* Re: [PATCH v2] wifi: mt76: Fix strscpy buffer overflow in mt76_connac2_load_patch
2025-12-05 16:12 ` [PATCH v2] " Mikhail Gavrilov
@ 2025-12-05 18:14 ` Mario Limonciello
2025-12-13 2:35 ` Eric Biggers
` (2 subsequent siblings)
3 siblings, 0 replies; 7+ messages in thread
From: Mario Limonciello @ 2025-12-05 18:14 UTC (permalink / raw)
To: Mikhail Gavrilov
Cc: Felix Fietkau, Lorenzo Bianconi, linux-wireless, linux-mediatek,
linux-kernel
On 12/5/25 10:12 AM, Mikhail Gavrilov wrote:
> Commit f804a5895eba ("wifi: mt76: Strip whitespace from build ddate") introduced
> a kernel panic/WARN on systems using MediaTek MT7921e (and potentially others
> using mt76_connac_lib) due to an incorrect buffer size calculation.
>
> The error logged is:
> "strnlen: detected buffer overflow: 17 byte read of buffer size 16"
>
> This occurs because the field 'hdr->build_date' is a fixed-size array of 16 bytes.
> The patch allocated a 17-byte local buffer 'build_date' but used 'sizeof(build_date)'
> (17) as the read limit for strscpy, causing Fortify Source to correctly detect
> an attempt to read 17 bytes from the 16-byte source field.
>
> To fix this, replace strscpy with memcpy, which is appropriate for raw data
> copying, and explicitly use the size of the source field (sizeof(hdr->build_date) = 16)
> to limit the read, followed by manual null termination.
>
> Fixes: f804a5895eba ("wifi: mt76: Strip whitespace from build ddate")
> Signed-off-by: Mikhail Gavrilov <mikhail.v.gavrilov@gmail.com>
Reviewed-by: Mario Limonciello (AMD) <superm1@kernel.org>
> ---
> drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c | 7 +++++--
> 1 file changed, 5 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c b/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c
> index ea99167765b0..d2c4c65ec464 100644
> --- a/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c
> +++ b/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c
> @@ -3125,8 +3125,11 @@ int mt76_connac2_load_patch(struct mt76_dev *dev, const char *fw_name)
> }
>
> hdr = (const void *)fw->data;
> - strscpy(build_date, hdr->build_date, sizeof(build_date));
> - build_date[16] = '\0';
> + /* hdr->build_date is 16 bytes. Copy exactly 16 bytes to the 17-byte buffer,
> + * and then add the null terminator at index 16.
> + */
> + memcpy(build_date, hdr->build_date, sizeof(hdr->build_date));
> + build_date[sizeof(hdr->build_date)] = '\0';
> strim(build_date);
> dev_info(dev->dev, "HW/SW Version: 0x%x, Build Time: %.16s\n",
> be32_to_cpu(hdr->hw_sw_ver), build_date);
^ permalink raw reply [flat|nested] 7+ messages in thread* Re: [PATCH v2] wifi: mt76: Fix strscpy buffer overflow in mt76_connac2_load_patch
2025-12-05 16:12 ` [PATCH v2] " Mikhail Gavrilov
2025-12-05 18:14 ` Mario Limonciello
@ 2025-12-13 2:35 ` Eric Biggers
2025-12-13 2:50 ` Mario Limonciello (AMD) (kernel.org)
2025-12-19 20:49 ` Matthew Schwartz
2025-12-23 21:54 ` Nathan Chancellor
3 siblings, 1 reply; 7+ messages in thread
From: Eric Biggers @ 2025-12-13 2:35 UTC (permalink / raw)
To: Mikhail Gavrilov
Cc: Mario Limonciello, Felix Fietkau, Lorenzo Bianconi,
linux-wireless, linux-mediatek, linux-kernel
On Fri, Dec 05, 2025 at 09:12:02PM +0500, Mikhail Gavrilov wrote:
> Commit f804a5895eba ("wifi: mt76: Strip whitespace from build ddate") introduced
> a kernel panic/WARN on systems using MediaTek MT7921e (and potentially others
> using mt76_connac_lib) due to an incorrect buffer size calculation.
>
> The error logged is:
> "strnlen: detected buffer overflow: 17 byte read of buffer size 16"
>
> This occurs because the field 'hdr->build_date' is a fixed-size array of 16 bytes.
> The patch allocated a 17-byte local buffer 'build_date' but used 'sizeof(build_date)'
> (17) as the read limit for strscpy, causing Fortify Source to correctly detect
> an attempt to read 17 bytes from the 16-byte source field.
>
> To fix this, replace strscpy with memcpy, which is appropriate for raw data
> copying, and explicitly use the size of the source field (sizeof(hdr->build_date) = 16)
> to limit the read, followed by manual null termination.
>
> Fixes: f804a5895eba ("wifi: mt76: Strip whitespace from build ddate")
> Signed-off-by: Mikhail Gavrilov <mikhail.v.gavrilov@gmail.com>
> ---
> drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c | 7 +++++--
> 1 file changed, 5 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c b/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c
> index ea99167765b0..d2c4c65ec464 100644
> --- a/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c
> +++ b/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c
> @@ -3125,8 +3125,11 @@ int mt76_connac2_load_patch(struct mt76_dev *dev, const char *fw_name)
> }
>
> hdr = (const void *)fw->data;
> - strscpy(build_date, hdr->build_date, sizeof(build_date));
> - build_date[16] = '\0';
> + /* hdr->build_date is 16 bytes. Copy exactly 16 bytes to the 17-byte buffer,
> + * and then add the null terminator at index 16.
> + */
> + memcpy(build_date, hdr->build_date, sizeof(hdr->build_date));
> + build_date[sizeof(hdr->build_date)] = '\0';
> strim(build_date);
> dev_info(dev->dev, "HW/SW Version: 0x%x, Build Time: %.16s\n",
> be32_to_cpu(hdr->hw_sw_ver), build_date);
Tested-by: Eric Biggers <ebiggers@kernel.org>
Can this be sent upstream soon?
- Eric
^ permalink raw reply [flat|nested] 7+ messages in thread* Re: [PATCH v2] wifi: mt76: Fix strscpy buffer overflow in mt76_connac2_load_patch
2025-12-13 2:35 ` Eric Biggers
@ 2025-12-13 2:50 ` Mario Limonciello (AMD) (kernel.org)
0 siblings, 0 replies; 7+ messages in thread
From: Mario Limonciello (AMD) (kernel.org) @ 2025-12-13 2:50 UTC (permalink / raw)
To: Eric Biggers, Mikhail Gavrilov
Cc: Felix Fietkau, Lorenzo Bianconi, linux-wireless, linux-mediatek,
linux-kernel
On 12/12/2025 8:35 PM, Eric Biggers wrote:
> On Fri, Dec 05, 2025 at 09:12:02PM +0500, Mikhail Gavrilov wrote:
>> Commit f804a5895eba ("wifi: mt76: Strip whitespace from build ddate") introduced
>> a kernel panic/WARN on systems using MediaTek MT7921e (and potentially others
>> using mt76_connac_lib) due to an incorrect buffer size calculation.
>>
>> The error logged is:
>> "strnlen: detected buffer overflow: 17 byte read of buffer size 16"
>>
>> This occurs because the field 'hdr->build_date' is a fixed-size array of 16 bytes.
>> The patch allocated a 17-byte local buffer 'build_date' but used 'sizeof(build_date)'
>> (17) as the read limit for strscpy, causing Fortify Source to correctly detect
>> an attempt to read 17 bytes from the 16-byte source field.
>>
>> To fix this, replace strscpy with memcpy, which is appropriate for raw data
>> copying, and explicitly use the size of the source field (sizeof(hdr->build_date) = 16)
>> to limit the read, followed by manual null termination.
>>
>> Fixes: f804a5895eba ("wifi: mt76: Strip whitespace from build ddate")
>> Signed-off-by: Mikhail Gavrilov <mikhail.v.gavrilov@gmail.com>
>> ---
>> drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c | 7 +++++--
>> 1 file changed, 5 insertions(+), 2 deletions(-)
>>
>> diff --git a/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c b/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c
>> index ea99167765b0..d2c4c65ec464 100644
>> --- a/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c
>> +++ b/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c
>> @@ -3125,8 +3125,11 @@ int mt76_connac2_load_patch(struct mt76_dev *dev, const char *fw_name)
>> }
>>
>> hdr = (const void *)fw->data;
>> - strscpy(build_date, hdr->build_date, sizeof(build_date));
>> - build_date[16] = '\0';
>> + /* hdr->build_date is 16 bytes. Copy exactly 16 bytes to the 17-byte buffer,
>> + * and then add the null terminator at index 16.
>> + */
>> + memcpy(build_date, hdr->build_date, sizeof(hdr->build_date));
>> + build_date[sizeof(hdr->build_date)] = '\0';
>> strim(build_date);
>> dev_info(dev->dev, "HW/SW Version: 0x%x, Build Time: %.16s\n",
>> be32_to_cpu(hdr->hw_sw_ver), build_date);
>
> Tested-by: Eric Biggers <ebiggers@kernel.org>
>
> Can this be sent upstream soon?
>
> - Eric
Tested-by: Mario Limonciello (AMD) <superm1@kernel.org>
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCH v2] wifi: mt76: Fix strscpy buffer overflow in mt76_connac2_load_patch
2025-12-05 16:12 ` [PATCH v2] " Mikhail Gavrilov
2025-12-05 18:14 ` Mario Limonciello
2025-12-13 2:35 ` Eric Biggers
@ 2025-12-19 20:49 ` Matthew Schwartz
2025-12-23 21:54 ` Nathan Chancellor
3 siblings, 0 replies; 7+ messages in thread
From: Matthew Schwartz @ 2025-12-19 20:49 UTC (permalink / raw)
To: Mikhail Gavrilov
Cc: Mario Limonciello, Felix Fietkau, Lorenzo Bianconi,
linux-wireless, linux-mediatek, linux-kernel
> On Dec 5, 2025, at 8:12 AM, Mikhail Gavrilov <mikhail.v.gavrilov@gmail.com> wrote:
>
> Commit f804a5895eba ("wifi: mt76: Strip whitespace from build ddate") introduced
> a kernel panic/WARN on systems using MediaTek MT7921e (and potentially others
> using mt76_connac_lib) due to an incorrect buffer size calculation.
>
> The error logged is:
> "strnlen: detected buffer overflow: 17 byte read of buffer size 16"
>
> This occurs because the field 'hdr->build_date' is a fixed-size array of 16 bytes.
> The patch allocated a 17-byte local buffer 'build_date' but used 'sizeof(build_date)'
> (17) as the read limit for strscpy, causing Fortify Source to correctly detect
> an attempt to read 17 bytes from the 16-byte source field.
>
> To fix this, replace strscpy with memcpy, which is appropriate for raw data
> copying, and explicitly use the size of the source field (sizeof(hdr->build_date) = 16)
> to limit the read, followed by manual null termination.
>
> Fixes: f804a5895eba ("wifi: mt76: Strip whitespace from build ddate")
> Signed-off-by: Mikhail Gavrilov <mikhail.v.gavrilov@gmail.com>
Ran into this kernel panic while booting into 6.19-rc1 on my handheld, this patch fixed it.
Tested-by: Matthew Schwartz <matthew.schwartz@linux.dev>
> ---
> drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c | 7 +++++--
> 1 file changed, 5 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c b/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c
> index ea99167765b0..d2c4c65ec464 100644
> --- a/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c
> +++ b/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c
> @@ -3125,8 +3125,11 @@ int mt76_connac2_load_patch(struct mt76_dev *dev, const char *fw_name)
> }
>
> hdr = (const void *)fw->data;
> - strscpy(build_date, hdr->build_date, sizeof(build_date));
> - build_date[16] = '\0';
> + /* hdr->build_date is 16 bytes. Copy exactly 16 bytes to the 17-byte buffer,
> + * and then add the null terminator at index 16.
> + */
> + memcpy(build_date, hdr->build_date, sizeof(hdr->build_date));
> + build_date[sizeof(hdr->build_date)] = '\0';
> strim(build_date);
> dev_info(dev->dev, "HW/SW Version: 0x%x, Build Time: %.16s\n",
> be32_to_cpu(hdr->hw_sw_ver), build_date);
> --
> 2.52.0
>
>
^ permalink raw reply [flat|nested] 7+ messages in thread* Re: [PATCH v2] wifi: mt76: Fix strscpy buffer overflow in mt76_connac2_load_patch
2025-12-05 16:12 ` [PATCH v2] " Mikhail Gavrilov
` (2 preceding siblings ...)
2025-12-19 20:49 ` Matthew Schwartz
@ 2025-12-23 21:54 ` Nathan Chancellor
3 siblings, 0 replies; 7+ messages in thread
From: Nathan Chancellor @ 2025-12-23 21:54 UTC (permalink / raw)
To: Mikhail Gavrilov
Cc: Mario Limonciello, Felix Fietkau, Lorenzo Bianconi,
linux-wireless, linux-mediatek, linux-kernel, Johannes Berg,
Andrew Lunn, David S. Miller, Eric Dumazet, Jakub Kicinski,
Paolo Abeni, netdev
+ netdev and wireless/networking maintainers
On Fri, Dec 05, 2025 at 09:12:02PM +0500, Mikhail Gavrilov wrote:
> Commit f804a5895eba ("wifi: mt76: Strip whitespace from build ddate") introduced
> a kernel panic/WARN on systems using MediaTek MT7921e (and potentially others
> using mt76_connac_lib) due to an incorrect buffer size calculation.
>
> The error logged is:
> "strnlen: detected buffer overflow: 17 byte read of buffer size 16"
>
> This occurs because the field 'hdr->build_date' is a fixed-size array of 16 bytes.
> The patch allocated a 17-byte local buffer 'build_date' but used 'sizeof(build_date)'
> (17) as the read limit for strscpy, causing Fortify Source to correctly detect
> an attempt to read 17 bytes from the 16-byte source field.
>
> To fix this, replace strscpy with memcpy, which is appropriate for raw data
> copying, and explicitly use the size of the source field (sizeof(hdr->build_date) = 16)
> to limit the read, followed by manual null termination.
>
> Fixes: f804a5895eba ("wifi: mt76: Strip whitespace from build ddate")
> Signed-off-by: Mikhail Gavrilov <mikhail.v.gavrilov@gmail.com>
I got bit by this regression when installing v6.19-rc2 on my new test
machine, which has an MT7925 (RZ717) chip in it. I don't see this in
either Felix's or the main wireless tree yet but I do understand it is
the end of the year with breaks and such (along with Johannes not
actually being on CC since he is not in the output of get_maintainers.pl
for drivers/net/wireless/mediatek/mt76). If there is not going to be a
wireless pull soon, can this be applied to net directly so that it gets
to Linus soon? It was rather annoying to do a bisect for a regression
that already has a pending fix.
Tested-by: Nathan Chancellor <nathan@kernel.org>
> ---
> drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c | 7 +++++--
> 1 file changed, 5 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c b/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c
> index ea99167765b0..d2c4c65ec464 100644
> --- a/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c
> +++ b/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c
> @@ -3125,8 +3125,11 @@ int mt76_connac2_load_patch(struct mt76_dev *dev, const char *fw_name)
> }
>
> hdr = (const void *)fw->data;
> - strscpy(build_date, hdr->build_date, sizeof(build_date));
> - build_date[16] = '\0';
> + /* hdr->build_date is 16 bytes. Copy exactly 16 bytes to the 17-byte buffer,
> + * and then add the null terminator at index 16.
> + */
> + memcpy(build_date, hdr->build_date, sizeof(hdr->build_date));
> + build_date[sizeof(hdr->build_date)] = '\0';
> strim(build_date);
> dev_info(dev->dev, "HW/SW Version: 0x%x, Build Time: %.16s\n",
> be32_to_cpu(hdr->hw_sw_ver), build_date);
> --
> 2.52.0
>
^ permalink raw reply [flat|nested] 7+ messages in thread