diff options
| author | Andrew Griffiths <andrew@calif.io> | 2026-08-20 14:29:53 +0000 |
|---|---|---|
| committer | Mark Johnston <markj@FreeBSD.org> | 2026-08-20 14:29:53 +0000 |
| commit | 7e9e72bee359437b9f78c6a4056ef0a90337f341 (patch) | |
| tree | a396b668043353865c5f20a8701c78b4afa5777c /lib/Lex/Preprocessor.cpp | |
| parent | f2366851616083f923e8101363802678a03dc0b9 (diff) | |
mtw: fix zero-length queue array that can corrupt struct mtw_softc
The mtw softc declares sc_epq with MTW_BULK_RX even though MTW_BULK_RX is enum
value 0, while initialization and queue handling index up to MTW_EP_QUEUES;
attaching a matching USB WLAN device can drive writes past the absent array and
corrupt adjacent softc fields.
This suggested patch sizes sc_epq with MTW_EP_QUEUES so the softc contains the
endpoint queues the driver initializes and uses.
Fixes: c14b01624261 ("mt7601U: Importing if_mtw from OpenBSD")
Reviewed by: bz
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D58897
Diffstat (limited to 'lib/Lex/Preprocessor.cpp')
0 files changed, 0 insertions, 0 deletions