gitops/mt76
1
0
Fork 0
mirror of https://github.com/outbackdingo/mt76.git synced 2026-10-24 13:26:48 +00:00
Code Issues Packages Projects Releases Wiki Activity

wifi: mt76: mt7915: validate skb length in txpower SKU query

Browse Source 
In mt7915_mcu_get_txpower_sku(), the response skb from
mt76_mcu_send_and_get_msg() is used in memcpy without validating
its length:

For TX_POWER_INFO_RATE:
  memcpy(res, skb->data + 4, sizeof(res));

where sizeof(res) is MT7915_SKU_RATE_NUM * 2 = 322 bytes.

For TX_POWER_INFO_PATH:
  memcpy(txpower, skb->data + 4, len);

In both cases, if the firmware returns a response shorter than
the expected size, the memcpy reads beyond the skb data buffer.
The data surfaces to userspace via debugfs (txpower_sku and
txpower_path).

Add length checks for both code paths before the memcpy.

Signed-off-by: Aviel Zohar <[email protected]>
Link: https://patch.msgid.link/[email protected]
Signed-off-by: Felix Fietkau <[email protected]>
This commit is contained in:
Aviel Zohar
2026-05-28 13:48:09 +02:00
committed by Felix Fietkau
parent e588dc4843
commit 2802466a94
1 changed files with 8 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
mt7915/mcu.c
+8
View File
@@ -3567,10 +3567,18 @@ int mt7915_mcu_get_txpower_sku(struct mt7915_phy *phy, s8 *txpower, int len,
if (category == TX_POWER_INFO_RATE) {
s8 res[MT7915_SKU_RATE_NUM][2];
if (skb->len < sizeof(res) + 4) {
dev_kfree_skb(skb);
return -EINVAL;
}
memcpy(res, skb->data + 4, sizeof(res));
for (i = 0; i < len; i++)
txpower[i] = res[i][req.band_idx];
} else if (category == TX_POWER_INFO_PATH) {
if (skb->len < len + 4) {
dev_kfree_skb(skb);
return -EINVAL;
}
memcpy(txpower, skb->data + 4, len);
}