From: Jiale Yao <yaojiale02@163.com>
To: Felix Fietkau <nbd@nbd.name>,
Lorenzo Bianconi <lorenzo@kernel.org>,
Ryder Lee <ryder.lee@mediatek.com>,
Shayne Chen <shayne.chen@mediatek.com>,
Sean Wang <sean.wang@mediatek.com>,
Matthias Brugger <matthias.bgg@gmail.com>,
AngeloGioacchino Del Regno
<angelogioacchino.delregno@collabora.com>,
Soul Huang <Soul.Huang@mediatek.com>,
linux-wireless@vger.kernel.org, linux-kernel@vger.kernel.org,
linux-arm-kernel@lists.infradead.org,
linux-mediatek@lists.infradead.org
Subject: [PATCH 01/11] wifi: mt76: mt7921: validate MCU response lengths
Date: Tue, 20 Oct 2026 10:45:33 +0800 [thread overview]
Message-ID: <20261020024544.3101738-2-yaojiale02@163.com> (raw)
In-Reply-To: <20261020024544.3101738-1-yaojiale02@163.com>
The MCU parser reads receive descriptor and command payload fields
without checking whether they are present. Truncated firmware responses
can therefore cause out-of-bounds reads.
Validate the descriptor and each command-specific payload before
accessing or removing it from the skb.
Fixes: 1c099ab44727 ("mt76: mt7921: add MCU support")
Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
.../net/wireless/mediatek/mt76/mt7921/mcu.c | 19 +++++++++++++++++++
1 file changed, 19 insertions(+)
diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c
index 40546005c743..782c8baaf776 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c
@@ -26,6 +26,13 @@ int mt7921_mcu_parse_response(struct mt76_dev *mdev, int cmd,
return -ETIMEDOUT;
}
+ if ((cmd == MCU_CMD(PATCH_SEM_CONTROL) ||
+ cmd == MCU_CMD(PATCH_FINISH_REQ)) &&
+ skb->len < sizeof(*rxd) - 4 + sizeof(u8))
+ return -EINVAL;
+ if (cmd != MCU_CMD(PATCH_SEM_CONTROL) &&
+ cmd != MCU_CMD(PATCH_FINISH_REQ) && skb->len < sizeof(*rxd))
+ return -EINVAL;
rxd = (struct mt76_connac2_mcu_rxd *)skb->data;
if (seq != rxd->seq)
@@ -36,6 +43,9 @@ int mt7921_mcu_parse_response(struct mt76_dev *mdev, int cmd,
skb_pull(skb, sizeof(*rxd) - 4);
ret = *skb->data;
} else if (cmd == MCU_EXT_CMD(THERMAL_CTRL)) {
+ if (skb->len < sizeof(*rxd) + 4 + sizeof(__le32))
+ return -EINVAL;
+
skb_pull(skb, sizeof(*rxd) + 4);
ret = le32_to_cpu(*(__le32 *)skb->data);
} else if (cmd == MCU_UNI_CMD(DEV_INFO_UPDATE) ||
@@ -46,6 +56,9 @@ int mt7921_mcu_parse_response(struct mt76_dev *mdev, int cmd,
cmd == MCU_UNI_CMD(SUSPEND)) {
struct mt76_connac_mcu_uni_event *event;
+ if (skb->len < sizeof(*rxd) + sizeof(*event))
+ return -EINVAL;
+
skb_pull(skb, sizeof(*rxd));
event = (struct mt76_connac_mcu_uni_event *)skb->data;
ret = le32_to_cpu(event->status);
@@ -55,12 +68,18 @@ int mt7921_mcu_parse_response(struct mt76_dev *mdev, int cmd,
} else if (cmd == MCU_CE_QUERY(REG_READ)) {
struct mt76_connac_mcu_reg_event *event;
+ if (skb->len < sizeof(*rxd) + sizeof(*event))
+ return -EINVAL;
+
skb_pull(skb, sizeof(*rxd));
event = (struct mt76_connac_mcu_reg_event *)skb->data;
ret = (int)le32_to_cpu(event->val);
} else if (cmd == MCU_EXT_CMD(WF_RF_PIN_CTRL)) {
struct mt7921_wf_rf_pin_ctrl_event *event;
+ if (skb->len < sizeof(*rxd) + sizeof(*event))
+ return -EINVAL;
+
skb_pull(skb, sizeof(*rxd));
event = (struct mt7921_wf_rf_pin_ctrl_event *)skb->data;
ret = (int)event->result;
--
2.34.1
next prev parent reply other threads:[~2026-10-20 2:46 UTC|newest]
Thread overview: 11+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-10-20 2:45 [PATCH 00/11] wifi: mt76: validate mt792x firmware data Jiale Yao
2026-10-20 2:45 ` Jiale Yao [this message]
2026-10-20 2:45 ` [PATCH 02/11] wifi: mt76: mt7921: validate EEPROM response length Jiale Yao
2026-10-20 2:45 ` [PATCH 03/11] wifi: mt76: mt7921: reject malformed TX power responses Jiale Yao
2026-10-20 2:45 ` [PATCH 04/11] wifi: mt76: mt7921: validate testmode query response Jiale Yao
2026-10-20 2:45 ` [PATCH 05/11] wifi: mt76: mt7925: validate MCU response lengths Jiale Yao
2026-10-20 2:45 ` [PATCH 06/11] wifi: mt76: mt7925: validate register query response Jiale Yao
2026-10-20 2:45 ` [PATCH 07/11] wifi: mt76: mt7925: validate EEPROM response length Jiale Yao
2026-10-20 2:45 ` [PATCH 08/11] wifi: mt76: mt7925: validate temperature " Jiale Yao
2026-10-20 2:45 ` [PATCH 09/11] wifi: mt76: mt7925: validate TX power " Jiale Yao
2026-10-20 2:45 ` [PATCH 10/11] wifi: mt76: mt7925: validate radio status response Jiale Yao
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20261020024544.3101738-2-yaojiale02@163.com \
--to=yaojiale02@163.com \
--cc=Soul.Huang@mediatek.com \
--cc=angelogioacchino.delregno@collabora.com \
--cc=linux-arm-kernel@lists.infradead.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mediatek@lists.infradead.org \
--cc=linux-wireless@vger.kernel.org \
--cc=lorenzo@kernel.org \
--cc=matthias.bgg@gmail.com \
--cc=nbd@nbd.name \
--cc=ryder.lee@mediatek.com \
--cc=sean.wang@mediatek.com \
--cc=shayne.chen@mediatek.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox