From: Jiale Yao <yaojiale02@163.com>
To: Felix Fietkau <nbd@nbd.name>,
Lorenzo Bianconi <lorenzo@kernel.org>,
Ryder Lee <ryder.lee@mediatek.com>,
Shayne Chen <shayne.chen@mediatek.com>,
Sean Wang <sean.wang@mediatek.com>,
Matthias Brugger <matthias.bgg@gmail.com>,
AngeloGioacchino Del Regno
<angelogioacchino.delregno@collabora.com>,
Maxime Coquelin <mcoquelin.stm32@gmail.com>,
Alexandre Torgue <alexandre.torgue@foss.st.com>,
Soul Huang <Soul.Huang@mediatek.com>,
Deren Wu <deren.wu@mediatek.com>,
Ming Yen Hsieh <mingyen.hsieh@mediatek.com>,
Rong Yan <rong.yan@mediatek.com>,
Quan Zhou <quan.zhou@mediatek.com>,
Nelson Yu <nelson.yu@mediatek.com>,
Allan Wang <allan.wang@mediatek.com>,
linux-wireless@vger.kernel.org, linux-kernel@vger.kernel.org,
linux-arm-kernel@lists.infradead.org,
linux-mediatek@lists.infradead.org,
linux-stm32@st-md-mailman.stormreply.com
Subject: [PATCH 00/11] wifi: mt76: validate mt792x firmware data
Date: Tue, 20 Oct 2026 10:45:32 +0800 [thread overview]
Message-ID: <20261020024544.3101738-1-yaojiale02@163.com> (raw)
The mt7921 and mt7925 MCU paths trust firmware response sizes before
reading fixed fields or copying payloads. The shared mt792x firmware
capability parser also derives pointers from unchecked region and
release-info lengths. Malformed firmware data can therefore cause
out-of-bounds reads.
Validate each response before accessing it and keep every firmware
region and release-info record within the loaded image.
Jiale Yao (11):
wifi: mt76: mt7921: validate MCU response lengths
wifi: mt76: mt7921: validate EEPROM response length
wifi: mt76: mt7921: reject malformed TX power responses
wifi: mt76: mt7921: validate testmode query response
wifi: mt76: mt7925: validate MCU response lengths
wifi: mt76: mt7925: validate register query response
wifi: mt76: mt7925: validate EEPROM response length
wifi: mt76: mt7925: validate temperature response length
wifi: mt76: mt7925: validate TX power response length
wifi: mt76: mt7925: validate radio status response
wifi: mt76: mt792x: bound firmware release-info parsing
.../net/wireless/mediatek/mt76/mt7921/mcu.c | 34 +++++++++++++-
.../wireless/mediatek/mt76/mt7921/testmode.c | 4 ++
.../net/wireless/mediatek/mt76/mt7925/mcu.c | 43 +++++++++++++++++-
.../net/wireless/mediatek/mt76/mt792x_core.c | 44 ++++++++++++++++---
4 files changed, 117 insertions(+), 8 deletions(-)
--
2.34.1
next reply other threads:[~2026-10-20 2:46 UTC|newest]
Thread overview: 11+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-10-20 2:45 Jiale Yao [this message]
2026-10-20 2:45 ` [PATCH 01/11] wifi: mt76: mt7921: validate MCU response lengths Jiale Yao
2026-10-20 2:45 ` [PATCH 02/11] wifi: mt76: mt7921: validate EEPROM response length Jiale Yao
2026-10-20 2:45 ` [PATCH 03/11] wifi: mt76: mt7921: reject malformed TX power responses Jiale Yao
2026-10-20 2:45 ` [PATCH 04/11] wifi: mt76: mt7921: validate testmode query response Jiale Yao
2026-10-20 2:45 ` [PATCH 05/11] wifi: mt76: mt7925: validate MCU response lengths Jiale Yao
2026-10-20 2:45 ` [PATCH 06/11] wifi: mt76: mt7925: validate register query response Jiale Yao
2026-10-20 2:45 ` [PATCH 07/11] wifi: mt76: mt7925: validate EEPROM response length Jiale Yao
2026-10-20 2:45 ` [PATCH 08/11] wifi: mt76: mt7925: validate temperature " Jiale Yao
2026-10-20 2:45 ` [PATCH 09/11] wifi: mt76: mt7925: validate TX power " Jiale Yao
2026-10-20 2:45 ` [PATCH 10/11] wifi: mt76: mt7925: validate radio status response Jiale Yao
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20261020024544.3101738-1-yaojiale02@163.com \
--to=yaojiale02@163.com \
--cc=Soul.Huang@mediatek.com \
--cc=alexandre.torgue@foss.st.com \
--cc=allan.wang@mediatek.com \
--cc=angelogioacchino.delregno@collabora.com \
--cc=deren.wu@mediatek.com \
--cc=linux-arm-kernel@lists.infradead.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mediatek@lists.infradead.org \
--cc=linux-stm32@st-md-mailman.stormreply.com \
--cc=linux-wireless@vger.kernel.org \
--cc=lorenzo@kernel.org \
--cc=matthias.bgg@gmail.com \
--cc=mcoquelin.stm32@gmail.com \
--cc=mingyen.hsieh@mediatek.com \
--cc=nbd@nbd.name \
--cc=nelson.yu@mediatek.com \
--cc=quan.zhou@mediatek.com \
--cc=rong.yan@mediatek.com \
--cc=ryder.lee@mediatek.com \
--cc=sean.wang@mediatek.com \
--cc=shayne.chen@mediatek.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®