From: Jiale Yao <yaojiale02@163.com>
To: Felix Fietkau <nbd@nbd.name>,
Lorenzo Bianconi <lorenzo@kernel.org>,
Ryder Lee <ryder.lee@mediatek.com>,
Shayne Chen <shayne.chen@mediatek.com>,
Sean Wang <sean.wang@mediatek.com>,
Matthias Brugger <matthias.bgg@gmail.com>,
AngeloGioacchino Del Regno
<angelogioacchino.delregno@collabora.com>,
Money Wang <Money.Wang@mediatek.com>,
Bo Jiao <Bo.Jiao@mediatek.com>,
Peter Chiu <chui-hao.chiu@mediatek.com>,
StanleyYP Wang <StanleyYP.Wang@mediatek.com>,
Elwin Huang <s09289728096@gmail.com>,
Howard Hsu <howard-yh.hsu@mediatek.com>,
linux-wireless@vger.kernel.org, linux-kernel@vger.kernel.org,
linux-arm-kernel@lists.infradead.org,
linux-mediatek@lists.infradead.org
Subject: [PATCH 0/7] wifi: mt76: validate mt7996 MCU responses
Date: Tue, 20 Oct 2026 10:49:26 +0800 [thread overview]
Message-ID: <20261020024933.3205681-1-yaojiale02@163.com> (raw)
Several mt7996 MCU paths trust firmware response sizes before reading
receive descriptors, fixed events, or variable data. The asynchronous
IE countdown handler also walks firmware TLVs without bounding their
lengths. Malformed responses can therefore cause out-of-bounds reads.
Validate fixed response fields and payloads, and constrain the IE
countdown TLV walk to the skb.
Jiale Yao (7):
wifi: mt76: mt7996: validate MCU response lengths
wifi: mt76: mt7996: bound IE countdown event parsing
wifi: mt76: mt7996: validate EEPROM response lengths
wifi: mt76: mt7996: validate free-block response length
wifi: mt76: mt7996: validate channel MIB response length
wifi: mt76: mt7996: validate temperature response length
wifi: mt76: mt7996: validate RF register response length
.../net/wireless/mediatek/mt76/mt7996/mcu.c | 97 ++++++++++++++++---
1 file changed, 85 insertions(+), 12 deletions(-)
--
2.34.1
next reply other threads:[~2026-10-20 2:50 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-10-20 2:49 Jiale Yao [this message]
2026-10-20 2:49 ` [PATCH 1/7] wifi: mt76: mt7996: validate MCU response lengths Jiale Yao
2026-10-20 2:49 ` [PATCH 2/7] wifi: mt76: mt7996: bound IE countdown event parsing Jiale Yao
2026-10-20 2:49 ` [PATCH 3/7] wifi: mt76: mt7996: validate EEPROM response lengths Jiale Yao
2026-10-20 2:49 ` [PATCH 4/7] wifi: mt76: mt7996: validate free-block response length Jiale Yao
2026-10-20 2:49 ` [PATCH 5/7] wifi: mt76: mt7996: validate channel MIB " Jiale Yao
2026-10-20 2:49 ` [PATCH 6/7] wifi: mt76: mt7996: validate temperature " Jiale Yao
2026-10-20 2:49 ` [PATCH 7/7] wifi: mt76: mt7996: validate RF register " Jiale Yao
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20261020024933.3205681-1-yaojiale02@163.com \
--to=yaojiale02@163.com \
--cc=Bo.Jiao@mediatek.com \
--cc=Money.Wang@mediatek.com \
--cc=StanleyYP.Wang@mediatek.com \
--cc=angelogioacchino.delregno@collabora.com \
--cc=chui-hao.chiu@mediatek.com \
--cc=howard-yh.hsu@mediatek.com \
--cc=linux-arm-kernel@lists.infradead.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mediatek@lists.infradead.org \
--cc=linux-wireless@vger.kernel.org \
--cc=lorenzo@kernel.org \
--cc=matthias.bgg@gmail.com \
--cc=nbd@nbd.name \
--cc=ryder.lee@mediatek.com \
--cc=s09289728096@gmail.com \
--cc=sean.wang@mediatek.com \
--cc=shayne.chen@mediatek.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®