[PATCH 00/11] wifi: mt76: validate mt792x firmware data

[PATCH 00/11] wifi: mt76: validate mt792x firmware data

[Jiale Yao]

The mt7921 and mt7925 MCU paths trust firmware response sizes before
reading fixed fields or copying payloads. The shared mt792x firmware
capability parser also derives pointers from unchecked region and
release-info lengths. Malformed firmware data can therefore cause
out-of-bounds reads.

Validate each response before accessing it and keep every firmware
region and release-info record within the loaded image.

Jiale Yao (11):
  wifi: mt76: mt7921: validate MCU response lengths
  wifi: mt76: mt7921: validate EEPROM response length
  wifi: mt76: mt7921: reject malformed TX power responses
  wifi: mt76: mt7921: validate testmode query response
  wifi: mt76: mt7925: validate MCU response lengths
  wifi: mt76: mt7925: validate register query response
  wifi: mt76: mt7925: validate EEPROM response length
  wifi: mt76: mt7925: validate temperature response length
  wifi: mt76: mt7925: validate TX power response length
  wifi: mt76: mt7925: validate radio status response
  wifi: mt76: mt792x: bound firmware release-info parsing

 .../net/wireless/mediatek/mt76/mt7921/mcu.c   | 34 +++++++++++++-
 .../wireless/mediatek/mt76/mt7921/testmode.c  |  4 ++
 .../net/wireless/mediatek/mt76/mt7925/mcu.c   | 43 +++++++++++++++++-
 .../net/wireless/mediatek/mt76/mt792x_core.c  | 44 ++++++++++++++++---
 4 files changed, 117 insertions(+), 8 deletions(-)

-- 
2.34.1

[PATCH 01/11] wifi: mt76: mt7921: validate MCU response lengths

[Jiale Yao]

The MCU parser reads receive descriptor and command payload fields
without checking whether they are present. Truncated firmware responses
can therefore cause out-of-bounds reads.

Validate the descriptor and each command-specific payload before
accessing or removing it from the skb.

Fixes: 1c099ab44727 ("mt76: mt7921: add MCU support")
Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
 .../net/wireless/mediatek/mt76/mt7921/mcu.c   | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)

diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c
index 40546005c743..782c8baaf776 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c
@@ -26,6 +26,13 @@ int mt7921_mcu_parse_response(struct mt76_dev *mdev, int cmd,
 
 		return -ETIMEDOUT;
 	}
+	if ((cmd == MCU_CMD(PATCH_SEM_CONTROL) ||
+	     cmd == MCU_CMD(PATCH_FINISH_REQ)) &&
+	    skb->len < sizeof(*rxd) - 4 + sizeof(u8))
+		return -EINVAL;
+	if (cmd != MCU_CMD(PATCH_SEM_CONTROL) &&
+	    cmd != MCU_CMD(PATCH_FINISH_REQ) && skb->len < sizeof(*rxd))
+		return -EINVAL;
 
 	rxd = (struct mt76_connac2_mcu_rxd *)skb->data;
 	if (seq != rxd->seq)
@@ -36,6 +43,9 @@ int mt7921_mcu_parse_response(struct mt76_dev *mdev, int cmd,
 		skb_pull(skb, sizeof(*rxd) - 4);
 		ret = *skb->data;
 	} else if (cmd == MCU_EXT_CMD(THERMAL_CTRL)) {
+		if (skb->len < sizeof(*rxd) + 4 + sizeof(__le32))
+			return -EINVAL;
+
 		skb_pull(skb, sizeof(*rxd) + 4);
 		ret = le32_to_cpu(*(__le32 *)skb->data);
 	} else if (cmd == MCU_UNI_CMD(DEV_INFO_UPDATE) ||
@@ -46,6 +56,9 @@ int mt7921_mcu_parse_response(struct mt76_dev *mdev, int cmd,
 		   cmd == MCU_UNI_CMD(SUSPEND)) {
 		struct mt76_connac_mcu_uni_event *event;
 
+		if (skb->len < sizeof(*rxd) + sizeof(*event))
+			return -EINVAL;
+
 		skb_pull(skb, sizeof(*rxd));
 		event = (struct mt76_connac_mcu_uni_event *)skb->data;
 		ret = le32_to_cpu(event->status);
@@ -55,12 +68,18 @@ int mt7921_mcu_parse_response(struct mt76_dev *mdev, int cmd,
 	} else if (cmd == MCU_CE_QUERY(REG_READ)) {
 		struct mt76_connac_mcu_reg_event *event;
 
+		if (skb->len < sizeof(*rxd) + sizeof(*event))
+			return -EINVAL;
+
 		skb_pull(skb, sizeof(*rxd));
 		event = (struct mt76_connac_mcu_reg_event *)skb->data;
 		ret = (int)le32_to_cpu(event->val);
 	} else if (cmd == MCU_EXT_CMD(WF_RF_PIN_CTRL)) {
 		struct mt7921_wf_rf_pin_ctrl_event *event;
 
+		if (skb->len < sizeof(*rxd) + sizeof(*event))
+			return -EINVAL;
+
 		skb_pull(skb, sizeof(*rxd));
 		event = (struct mt7921_wf_rf_pin_ctrl_event *)skb->data;
 		ret = (int)event->result;
-- 
2.34.1

[PATCH 02/11] wifi: mt76: mt7921: validate EEPROM response length

[Jiale Yao]

The EEPROM reader indexes the data array in a firmware response without
checking that the complete response structure is present. A truncated
response can therefore cause an out-of-bounds read.

Require the complete EEPROM response before indexing its data.

Fixes: 23bdc5d8cadf ("wifi: mt76: mt7921: introduce Country Location Control support")
Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
 drivers/net/wireless/mediatek/mt76/mt7921/mcu.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c
index 782c8baaf776..ef6660653723 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c
@@ -104,6 +104,10 @@ static int mt7921_mcu_read_eeprom(struct mt792x_dev *dev, u32 offset, u8 *val)
 					&req, sizeof(req), true, &skb);
 	if (ret)
 		return ret;
+	if (skb->len < sizeof(*res)) {
+		dev_kfree_skb(skb);
+		return -EINVAL;
+	}
 
 	res = (struct mt7921_mcu_eeprom_info *)skb->data;
 	*val = res->data[offset % MT7921_EEPROM_BLOCK_SIZE];
-- 
2.34.1

[PATCH 03/11] wifi: mt76: mt7921: reject malformed TX power responses

[Jiale Yao]

mt7921_get_txpwr_info() only warns when the firmware length differs from
the skb length and then copies the response anyway. It also reads the
length field before ensuring that the response header is present.

Require the complete event and reject a mismatched firmware length
before copying the TX power data.

Fixes: ea29acc97c55 ("mt76: mt7921: add dumping Tx power table")
Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
 drivers/net/wireless/mediatek/mt76/mt7921/mcu.c | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c
index ef6660653723..96e5e13d3c47 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c
@@ -1167,8 +1167,17 @@ int mt7921_get_txpwr_info(struct mt792x_dev *dev, struct mt7921_txpwr *txpwr)
 	if (ret)
 		return ret;
 
+	if (skb->len < sizeof(*event)) {
+		dev_kfree_skb(skb);
+		return -EINVAL;
+	}
+
 	event = (struct mt7921_txpwr_event *)skb->data;
-	WARN_ON(skb->len != le16_to_cpu(event->len));
+	if (skb->len != le16_to_cpu(event->len)) {
+		dev_kfree_skb(skb);
+		return -EINVAL;
+	}
+
 	memcpy(txpwr, &event->txpwr, sizeof(event->txpwr));
 
 	dev_kfree_skb(skb);
-- 
2.34.1

[PATCH 04/11] wifi: mt76: mt7921: validate testmode query response

[Jiale Yao]

The testmode query reads both response parameters without checking that
the firmware returned a complete event. A truncated response can cause
out-of-bounds reads.

Reject responses shorter than the testmode event structure.

Fixes: bce844584799 ("mt76: mt7921: introduce testmode support")
Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
 drivers/net/wireless/mediatek/mt76/mt7921/testmode.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/testmode.c b/drivers/net/wireless/mediatek/mt76/mt7921/testmode.c
index e60ee992edf8..ce95b0db1428 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7921/testmode.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7921/testmode.c
@@ -98,6 +98,10 @@ mt7921_tm_query(struct mt792x_dev *dev, struct mt7921_tm_cmd *req,
 					&cmd, sizeof(cmd), true, &skb);
 	if (ret)
 		goto out;
+	if (skb->len < sizeof(*evt)) {
+		ret = -EINVAL;
+		goto out;
+	}
 
 	evt = (struct mt7921_rftest_evt *)skb->data;
 	evt_resp->param0 = le32_to_cpu(evt->param0);
-- 
2.34.1

[PATCH 05/11] wifi: mt76: mt7925: validate MCU response lengths

[Jiale Yao]

The MCU parser reads receive descriptor and UNI event fields without
checking whether they are present. Truncated firmware responses can
therefore cause out-of-bounds reads.

Account for the shorter patch responses and validate all other receive
descriptors and UNI event payloads before accessing them.

Fixes: c948b5da6bbe ("wifi: mt76: mt7925: add Mediatek Wi-Fi7 driver for mt7925 chips")
Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
 drivers/net/wireless/mediatek/mt76/mt7925/mcu.c | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c
index fa29c486a455..bca753d8ce71 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c
@@ -32,6 +32,17 @@ int mt7925_mcu_parse_response(struct mt76_dev *mdev, int cmd,
 
 		return -ETIMEDOUT;
 	}
+	if ((cmd == MCU_CMD(PATCH_SEM_CONTROL) ||
+	     cmd == MCU_CMD(PATCH_FINISH_REQ) ||
+	     cmd == MCU_CMD(CB_PATCH_SEM_CONTROL) ||
+	     cmd == MCU_CMD(CB_PATCH_FINISH_REQ)) &&
+	    skb->len < sizeof(*rxd) - 4 + sizeof(u8))
+		return -EINVAL;
+	if (cmd != MCU_CMD(PATCH_SEM_CONTROL) &&
+	    cmd != MCU_CMD(PATCH_FINISH_REQ) &&
+	    cmd != MCU_CMD(CB_PATCH_SEM_CONTROL) &&
+	    cmd != MCU_CMD(CB_PATCH_FINISH_REQ) && skb->len < sizeof(*rxd))
+		return -EINVAL;
 
 	rxd = (struct mt7925_mcu_rxd *)skb->data;
 	if (seq != rxd->seq) {
@@ -60,6 +71,9 @@ int mt7925_mcu_parse_response(struct mt76_dev *mdev, int cmd,
 		   cmd == MCU_UNI_CMD(NAN)) {
 		struct mt7925_mcu_uni_event *event;
 
+		if (skb->len < sizeof(*rxd) + sizeof(*event))
+			return -EINVAL;
+
 		skb_pull(skb, sizeof(*rxd));
 		event = (struct mt7925_mcu_uni_event *)skb->data;
 		ret = le32_to_cpu(event->status);
-- 
2.34.1

[PATCH 06/11] wifi: mt76: mt7925: validate register query response

[Jiale Yao]

The register query reads either a basic or RF register response without
checking its length. A truncated firmware response can cause an
out-of-bounds read.

Calculate the response size for the selected register type and reject
short responses before reading the value.

Fixes: c948b5da6bbe ("wifi: mt76: mt7925: add Mediatek Wi-Fi7 driver for mt7925 chips")
Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
 drivers/net/wireless/mediatek/mt76/mt7925/mcu.c | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c
index bca753d8ce71..ce860e63a108 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c
@@ -113,7 +113,7 @@ int mt7925_mcu_regval(struct mt792x_dev *dev, u32 regidx, u32 *val, bool set)
 		};
 	} __packed * res, req;
 	struct sk_buff *skb;
-	int ret;
+	int len, ret;
 
 	if (u32_get_bits(regidx, MT_RF_REG_HDR) == RF_REG_PREFIX) {
 		req.rf_reg.tag = cpu_to_le16(UNI_CMD_ACCESS_RF_REG_BASIC);
@@ -138,6 +138,17 @@ int mt7925_mcu_regval(struct mt792x_dev *dev, u32 regidx, u32 *val, bool set)
 	if (ret)
 		return ret;
 
+	len = sizeof(res->__rsv);
+	if (u32_get_bits(regidx, MT_RF_REG_HDR) == RF_REG_PREFIX)
+		len += sizeof(res->rf_reg);
+	else
+		len += sizeof(res->reg);
+
+	if (skb->len < len) {
+		dev_kfree_skb(skb);
+		return -EINVAL;
+	}
+
 	res = (void *)skb->data;
 	if (u32_get_bits(regidx, MT_RF_REG_HDR) == RF_REG_PREFIX)
 		*val = le32_to_cpu(res->rf_reg.data);
-- 
2.34.1

[PATCH 07/11] wifi: mt76: mt7925: validate EEPROM response length

[Jiale Yao]

The EEPROM reader indexes the response data array without checking that
the complete firmware event is present. A truncated response can cause
an out-of-bounds read.

Require the complete EEPROM event before indexing its data.

Fixes: f2027ef3f733 ("wifi: mt76: mt7925: load the appropriate CLC data based on hardware type")
Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
 drivers/net/wireless/mediatek/mt76/mt7925/mcu.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c
index ce860e63a108..e5cacb12d367 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c
@@ -887,6 +887,10 @@ static int mt7925_mcu_read_eeprom(struct mt792x_dev *dev, u32 offset, u8 *val)
 					&req, sizeof(req), true, &skb);
 	if (ret)
 		return ret;
+	if (skb->len < sizeof(*res)) {
+		dev_kfree_skb(skb);
+		return -EINVAL;
+	}
 
 	res = (struct evt *)skb->data;
 	*val = res->data[offset % MT7925_EEPROM_BLOCK_SIZE];
-- 
2.34.1

[PATCH 08/11] wifi: mt76: mt7925: validate temperature response length

[Jiale Yao]

The temperature query removes a fixed prefix and TLV header and then
reads the event without validating the response length. A truncated
firmware response can cause an out-of-bounds read.

Require the prefix, TLV header, and complete temperature event before
pulling the skb.

Fixes: 396e41a74a88 ("wifi: mt76: mt7925: support temperature sensor")
Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
 drivers/net/wireless/mediatek/mt76/mt7925/mcu.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c
index e5cacb12d367..d768002c64c2 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c
@@ -1037,6 +1037,10 @@ int mt7925_mcu_get_temperature(struct mt792x_phy *phy)
 					&req, sizeof(req), true, &skb);
 	if (ret)
 		return ret;
+	if (skb->len < 4 + sizeof(struct tlv) + sizeof(*evt)) {
+		dev_kfree_skb(skb);
+		return -EINVAL;
+	}
 
 	skb_pull(skb, 4 + sizeof(struct tlv));
 	evt = (struct mt7925_thermal_evt *)skb->data;
-- 
2.34.1

[PATCH 09/11] wifi: mt76: mt7925: validate TX power response length

[Jiale Yao]

The TX power query copies a complete event payload without checking the
firmware response length. A truncated response can cause an
out-of-bounds read.

Require the complete TX power event before copying its payload.

Fixes: c948b5da6bbe ("wifi: mt76: mt7925: add Mediatek Wi-Fi7 driver for mt7925 chips")
Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
 drivers/net/wireless/mediatek/mt76/mt7925/mcu.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c
index d768002c64c2..f37d2a8eafe6 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c
@@ -2287,6 +2287,10 @@ int mt7925_get_txpwr_info(struct mt792x_dev *dev, u8 band_idx, struct mt7925_txp
 					&req, sizeof(req), true, &skb);
 	if (ret)
 		return ret;
+	if (skb->len < sizeof(*event)) {
+		dev_kfree_skb(skb);
+		return -EINVAL;
+	}
 
 	event = (struct mt7925_txpwr_event *)skb->data;
 	memcpy(txpwr, &event->txpwr, sizeof(event->txpwr));
-- 
2.34.1

[PATCH 10/11] wifi: mt76: mt7925: validate radio status response

[Jiale Yao]

The radio status query removes an outer TLV header and reads the status
event without checking the response length. A truncated firmware
response can cause an out-of-bounds read.

Require both the outer TLV header and complete status event before
pulling the skb.

Fixes: e54b870212c0 ("wifi: mt76: mt7925: add rfkill_poll for hardware rfkill")
Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
 drivers/net/wireless/mediatek/mt76/mt7925/mcu.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c
index f37d2a8eafe6..0baef78148d1 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c
@@ -4140,6 +4140,10 @@ int mt7925_mcu_wf_rf_pin_ctrl(struct mt792x_phy *phy)
 					&req, sizeof(req), true, &skb);
 	if (ret)
 		return ret;
+	if (skb->len < sizeof(struct tlv) + sizeof(*status)) {
+		dev_kfree_skb(skb);
+		return -EINVAL;
+	}
 
 	skb_pull(skb, sizeof(struct tlv));
 	status = (struct mt7925_radio_status_event *)skb->data;
-- 
2.34.1