From patchwork Fri Mar 3 08:35:55 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Shayne Chen X-Patchwork-Id: 659133 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id DCBE4C7EE30 for ; Fri, 3 Mar 2023 08:37:57 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230167AbjCCIhz (ORCPT ); Fri, 3 Mar 2023 03:37:55 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:36428 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229868AbjCCIhy (ORCPT ); Fri, 3 Mar 2023 03:37:54 -0500 Received: from mailgw02.mediatek.com (unknown [210.61.82.184]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id E661259E46 for ; Fri, 3 Mar 2023 00:37:27 -0800 (PST) X-UUID: 7f4dd5b6b99e11ed945fc101203acc17-20230303 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=mediatek.com; s=dk; h=Content-Type:MIME-Version:References:In-Reply-To:Message-ID:Date:Subject:CC:To:From; bh=nRFlMhkoG6wNYvXezvChiUeEPZjzrug90jBjW2mbSWs=; b=JkP+QqCPi0DiYeM1btqY2iMAc/5bMg2yY9xhVDE1tGL32SsnU7B+bHOuCy+NO+Bg6Q9BDyQqzep/XvK7Ym8joRiThsDmr5tu+JsfGN4klq0CsmXt3NsLnedctlK6LuYTFjuKyWX8mohRmBe212RPR/dhrcw2dyZJj2LxVmW/PpU=; X-CID-P-RULE: Release_Ham X-CID-O-INFO: VERSION:1.1.20, REQID:c8af1ded-8fe4-47a6-867e-7831e383ea0a, IP:0, U RL:0,TC:0,Content:0,EDM:0,RT:0,SF:0,FILE:0,BULK:0,RULE:Release_Ham,ACTION: release,TS:0 X-CID-META: VersionHash:25b5999, CLOUDID:ad4c3b27-564d-42d9-9875-7c868ee415ec, B ulkID:nil,BulkQuantity:0,Recheck:0,SF:102,TC:nil,Content:0,EDM:-3,IP:nil,U RL:0,File:nil,Bulk:nil,QS:nil,BEC:nil,COL:0,OSI:0,OSA:0,AV:0 X-CID-BVR: 0 X-UUID: 7f4dd5b6b99e11ed945fc101203acc17-20230303 Received: from mtkmbs13n2.mediatek.inc [(172.21.101.108)] by mailgw02.mediatek.com (envelope-from ) (Generic MTA with TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 256/256) with ESMTP id 361732425; Fri, 03 Mar 2023 16:36:31 +0800 Received: from mtkmbs11n1.mediatek.inc (172.21.101.186) by mtkmbs10n2.mediatek.inc (172.21.101.183) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.1118.25; Fri, 3 Mar 2023 16:36:30 +0800 Received: from mtksdccf07.mediatek.inc (172.21.84.99) by mtkmbs11n1.mediatek.inc (172.21.101.73) with Microsoft SMTP Server id 15.2.1118.25 via Frontend Transport; Fri, 3 Mar 2023 16:36:30 +0800 From: Shayne Chen To: Felix Fietkau CC: linux-wireless , Lorenzo Bianconi , Ryder Lee , Evelyn Tsai , Bo Jiao , linux-mediatek , Peter Chiu , Shayne Chen Subject: [PATCH 4/7] wifi: mt76: mt7996: fix pointer calculation in ie countdown event Date: Fri, 3 Mar 2023 16:35:55 +0800 Message-ID: <20230303083558.3586-4-shayne.chen@mediatek.com> X-Mailer: git-send-email 2.18.0 In-Reply-To: <20230303083558.3586-1-shayne.chen@mediatek.com> References: <20230303083558.3586-1-shayne.chen@mediatek.com> MIME-Version: 1.0 X-MTK: N Precedence: bulk List-ID: X-Mailing-List: linux-wireless@vger.kernel.org From: Peter Chiu Fix the tail and data pointers. The rxd->len in mt7996_mcu_rxd does not include the length of general rxd. It only includes the length of firmware event rxd. Use skb->length to get the correct length. Fixes: 98686cd21624 ("wifi: mt76: mt7996: add driver for MediaTek Wi-Fi 7 (802.11be) devices") Signed-off-by: Peter Chiu Signed-off-by: Shayne Chen --- drivers/net/wireless/mediatek/mt76/mt7996/mcu.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c index 90d8135a649a..c11e92db5f07 100644 --- a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c +++ b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c @@ -422,7 +422,8 @@ mt7996_mcu_ie_countdown(struct mt7996_dev *dev, struct sk_buff *skb) if (hdr->band && dev->mt76.phys[hdr->band]) mphy = dev->mt76.phys[hdr->band]; - tail = skb->data + le16_to_cpu(rxd->len); + tail = skb->data + skb->len; + data += sizeof(struct header); while (data + sizeof(struct tlv) < tail && le16_to_cpu(tlv->len)) { switch (le16_to_cpu(tlv->tag)) { case UNI_EVENT_IE_COUNTDOWN_CSA: