From f5a80422207b76c740f284719539419b6a3dcc89 Mon Sep 17 00:00:00 2001
From: MeiChia Chiu <meichia.chiu@mediatek.com>
Date: Mon, 23 May 2022 17:09:52 +0800
Subject: [PATCH] mt76: mt7915: add the maximum size of beacon offload

add the maximum size of beacon offload to avoid exceeding the size limit

Signed-off-by: Money Wang <Money.Wang@mediatek.com>
Signed-off-by: MeiChia Chiu <MeiChia.Chiu@mediatek.com>
---
 mt7915/mcu.c | 11 +++++++++--
 mt7915/mcu.h |  3 +++
 2 files changed, 12 insertions(+), 2 deletions(-)

diff --git a/mt7915/mcu.c b/mt7915/mcu.c
index bdef2b3..8155900 100644
--- a/mt7915/mcu.c
+++ b/mt7915/mcu.c
@@ -2037,6 +2037,13 @@ mt7915_mcu_beacon_inband_discov(struct mt7915_dev *dev, struct ieee80211_vif *vi
 	len = sizeof(*discov) + MT_TXD_SIZE + skb->len;
 	len = (len & 0x3) ? ((len | 0x3) + 1) : len;
 
+	if (len > (MAX_BEACON_SIZE + MAX_INBND_FRME_SIZE +
+		   MT7915_BEACON_UPDATE_SIZE) - rskb->len) {
+		dev_err(dev->mt76.dev, "inband discovery size limit exceed\n");
+		dev_kfree_skb(skb);
+		return;
+	}
+
 	tlv = mt7915_mcu_add_nested_subtlv(rskb, BSS_INFO_BCN_DISCOV,
 					   len, &bcn->sub_ntlv, &bcn->len);
 	discov = (struct bss_info_inband_discovery *)tlv;
@@ -2059,7 +2066,6 @@ mt7915_mcu_beacon_inband_discov(struct mt7915_dev *dev, struct ieee80211_vif *vi
 int mt7915_mcu_add_beacon(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
 			  int en, u32 changed)
 {
-#define MAX_BEACON_SIZE 512
 	struct mt7915_dev *dev = mt7915_hw_dev(hw);
 	struct mt7915_phy *phy = mt7915_hw_phy(hw);
 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
@@ -2068,7 +2074,8 @@ int mt7915_mcu_add_beacon(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
 	struct sk_buff *skb, *rskb;
 	struct tlv *tlv;
 	struct bss_info_bcn *bcn;
-	int len = MT7915_BEACON_UPDATE_SIZE + MAX_BEACON_SIZE;
+	int len = MT7915_BEACON_UPDATE_SIZE + MAX_BEACON_SIZE +
+		  MAX_INBND_FRME_SIZE;
 	bool ext_phy = phy != &dev->phy;
 
 	if (vif->bss_conf.nontransmitted)
diff --git a/mt7915/mcu.h b/mt7915/mcu.h
index 21aa963..d46c8da 100644
--- a/mt7915/mcu.h
+++ b/mt7915/mcu.h
@@ -490,6 +490,9 @@ enum {
 	SER_RECOVER
 };
 
+#define MAX_BEACON_SIZE 512
+#define MAX_INBND_FRME_SIZE 256
+
 #define MT7915_BSS_UPDATE_MAX_SIZE	(sizeof(struct sta_req_hdr) +	\
 					 sizeof(struct bss_info_omac) +	\
 					 sizeof(struct bss_info_basic) +\
-- 
2.29.2