[PATCH] mt76: fix buffer overrun in pkt buffer

[Dan Carpenter]

On Tue, Oct 20, 2026 at 11:22:00AM +0800, anthony.liu at mediatek.com wrote:
> From: Anthony Liu <anthony.liu at mediatek.com>
> 
> The last patch (d4e5ca3483a0) addresses mt7928 F/W 4 byte-aligment
> requirement by reducing pkt buffer by 2 bytes, causing the chance
> of buffer overrun.
> 
> This patch reduces incoming skb length limit accordingly.
> 
> Fixes: d4e5ca3483a0 ("wifi: mt76: mt7928: makes struct beacon_tlv 4-byte aligned.")
> Signed-off-by: Anthony Liu <anthony.liu at mediatek.com>
> Reported-by: kernel test robot <lkp at intel.com>
> Reported-by: Dan Carpenter <error27 at gmail.com>
> Closes: https://lore.kernel.org/r/202610172141.mmRmGqow-lkp@intel.com/
> 
> diff --git a/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c
> index 26cdb3f0a98a..131585b3359d 100644
> --- a/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c
> +++ b/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c
> @@ -2479,7 +2479,7 @@ mt7925_mcu_uni_add_beacon_offload(struct mt792x_dev *dev,
>  		return -EINVAL;
>  	}
>  
> -	if (skb->len > 512) {
> +	if (skb->len > 510) {

I would probably use:

	if (skb->len > sizeof(req.beacon_tlv.pkt)) {

but, we do need to apply this patch in linux-next.

regards,
dan carpenter