mirror of
https://github.com/outbackdingo/mt76.git
synced 2026-10-24 21:36:52 +00:00
Aviel ZoharandFelix Fietkau
2802466a94
In mt7915_mcu_get_txpower_sku(), the response skb from mt76_mcu_send_and_get_msg() is used in memcpy without validating its length: For TX_POWER_INFO_RATE: memcpy(res, skb->data + 4, sizeof(res)); where sizeof(res) is MT7915_SKU_RATE_NUM * 2 = 322 bytes. For TX_POWER_INFO_PATH: memcpy(txpower, skb->data + 4, len); In both cases, if the firmware returns a response shorter than the expected size, the memcpy reads beyond the skb data buffer. The data surfaces to userspace via debugfs (txpower_sku and txpower_path). Add length checks for both code paths before the memcpy. Signed-off-by: Aviel Zohar <[email protected]> Link: https://patch.msgid.link/[email protected] Signed-off-by: Felix Fietkau <[email protected]>