* [PATCH 01/11] wifi: mt76: mt7921: validate MCU response lengths
2026-10-20 2:45 [PATCH 00/11] wifi: mt76: validate mt792x firmware data Jiale Yao
@ 2026-10-20 2:45 ` Jiale Yao
2026-10-20 2:45 ` [PATCH 02/11] wifi: mt76: mt7921: validate EEPROM response length Jiale Yao
` (8 subsequent siblings)
9 siblings, 0 replies; 11+ messages in thread
From: Jiale Yao @ 2026-10-20 2:45 UTC (permalink / raw)
To: Felix Fietkau, Lorenzo Bianconi, Ryder Lee, Shayne Chen,
Sean Wang, Matthias Brugger, AngeloGioacchino Del Regno,
Soul Huang, linux-wireless, linux-kernel, linux-arm-kernel,
linux-mediatek
The MCU parser reads receive descriptor and command payload fields
without checking whether they are present. Truncated firmware responses
can therefore cause out-of-bounds reads.
Validate the descriptor and each command-specific payload before
accessing or removing it from the skb.
Fixes: 1c099ab44727 ("mt76: mt7921: add MCU support")
Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
.../net/wireless/mediatek/mt76/mt7921/mcu.c | 19 +++++++++++++++++++
1 file changed, 19 insertions(+)
diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c
index 40546005c743..782c8baaf776 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c
@@ -26,6 +26,13 @@ int mt7921_mcu_parse_response(struct mt76_dev *mdev, int cmd,
return -ETIMEDOUT;
}
+ if ((cmd == MCU_CMD(PATCH_SEM_CONTROL) ||
+ cmd == MCU_CMD(PATCH_FINISH_REQ)) &&
+ skb->len < sizeof(*rxd) - 4 + sizeof(u8))
+ return -EINVAL;
+ if (cmd != MCU_CMD(PATCH_SEM_CONTROL) &&
+ cmd != MCU_CMD(PATCH_FINISH_REQ) && skb->len < sizeof(*rxd))
+ return -EINVAL;
rxd = (struct mt76_connac2_mcu_rxd *)skb->data;
if (seq != rxd->seq)
@@ -36,6 +43,9 @@ int mt7921_mcu_parse_response(struct mt76_dev *mdev, int cmd,
skb_pull(skb, sizeof(*rxd) - 4);
ret = *skb->data;
} else if (cmd == MCU_EXT_CMD(THERMAL_CTRL)) {
+ if (skb->len < sizeof(*rxd) + 4 + sizeof(__le32))
+ return -EINVAL;
+
skb_pull(skb, sizeof(*rxd) + 4);
ret = le32_to_cpu(*(__le32 *)skb->data);
} else if (cmd == MCU_UNI_CMD(DEV_INFO_UPDATE) ||
@@ -46,6 +56,9 @@ int mt7921_mcu_parse_response(struct mt76_dev *mdev, int cmd,
cmd == MCU_UNI_CMD(SUSPEND)) {
struct mt76_connac_mcu_uni_event *event;
+ if (skb->len < sizeof(*rxd) + sizeof(*event))
+ return -EINVAL;
+
skb_pull(skb, sizeof(*rxd));
event = (struct mt76_connac_mcu_uni_event *)skb->data;
ret = le32_to_cpu(event->status);
@@ -55,12 +68,18 @@ int mt7921_mcu_parse_response(struct mt76_dev *mdev, int cmd,
} else if (cmd == MCU_CE_QUERY(REG_READ)) {
struct mt76_connac_mcu_reg_event *event;
+ if (skb->len < sizeof(*rxd) + sizeof(*event))
+ return -EINVAL;
+
skb_pull(skb, sizeof(*rxd));
event = (struct mt76_connac_mcu_reg_event *)skb->data;
ret = (int)le32_to_cpu(event->val);
} else if (cmd == MCU_EXT_CMD(WF_RF_PIN_CTRL)) {
struct mt7921_wf_rf_pin_ctrl_event *event;
+ if (skb->len < sizeof(*rxd) + sizeof(*event))
+ return -EINVAL;
+
skb_pull(skb, sizeof(*rxd));
event = (struct mt7921_wf_rf_pin_ctrl_event *)skb->data;
ret = (int)event->result;
--
2.34.1
^ permalink raw reply related [flat|nested] 11+ messages in thread* [PATCH 02/11] wifi: mt76: mt7921: validate EEPROM response length
2026-10-20 2:45 [PATCH 00/11] wifi: mt76: validate mt792x firmware data Jiale Yao
2026-10-20 2:45 ` [PATCH 01/11] wifi: mt76: mt7921: validate MCU response lengths Jiale Yao
@ 2026-10-20 2:45 ` Jiale Yao
2026-10-20 2:45 ` [PATCH 03/11] wifi: mt76: mt7921: reject malformed TX power responses Jiale Yao
` (7 subsequent siblings)
9 siblings, 0 replies; 11+ messages in thread
From: Jiale Yao @ 2026-10-20 2:45 UTC (permalink / raw)
To: Felix Fietkau, Lorenzo Bianconi, Ryder Lee, Shayne Chen,
Sean Wang, Matthias Brugger, AngeloGioacchino Del Regno, Deren Wu,
Ming Yen Hsieh, linux-wireless, linux-kernel, linux-arm-kernel,
linux-mediatek
The EEPROM reader indexes the data array in a firmware response without
checking that the complete response structure is present. A truncated
response can therefore cause an out-of-bounds read.
Require the complete EEPROM response before indexing its data.
Fixes: 23bdc5d8cadf ("wifi: mt76: mt7921: introduce Country Location Control support")
Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
drivers/net/wireless/mediatek/mt76/mt7921/mcu.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c
index 782c8baaf776..ef6660653723 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c
@@ -104,6 +104,10 @@ static int mt7921_mcu_read_eeprom(struct mt792x_dev *dev, u32 offset, u8 *val)
&req, sizeof(req), true, &skb);
if (ret)
return ret;
+ if (skb->len < sizeof(*res)) {
+ dev_kfree_skb(skb);
+ return -EINVAL;
+ }
res = (struct mt7921_mcu_eeprom_info *)skb->data;
*val = res->data[offset % MT7921_EEPROM_BLOCK_SIZE];
--
2.34.1
^ permalink raw reply related [flat|nested] 11+ messages in thread* [PATCH 03/11] wifi: mt76: mt7921: reject malformed TX power responses
2026-10-20 2:45 [PATCH 00/11] wifi: mt76: validate mt792x firmware data Jiale Yao
2026-10-20 2:45 ` [PATCH 01/11] wifi: mt76: mt7921: validate MCU response lengths Jiale Yao
2026-10-20 2:45 ` [PATCH 02/11] wifi: mt76: mt7921: validate EEPROM response length Jiale Yao
@ 2026-10-20 2:45 ` Jiale Yao
2026-10-20 2:45 ` [PATCH 04/11] wifi: mt76: mt7921: validate testmode query response Jiale Yao
` (6 subsequent siblings)
9 siblings, 0 replies; 11+ messages in thread
From: Jiale Yao @ 2026-10-20 2:45 UTC (permalink / raw)
To: Felix Fietkau, Lorenzo Bianconi, Ryder Lee, Shayne Chen,
Sean Wang, Matthias Brugger, AngeloGioacchino Del Regno,
linux-wireless, linux-kernel, linux-arm-kernel, linux-mediatek
mt7921_get_txpwr_info() only warns when the firmware length differs from
the skb length and then copies the response anyway. It also reads the
length field before ensuring that the response header is present.
Require the complete event and reject a mismatched firmware length
before copying the TX power data.
Fixes: ea29acc97c55 ("mt76: mt7921: add dumping Tx power table")
Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
drivers/net/wireless/mediatek/mt76/mt7921/mcu.c | 11 ++++++++++-
1 file changed, 10 insertions(+), 1 deletion(-)
diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c
index ef6660653723..96e5e13d3c47 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c
@@ -1167,8 +1167,17 @@ int mt7921_get_txpwr_info(struct mt792x_dev *dev, struct mt7921_txpwr *txpwr)
if (ret)
return ret;
+ if (skb->len < sizeof(*event)) {
+ dev_kfree_skb(skb);
+ return -EINVAL;
+ }
+
event = (struct mt7921_txpwr_event *)skb->data;
- WARN_ON(skb->len != le16_to_cpu(event->len));
+ if (skb->len != le16_to_cpu(event->len)) {
+ dev_kfree_skb(skb);
+ return -EINVAL;
+ }
+
memcpy(txpwr, &event->txpwr, sizeof(event->txpwr));
dev_kfree_skb(skb);
--
2.34.1
^ permalink raw reply related [flat|nested] 11+ messages in thread* [PATCH 04/11] wifi: mt76: mt7921: validate testmode query response
2026-10-20 2:45 [PATCH 00/11] wifi: mt76: validate mt792x firmware data Jiale Yao
` (2 preceding siblings ...)
2026-10-20 2:45 ` [PATCH 03/11] wifi: mt76: mt7921: reject malformed TX power responses Jiale Yao
@ 2026-10-20 2:45 ` Jiale Yao
2026-10-20 2:45 ` [PATCH 05/11] wifi: mt76: mt7925: validate MCU response lengths Jiale Yao
` (5 subsequent siblings)
9 siblings, 0 replies; 11+ messages in thread
From: Jiale Yao @ 2026-10-20 2:45 UTC (permalink / raw)
To: Felix Fietkau, Lorenzo Bianconi, Ryder Lee, Shayne Chen,
Sean Wang, Matthias Brugger, AngeloGioacchino Del Regno,
Maxime Coquelin, Alexandre Torgue, linux-wireless, linux-kernel,
linux-arm-kernel, linux-mediatek, linux-stm32
The testmode query reads both response parameters without checking that
the firmware returned a complete event. A truncated response can cause
out-of-bounds reads.
Reject responses shorter than the testmode event structure.
Fixes: bce844584799 ("mt76: mt7921: introduce testmode support")
Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
drivers/net/wireless/mediatek/mt76/mt7921/testmode.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/testmode.c b/drivers/net/wireless/mediatek/mt76/mt7921/testmode.c
index e60ee992edf8..ce95b0db1428 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7921/testmode.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7921/testmode.c
@@ -98,6 +98,10 @@ mt7921_tm_query(struct mt792x_dev *dev, struct mt7921_tm_cmd *req,
&cmd, sizeof(cmd), true, &skb);
if (ret)
goto out;
+ if (skb->len < sizeof(*evt)) {
+ ret = -EINVAL;
+ goto out;
+ }
evt = (struct mt7921_rftest_evt *)skb->data;
evt_resp->param0 = le32_to_cpu(evt->param0);
--
2.34.1
^ permalink raw reply related [flat|nested] 11+ messages in thread* [PATCH 05/11] wifi: mt76: mt7925: validate MCU response lengths
2026-10-20 2:45 [PATCH 00/11] wifi: mt76: validate mt792x firmware data Jiale Yao
` (3 preceding siblings ...)
2026-10-20 2:45 ` [PATCH 04/11] wifi: mt76: mt7921: validate testmode query response Jiale Yao
@ 2026-10-20 2:45 ` Jiale Yao
2026-10-20 2:45 ` [PATCH 06/11] wifi: mt76: mt7925: validate register query response Jiale Yao
` (4 subsequent siblings)
9 siblings, 0 replies; 11+ messages in thread
From: Jiale Yao @ 2026-10-20 2:45 UTC (permalink / raw)
To: Felix Fietkau, Lorenzo Bianconi, Ryder Lee, Shayne Chen,
Sean Wang, Matthias Brugger, AngeloGioacchino Del Regno,
Hao Zhang, Leon Yen, Mingyen Hsieh, Rong Yan, Nelson Yu,
linux-wireless, linux-kernel, linux-arm-kernel, linux-mediatek
The MCU parser reads receive descriptor and UNI event fields without
checking whether they are present. Truncated firmware responses can
therefore cause out-of-bounds reads.
Account for the shorter patch responses and validate all other receive
descriptors and UNI event payloads before accessing them.
Fixes: c948b5da6bbe ("wifi: mt76: mt7925: add Mediatek Wi-Fi7 driver for mt7925 chips")
Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
drivers/net/wireless/mediatek/mt76/mt7925/mcu.c | 14 ++++++++++++++
1 file changed, 14 insertions(+)
diff --git a/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c
index fa29c486a455..bca753d8ce71 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c
@@ -32,6 +32,17 @@ int mt7925_mcu_parse_response(struct mt76_dev *mdev, int cmd,
return -ETIMEDOUT;
}
+ if ((cmd == MCU_CMD(PATCH_SEM_CONTROL) ||
+ cmd == MCU_CMD(PATCH_FINISH_REQ) ||
+ cmd == MCU_CMD(CB_PATCH_SEM_CONTROL) ||
+ cmd == MCU_CMD(CB_PATCH_FINISH_REQ)) &&
+ skb->len < sizeof(*rxd) - 4 + sizeof(u8))
+ return -EINVAL;
+ if (cmd != MCU_CMD(PATCH_SEM_CONTROL) &&
+ cmd != MCU_CMD(PATCH_FINISH_REQ) &&
+ cmd != MCU_CMD(CB_PATCH_SEM_CONTROL) &&
+ cmd != MCU_CMD(CB_PATCH_FINISH_REQ) && skb->len < sizeof(*rxd))
+ return -EINVAL;
rxd = (struct mt7925_mcu_rxd *)skb->data;
if (seq != rxd->seq) {
@@ -60,6 +71,9 @@ int mt7925_mcu_parse_response(struct mt76_dev *mdev, int cmd,
cmd == MCU_UNI_CMD(NAN)) {
struct mt7925_mcu_uni_event *event;
+ if (skb->len < sizeof(*rxd) + sizeof(*event))
+ return -EINVAL;
+
skb_pull(skb, sizeof(*rxd));
event = (struct mt7925_mcu_uni_event *)skb->data;
ret = le32_to_cpu(event->status);
--
2.34.1
^ permalink raw reply related [flat|nested] 11+ messages in thread* [PATCH 06/11] wifi: mt76: mt7925: validate register query response
2026-10-20 2:45 [PATCH 00/11] wifi: mt76: validate mt792x firmware data Jiale Yao
` (4 preceding siblings ...)
2026-10-20 2:45 ` [PATCH 05/11] wifi: mt76: mt7925: validate MCU response lengths Jiale Yao
@ 2026-10-20 2:45 ` Jiale Yao
2026-10-20 2:45 ` [PATCH 07/11] wifi: mt76: mt7925: validate EEPROM response length Jiale Yao
` (3 subsequent siblings)
9 siblings, 0 replies; 11+ messages in thread
From: Jiale Yao @ 2026-10-20 2:45 UTC (permalink / raw)
To: Felix Fietkau, Lorenzo Bianconi, Ryder Lee, Shayne Chen,
Sean Wang, Matthias Brugger, AngeloGioacchino Del Regno,
Hao Zhang, Quan Zhou, Rong Yan, Leon Yen, Nelson Yu,
linux-wireless, linux-kernel, linux-arm-kernel, linux-mediatek
The register query reads either a basic or RF register response without
checking its length. A truncated firmware response can cause an
out-of-bounds read.
Calculate the response size for the selected register type and reject
short responses before reading the value.
Fixes: c948b5da6bbe ("wifi: mt76: mt7925: add Mediatek Wi-Fi7 driver for mt7925 chips")
Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
drivers/net/wireless/mediatek/mt76/mt7925/mcu.c | 13 ++++++++++++-
1 file changed, 12 insertions(+), 1 deletion(-)
diff --git a/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c
index bca753d8ce71..ce860e63a108 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c
@@ -113,7 +113,7 @@ int mt7925_mcu_regval(struct mt792x_dev *dev, u32 regidx, u32 *val, bool set)
};
} __packed * res, req;
struct sk_buff *skb;
- int ret;
+ int len, ret;
if (u32_get_bits(regidx, MT_RF_REG_HDR) == RF_REG_PREFIX) {
req.rf_reg.tag = cpu_to_le16(UNI_CMD_ACCESS_RF_REG_BASIC);
@@ -138,6 +138,17 @@ int mt7925_mcu_regval(struct mt792x_dev *dev, u32 regidx, u32 *val, bool set)
if (ret)
return ret;
+ len = sizeof(res->__rsv);
+ if (u32_get_bits(regidx, MT_RF_REG_HDR) == RF_REG_PREFIX)
+ len += sizeof(res->rf_reg);
+ else
+ len += sizeof(res->reg);
+
+ if (skb->len < len) {
+ dev_kfree_skb(skb);
+ return -EINVAL;
+ }
+
res = (void *)skb->data;
if (u32_get_bits(regidx, MT_RF_REG_HDR) == RF_REG_PREFIX)
*val = le32_to_cpu(res->rf_reg.data);
--
2.34.1
^ permalink raw reply related [flat|nested] 11+ messages in thread* [PATCH 07/11] wifi: mt76: mt7925: validate EEPROM response length
2026-10-20 2:45 [PATCH 00/11] wifi: mt76: validate mt792x firmware data Jiale Yao
` (5 preceding siblings ...)
2026-10-20 2:45 ` [PATCH 06/11] wifi: mt76: mt7925: validate register query response Jiale Yao
@ 2026-10-20 2:45 ` Jiale Yao
2026-10-20 2:45 ` [PATCH 08/11] wifi: mt76: mt7925: validate temperature " Jiale Yao
` (2 subsequent siblings)
9 siblings, 0 replies; 11+ messages in thread
From: Jiale Yao @ 2026-10-20 2:45 UTC (permalink / raw)
To: Felix Fietkau, Lorenzo Bianconi, Ryder Lee, Shayne Chen,
Sean Wang, Matthias Brugger, AngeloGioacchino Del Regno,
Ming Yen Hsieh, linux-wireless, linux-kernel, linux-arm-kernel,
linux-mediatek
The EEPROM reader indexes the response data array without checking that
the complete firmware event is present. A truncated response can cause
an out-of-bounds read.
Require the complete EEPROM event before indexing its data.
Fixes: f2027ef3f733 ("wifi: mt76: mt7925: load the appropriate CLC data based on hardware type")
Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
drivers/net/wireless/mediatek/mt76/mt7925/mcu.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c
index ce860e63a108..e5cacb12d367 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c
@@ -887,6 +887,10 @@ static int mt7925_mcu_read_eeprom(struct mt792x_dev *dev, u32 offset, u8 *val)
&req, sizeof(req), true, &skb);
if (ret)
return ret;
+ if (skb->len < sizeof(*res)) {
+ dev_kfree_skb(skb);
+ return -EINVAL;
+ }
res = (struct evt *)skb->data;
*val = res->data[offset % MT7925_EEPROM_BLOCK_SIZE];
--
2.34.1
^ permalink raw reply related [flat|nested] 11+ messages in thread* [PATCH 08/11] wifi: mt76: mt7925: validate temperature response length
2026-10-20 2:45 [PATCH 00/11] wifi: mt76: validate mt792x firmware data Jiale Yao
` (6 preceding siblings ...)
2026-10-20 2:45 ` [PATCH 07/11] wifi: mt76: mt7925: validate EEPROM response length Jiale Yao
@ 2026-10-20 2:45 ` Jiale Yao
2026-10-20 2:45 ` [PATCH 09/11] wifi: mt76: mt7925: validate TX power " Jiale Yao
2026-10-20 2:45 ` [PATCH 10/11] wifi: mt76: mt7925: validate radio status response Jiale Yao
9 siblings, 0 replies; 11+ messages in thread
From: Jiale Yao @ 2026-10-20 2:45 UTC (permalink / raw)
To: Felix Fietkau, Lorenzo Bianconi, Ryder Lee, Shayne Chen,
Sean Wang, Matthias Brugger, AngeloGioacchino Del Regno, Deren Wu,
linux-wireless, linux-kernel, linux-arm-kernel, linux-mediatek
The temperature query removes a fixed prefix and TLV header and then
reads the event without validating the response length. A truncated
firmware response can cause an out-of-bounds read.
Require the prefix, TLV header, and complete temperature event before
pulling the skb.
Fixes: 396e41a74a88 ("wifi: mt76: mt7925: support temperature sensor")
Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
drivers/net/wireless/mediatek/mt76/mt7925/mcu.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c
index e5cacb12d367..d768002c64c2 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c
@@ -1037,6 +1037,10 @@ int mt7925_mcu_get_temperature(struct mt792x_phy *phy)
&req, sizeof(req), true, &skb);
if (ret)
return ret;
+ if (skb->len < 4 + sizeof(struct tlv) + sizeof(*evt)) {
+ dev_kfree_skb(skb);
+ return -EINVAL;
+ }
skb_pull(skb, 4 + sizeof(struct tlv));
evt = (struct mt7925_thermal_evt *)skb->data;
--
2.34.1
^ permalink raw reply related [flat|nested] 11+ messages in thread* [PATCH 09/11] wifi: mt76: mt7925: validate TX power response length
2026-10-20 2:45 [PATCH 00/11] wifi: mt76: validate mt792x firmware data Jiale Yao
` (7 preceding siblings ...)
2026-10-20 2:45 ` [PATCH 08/11] wifi: mt76: mt7925: validate temperature " Jiale Yao
@ 2026-10-20 2:45 ` Jiale Yao
2026-10-20 2:45 ` [PATCH 10/11] wifi: mt76: mt7925: validate radio status response Jiale Yao
9 siblings, 0 replies; 11+ messages in thread
From: Jiale Yao @ 2026-10-20 2:45 UTC (permalink / raw)
To: Felix Fietkau, Lorenzo Bianconi, Ryder Lee, Shayne Chen,
Sean Wang, Matthias Brugger, AngeloGioacchino Del Regno, Deren Wu,
Hao Zhang, Mingyen Hsieh, linux-wireless, linux-kernel,
linux-arm-kernel, linux-mediatek
The TX power query copies a complete event payload without checking the
firmware response length. A truncated response can cause an
out-of-bounds read.
Require the complete TX power event before copying its payload.
Fixes: c948b5da6bbe ("wifi: mt76: mt7925: add Mediatek Wi-Fi7 driver for mt7925 chips")
Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
drivers/net/wireless/mediatek/mt76/mt7925/mcu.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c
index d768002c64c2..f37d2a8eafe6 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c
@@ -2287,6 +2287,10 @@ int mt7925_get_txpwr_info(struct mt792x_dev *dev, u8 band_idx, struct mt7925_txp
&req, sizeof(req), true, &skb);
if (ret)
return ret;
+ if (skb->len < sizeof(*event)) {
+ dev_kfree_skb(skb);
+ return -EINVAL;
+ }
event = (struct mt7925_txpwr_event *)skb->data;
memcpy(txpwr, &event->txpwr, sizeof(event->txpwr));
--
2.34.1
^ permalink raw reply related [flat|nested] 11+ messages in thread* [PATCH 10/11] wifi: mt76: mt7925: validate radio status response
2026-10-20 2:45 [PATCH 00/11] wifi: mt76: validate mt792x firmware data Jiale Yao
` (8 preceding siblings ...)
2026-10-20 2:45 ` [PATCH 09/11] wifi: mt76: mt7925: validate TX power " Jiale Yao
@ 2026-10-20 2:45 ` Jiale Yao
9 siblings, 0 replies; 11+ messages in thread
From: Jiale Yao @ 2026-10-20 2:45 UTC (permalink / raw)
To: Felix Fietkau, Lorenzo Bianconi, Ryder Lee, Shayne Chen,
Sean Wang, Matthias Brugger, AngeloGioacchino Del Regno,
Allan Wang, linux-wireless, linux-kernel, linux-arm-kernel,
linux-mediatek
The radio status query removes an outer TLV header and reads the status
event without checking the response length. A truncated firmware
response can cause an out-of-bounds read.
Require both the outer TLV header and complete status event before
pulling the skb.
Fixes: e54b870212c0 ("wifi: mt76: mt7925: add rfkill_poll for hardware rfkill")
Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
drivers/net/wireless/mediatek/mt76/mt7925/mcu.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c
index f37d2a8eafe6..0baef78148d1 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c
@@ -4140,6 +4140,10 @@ int mt7925_mcu_wf_rf_pin_ctrl(struct mt792x_phy *phy)
&req, sizeof(req), true, &skb);
if (ret)
return ret;
+ if (skb->len < sizeof(struct tlv) + sizeof(*status)) {
+ dev_kfree_skb(skb);
+ return -EINVAL;
+ }
skb_pull(skb, sizeof(struct tlv));
status = (struct mt7925_radio_status_event *)skb->data;
--
2.34.1
^ permalink raw reply related [flat|nested] 11+ messages in thread