autobuild_mac80211_release/package/kernel/mt76/patches/0006-mt76-mt7915-add-the-maximum-size-of-beacon-offload.patch

From f07ccb594e7e4653db40a84ac34f12958dc7a4bd Mon Sep 17 00:00:00 2001
From: MeiChia Chiu <meichia.chiu@mediatek.com>
Date: Mon, 23 May 2022 17:09:52 +0800
Subject: [PATCH 06/12] mt76: mt7915: add the maximum size of beacon offload

add the maximum size of beacon offload to avoid exceeding the size limit

Signed-off-by: Money Wang <Money.Wang@mediatek.com>
Signed-off-by: MeiChia Chiu <MeiChia.Chiu@mediatek.com>
---
 mt7915/mcu.c | 11 +++++++++--
 mt7915/mcu.h |  3 +++
 2 files changed, 12 insertions(+), 2 deletions(-)

diff --git a/mt7915/mcu.c b/mt7915/mcu.c
index f513005..3a88638 100644
--- a/mt7915/mcu.c
+++ b/mt7915/mcu.c
@@ -1937,6 +1937,13 @@ mt7915_mcu_beacon_inband_discov(struct mt7915_dev *dev, struct ieee80211_vif *vi
 	len = sizeof(*discov) + MT_TXD_SIZE + skb->len;
 	len = (len & 0x3) ? ((len | 0x3) + 1) : len;
 
+	if (len > (MAX_BEACON_SIZE + MAX_INBND_FRME_SIZE +
+		   MT7915_BEACON_UPDATE_SIZE) - rskb->len) {
+		dev_err(dev->mt76.dev, "inband discovery size limit exceed\n");
+		dev_kfree_skb(skb);
+		return;
+	}
+
 	tlv = mt7915_mcu_add_nested_subtlv(rskb, BSS_INFO_BCN_DISCOV,
 					   len, &bcn->sub_ntlv, &bcn->len);
 	discov = (struct bss_info_inband_discovery *)tlv;
@@ -1959,7 +1966,6 @@ mt7915_mcu_beacon_inband_discov(struct mt7915_dev *dev, struct ieee80211_vif *vi
 int mt7915_mcu_add_beacon(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
 			  int en, u32 changed)
 {
-#define MAX_BEACON_SIZE 512
 	struct mt7915_dev *dev = mt7915_hw_dev(hw);
 	struct mt7915_phy *phy = mt7915_hw_phy(hw);
 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
@@ -1968,7 +1974,8 @@ int mt7915_mcu_add_beacon(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
 	struct sk_buff *skb, *rskb;
 	struct tlv *tlv;
 	struct bss_info_bcn *bcn;
-	int len = MT7915_BEACON_UPDATE_SIZE + MAX_BEACON_SIZE;
+	int len = MT7915_BEACON_UPDATE_SIZE + MAX_BEACON_SIZE +
+		  MAX_INBND_FRME_SIZE;
 	bool ext_phy = phy != &dev->phy;
 
 	if (vif->bss_conf.nontransmitted)
diff --git a/mt7915/mcu.h b/mt7915/mcu.h
index bd9c6dc..b82f258 100644
--- a/mt7915/mcu.h
+++ b/mt7915/mcu.h
@@ -453,6 +453,9 @@ enum {
 	SER_RECOVER
 };
 
+#define MAX_BEACON_SIZE 512
+#define MAX_INBND_FRME_SIZE 256
+
 #define MT7915_BSS_UPDATE_MAX_SIZE	(sizeof(struct sta_req_hdr) +	\
 					 sizeof(struct bss_info_omac) +	\
 					 sizeof(struct bss_info_basic) +\
-- 
2.18.0