diff options
| author | Shengzhuo Wei <me@cherr.cc> | 2026-08-31 02:42:12 +0800 |
|---|---|---|
| committer | Johannes Berg <johannes.berg@intel.com> | 2026-09-04 10:12:59 +0200 |
| commit | ce858fa6b8a214dee5adb82358885fa024cdd887 (patch) | |
| tree | 516f45c271efe751b23834b74bbef825b88e50fd /tools/perf/scripts/python | |
| parent | c46cfaf8db42de0806076139fb40744d23041377 (diff) | |
wifi: p54: validate curve data length in the calibration curve converters
p54_convert_rev0() and p54_convert_rev1() read calibration curve
data from the device-supplied EEPROM entry using channel and
points-per-channel counts taken verbatim from that same entry, so
an entry that declares more data than it carries drives an
out-of-bounds read past the EEPROM buffer (verified with a KASAN
reproducer of the conversion loop). The sibling converters
p54_convert_output_limits() and p54_convert_db() already validate
their counts against the entry length; this path was missed.
Reject the entry when the counts do not fit in the entry data.
Fixes: eff1a59c48e3 ("[P54]: add mac80211-based driver for prism54 softmac hardware")
Cc: stable@vger.kernel.org
Assisted-by: GLM:5.3
Signed-off-by: Shengzhuo Wei <me@cherr.cc>
Link: https://patch.msgid.link/20260831-p54-pda-validation-v2-1-dae566b388c8@cherr.cc
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Diffstat (limited to 'tools/perf/scripts/python')
0 files changed, 0 insertions, 0 deletions