set batch capacity 2026-07-09 15:48:56 -07:00
w1 Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
watchdog watchdog fixes for v7.2-rc5 2026-07-22 11:15:49 -07:00
xen SCSI fixes on 20260718 2026-07-18 12:36:19 -07:00
zorro
Kconfig
Makefile