The branch stable/15 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=6484d5547fb00aa65d5abdf203c21d4486ad771a
commit 6484d5547fb00aa65d5abdf203c21d4486ad771a Author: Andrew Griffiths <[email protected]> AuthorDate: 2026-08-20 14:29:53 +0000 Commit: Mark Johnston <[email protected]> CommitDate: 2026-09-02 17:40:28 +0000 mtw: fix zero-length queue array that can corrupt struct mtw_softc The mtw softc declares sc_epq with MTW_BULK_RX even though MTW_BULK_RX is enum value 0, while initialization and queue handling index up to MTW_EP_QUEUES; attaching a matching USB WLAN device can drive writes past the absent array and corrupt adjacent softc fields. This suggested patch sizes sc_epq with MTW_EP_QUEUES so the softc contains the endpoint queues the driver initializes and uses. Fixes: c14b01624261 ("mt7601U: Importing if_mtw from OpenBSD") Reviewed by: bz MFC after: 1 week Differential Revision: https://reviews.freebsd.org/D58897 (cherry picked from commit 7e9e72bee359437b9f78c6a4056ef0a90337f341) --- sys/dev/usb/wlan/if_mtwvar.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sys/dev/usb/wlan/if_mtwvar.h b/sys/dev/usb/wlan/if_mtwvar.h index 3cf4c4f9c94e..67b9291cefc2 100644 --- a/sys/dev/usb/wlan/if_mtwvar.h +++ b/sys/dev/usb/wlan/if_mtwvar.h @@ -320,7 +320,7 @@ struct mtw_softc { struct mtw_txd_fw *txd_fw[4]; int sc_sent; uint8_t sc_ivb_1[MTW_MCU_IVB_LEN]; - struct mtw_endpoint_queue sc_epq[MTW_BULK_RX]; + struct mtw_endpoint_queue sc_epq[MTW_EP_QUEUES]; uint8_t rfswitch; uint8_t ext_2ghz_lna; uint8_t ext_5ghz_lna;
