wifi: mt76: mt7915: validate skb length in txpower SKU query

Browse source

In mt7915_mcu_get_txpower_sku(), the response skb from
mt76_mcu_send_and_get_msg() is used in memcpy without validating
its length:

For TX_POWER_INFO_RATE:
  memcpy(res, skb->data + 4, sizeof(res));

where sizeof(res) is MT7915_SKU_RATE_NUM * 2 = 322 bytes.

For TX_POWER_INFO_PATH:
  memcpy(txpower, skb->data + 4, len);

In both cases, if the firmware returns a response shorter than
the expected size, the memcpy reads beyond the skb data buffer.
The data surfaces to userspace via debugfs (txpower_sku and
txpower_path).

Add length checks for both code paths before the memcpy.

Signed-off-by: Aviel Zohar <avielzohar123@gmail.com>
Link: https://patch.msgid.link/20260413033136.5417-3-avielzohar123@gmail.com
Signed-off-by: Felix Fietkau <nbd@nbd.name>

...

This commit is contained in:

Aviel Zohar 2026-04-13 06:31:35 +03:00 • committed by Felix Fietkau

parent c7369a0086

commit 4497665cf4

1 changed files with 8 additions and 0 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

8

drivers/net/wireless/mediatek/mt76/mt7915/mcu.c

View file