git: 7e9e72bee359 - main - mtw: fix zero-length queue array that can corrupt struct mtw_softc

The branch main has been updated by markj:

URL: https://cgit.FreeBSD.org/src/commit/?id=7e9e72bee359437b9f78c6a4056ef0a90337f341

commit 7e9e72bee359437b9f78c6a4056ef0a90337f341
Author:     Andrew Griffiths <[email protected]>
AuthorDate: 2026-08-20 14:29:53 +0000
Commit:     Mark Johnston <[email protected]>
CommitDate: 2026-08-20 14:29:53 +0000

    mtw: fix zero-length queue array that can corrupt struct mtw_softc
    
    The mtw softc declares sc_epq with MTW_BULK_RX even though MTW_BULK_RX is enum
    value 0, while initialization and queue handling index up to MTW_EP_QUEUES;
    attaching a matching USB WLAN device can drive writes past the absent array and
    corrupt adjacent softc fields.
    
    This suggested patch sizes sc_epq with MTW_EP_QUEUES so the softc contains the
    endpoint queues the driver initializes and uses.
    
    Fixes:          c14b01624261 ("mt7601U: Importing if_mtw from OpenBSD")
    Reviewed by:    bz
    MFC after:      1 week
    Differential Revision:  https://reviews.freebsd.org/D58897
---
 sys/dev/usb/wlan/if_mtwvar.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sys/dev/usb/wlan/if_mtwvar.h b/sys/dev/usb/wlan/if_mtwvar.h
index 3cf4c4f9c94e..67b9291cefc2 100644
--- a/sys/dev/usb/wlan/if_mtwvar.h
+++ b/sys/dev/usb/wlan/if_mtwvar.h
@@ -320,7 +320,7 @@ struct mtw_softc {
   struct mtw_txd_fw *txd_fw[4];
   int sc_sent;
   uint8_t sc_ivb_1[MTW_MCU_IVB_LEN];
-	struct mtw_endpoint_queue	sc_epq[MTW_BULK_RX];
+	struct mtw_endpoint_queue	sc_epq[MTW_EP_QUEUES];
 	uint8_t				rfswitch;
 	uint8_t				ext_2ghz_lna;
 	uint8_t				ext_5ghz_lna;