[PATCH mt76-next 05/11] wifi: mt76: mt7996: validate radar, thermal and WED RRO event lengths

[Felix Fietkau <nbd@nbd.name>]

mt7996_mcu_rx_event() only guarantees the receive descriptor fields
used for dispatch. mt7996_mcu_rx_radar_detected(),
mt7996_mcu_rx_thermal_notify() and mt7996_mcu_wed_rro_event() then read
event fields after the descriptor without checking the event length. A
truncated event causes an out-of-bounds read.

Ignore events too short for the fields the handler reads, like the
other unsolicited event handlers do.

Fixes: 98686cd21624 ("wifi: mt76: mt7996: add driver for MediaTek Wi-Fi 7 (802.11be) devices")
Fixes: 21f290884bc1 ("wifi: mt76: connac: add thermal protection support for mt7996")
Fixes: a5d028d66836 ("wifi: mt76: mt7996: add wed rro delete session garbage collector")
Signed-off-by: Felix Fietkau <nbd@nbd.name>
---
 drivers/net/wireless/mediatek/mt76/mt7996/mcu.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
index 9037520183f4..590931207d79 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
@@ -544,6 +544,9 @@ mt7996_mcu_rx_radar_detected(struct mt7996_dev *dev, struct sk_buff *skb)
 	struct mt76_phy *mphy = &dev->mt76.phy;
 	struct mt7996_mcu_rdd_report *r;
 
+	if (skb->len < offsetofend(struct mt7996_mcu_rdd_report, rdd_idx))
+		return;
+
 	r = (struct mt7996_mcu_rdd_report *)skb->data;
 
 	switch (r->rdd_idx) {
@@ -763,6 +766,10 @@ mt7996_mcu_rx_thermal_notify(struct mt7996_dev *dev, struct sk_buff *skb)
 	struct mt7996_mcu_thermal_notify *n;
 	struct mt7996_phy *phy;
 
+	if (skb->len < offsetofend(struct mt7996_mcu_thermal_notify,
+				   duty_percent))
+		return;
+
 	n = (struct mt7996_mcu_thermal_notify *)skb->data;
 
 	if (le16_to_cpu(n->tag) != THERMAL_NOTIFY_TAG)
@@ -819,7 +826,7 @@ mt7996_mcu_wed_rro_event(struct mt7996_dev *dev, struct sk_buff *skb)
 {
 	struct mt7996_mcu_wed_rro_event *event = (void *)skb->data;
 
-	if (!mt7996_has_hwrro(dev))
+	if (!mt7996_has_hwrro(dev) || skb->len < sizeof(*event))
 		return;
 
 	skb_pull(skb, sizeof(struct mt7996_mcu_rxd) + 4);
-- 
2.47.3