Pengpeng Hou 8ecdeb8b8a wifi: rsi: validate beacon length before fixed buffer copy ...

rsi_prepare_beacon() copies the mac80211 beacon frame after
FRAME_DESC_SZ into a management skb whose usable tailroom may be smaller
than MAX_MGMT_PKT_SIZE after alignment.

Validate the beacon length against the actual tailroom before the copy
and skb_put(). Leave ownership of the management skb with the caller on
error, matching the existing rsi_send_beacon() cleanup path.

Signed-off-by: Pengpeng Hou <[email protected]>
Link: https://patch.msgid.link/[email protected]
Signed-off-by: Johannes Berg <[email protected]>

2026-07-06 14:11:09 +02:00

..

Kconfig

…

Makefile

…

rsi_91x_coex.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

rsi_91x_core.c

…

rsi_91x_debugfs.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

rsi_91x_hal.c

wifi: rsi: validate beacon length before fixed buffer copy

2026-07-06 14:11:09 +02:00

rsi_91x_mac80211.c

wifi: rsi_91x_usb: do not pause rfkill polling when stopping mac80211

2026-03-19 09:07:16 +01:00

rsi_91x_main.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

rsi_91x_mgmt.c

wifi: rsi: bound background scan probe request copy

2026-07-06 14:11:08 +02:00

rsi_91x_ps.c

…

rsi_91x_sdio_ops.c

…

rsi_91x_sdio.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

rsi_91x_usb_ops.c

…

rsi_91x_usb.c

wifi: rsi_91x_usb: do not pause rfkill polling when stopping mac80211

2026-03-19 09:07:16 +01:00

rsi_boot_params.h

…

rsi_coex.h

…

rsi_common.h

wifi: rsi: fix kthread lifetime race between self-exit and external-stop

2026-04-28 10:40:52 +02:00

rsi_debugfs.h

…

rsi_hal.h

…

rsi_main.h

…

rsi_mgmt.h

…

rsi_ps.h

…

rsi_sdio.h

…

rsi_usb.h

…