[PATCH 0/7] wifi: mt76: validate mt7996 MCU responses

[PATCH 0/7] wifi: mt76: validate mt7996 MCU responses

[Jiale Yao]

Several mt7996 MCU paths trust firmware response sizes before reading
receive descriptors, fixed events, or variable data. The asynchronous
IE countdown handler also walks firmware TLVs without bounding their
lengths. Malformed responses can therefore cause out-of-bounds reads.

Validate fixed response fields and payloads, and constrain the IE
countdown TLV walk to the skb.

Jiale Yao (7):
  wifi: mt76: mt7996: validate MCU response lengths
  wifi: mt76: mt7996: bound IE countdown event parsing
  wifi: mt76: mt7996: validate EEPROM response lengths
  wifi: mt76: mt7996: validate free-block response length
  wifi: mt76: mt7996: validate channel MIB response length
  wifi: mt76: mt7996: validate temperature response length
  wifi: mt76: mt7996: validate RF register response length

 .../net/wireless/mediatek/mt76/mt7996/mcu.c   | 97 ++++++++++++++++---
 1 file changed, 85 insertions(+), 12 deletions(-)

-- 
2.34.1

[PATCH 1/7] wifi: mt76: mt7996: validate MCU response lengths

[Jiale Yao]

The MCU receive and response paths access descriptor fields without
checking that they are present. The response parser can also read a UNI
event payload beyond a truncated skb.

Require enough descriptor data at the receive entry point, account for
the shorter patch response, and validate UNI event payloads before
accessing them.

Fixes: 98686cd21624 ("wifi: mt76: mt7996: add driver for MediaTek Wi-Fi 7 (802.11be) devices")
Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
 drivers/net/wireless/mediatek/mt76/mt7996/mcu.c | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
index cd7587ce5b8a..d661ff1e4a20 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
@@ -238,6 +238,11 @@ mt7996_mcu_parse_response(struct mt76_dev *mdev, int cmd,
 
 		return -ETIMEDOUT;
 	}
+	if (cmd == MCU_CMD(PATCH_SEM_CONTROL) &&
+	    skb->len < offsetofend(struct mt7996_mcu_rxd, ext_eid))
+		return -EINVAL;
+	if (cmd != MCU_CMD(PATCH_SEM_CONTROL) && skb->len < sizeof(*rxd))
+		return -EINVAL;
 
 	rxd = (struct mt7996_mcu_rxd *)skb->data;
 	if (seq != rxd->seq)
@@ -248,6 +253,9 @@ mt7996_mcu_parse_response(struct mt76_dev *mdev, int cmd,
 		ret = *skb->data;
 	} else if ((rxd->option & MCU_UNI_CMD_EVENT) &&
 		    rxd->eid == MCU_UNI_EVENT_RESULT) {
+		if (skb->len < sizeof(*rxd) + sizeof(*event))
+			return -EINVAL;
+
 		skb_pull(skb, sizeof(*rxd));
 		event = (struct mt7996_mcu_uni_event *)skb->data;
 		ret = le32_to_cpu(event->status);
@@ -943,6 +951,11 @@ void mt7996_mcu_rx_event(struct mt7996_dev *dev, struct sk_buff *skb)
 {
 	struct mt7996_mcu_rxd *rxd = (struct mt7996_mcu_rxd *)skb->data;
 
+	if (skb->len < offsetofend(struct mt7996_mcu_rxd, ext_eid)) {
+		dev_kfree_skb(skb);
+		return;
+	}
+
 	if (rxd->option & MCU_UNI_CMD_UNSOLICITED_EVENT) {
 		mt7996_mcu_uni_rx_unsolicited_event(dev, skb);
 		return;
-- 
2.34.1

[PATCH 2/7] wifi: mt76: mt7996: bound IE countdown event parsing

[Jiale Yao]

The IE countdown handler reads its fixed header before checking the skb
length. Its TLV loop also accepts lengths smaller than the TLV header or
larger than the remaining data and reads the event payload unchecked.

Validate the fixed fields and constrain every TLV and known countdown
payload to the response buffer.

Fixes: 98686cd21624 ("wifi: mt76: mt7996: add driver for MediaTek Wi-Fi 7 (802.11be) devices")
Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
 .../net/wireless/mediatek/mt76/mt7996/mcu.c   | 38 ++++++++++++++-----
 1 file changed, 28 insertions(+), 10 deletions(-)

diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
index d661ff1e4a20..1f7af6359dd7 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
@@ -489,12 +489,20 @@ mt7996_mcu_ie_countdown(struct mt7996_dev *dev, struct sk_buff *skb)
 		u8 band;
 		u8 rsv[3];
 	};
-	struct mt7996_mcu_rxd *rxd = (struct mt7996_mcu_rxd *)skb->data;
-	const char *data = (char *)&rxd[1], *tail;
-	struct header *hdr = (struct header *)data;
-	struct tlv *tlv = (struct tlv *)(data + 4);
+	struct mt7996_mcu_rxd *rxd;
+	const char *data, *tail;
+	struct header *hdr;
+	struct tlv *tlv;
 	struct mt7996_mcu_countdown_notify *event;
 	struct mt7996_mcu_countdown_data cdata;
+	u16 tlv_len;
+
+	if (skb->len < sizeof(*rxd) + sizeof(*hdr))
+		return;
+
+	rxd = (struct mt7996_mcu_rxd *)skb->data;
+	data = (char *)&rxd[1];
+	hdr = (struct header *)data;
 
 	if (hdr->band >= ARRAY_SIZE(dev->mt76.phys))
 		return;
@@ -505,18 +513,29 @@ mt7996_mcu_ie_countdown(struct mt7996_dev *dev, struct sk_buff *skb)
 
 	tail = skb->data + skb->len;
 	data += sizeof(*hdr);
-	while (data + sizeof(*tlv) < tail && le16_to_cpu(tlv->len)) {
-		event = (struct mt7996_mcu_countdown_notify *)tlv->data;
-
-		cdata.omac_idx = event->omac_idx;
+	while (tail - data >= sizeof(*tlv)) {
+		tlv = (struct tlv *)data;
+		tlv_len = le16_to_cpu(tlv->len);
+		if (tlv_len < sizeof(*tlv) || tlv_len > tail - data)
+			return;
 
 		switch (le16_to_cpu(tlv->tag)) {
 		case UNI_EVENT_IE_COUNTDOWN_CSA:
+			if (tlv_len < sizeof(*tlv) + sizeof(*event))
+				return;
+
+			event = (struct mt7996_mcu_countdown_notify *)tlv->data;
+			cdata.omac_idx = event->omac_idx;
 			ieee80211_iterate_active_interfaces_atomic(mt76_hw(dev),
 					IEEE80211_IFACE_ITER_RESUME_ALL,
 					mt7996_mcu_csa_finish, &cdata);
 			break;
 		case UNI_EVENT_IE_COUNTDOWN_BCC:
+			if (tlv_len < sizeof(*tlv) + sizeof(*event))
+				return;
+
+			event = (struct mt7996_mcu_countdown_notify *)tlv->data;
+			cdata.omac_idx = event->omac_idx;
 			ieee80211_iterate_active_interfaces_atomic(mt76_hw(dev),
 					IEEE80211_IFACE_ITER_RESUME_ALL,
 					mt7996_mcu_cca_finish, &cdata);
@@ -525,8 +544,7 @@ mt7996_mcu_ie_countdown(struct mt7996_dev *dev, struct sk_buff *skb)
 			break;
 		}
 
-		data += le16_to_cpu(tlv->len);
-		tlv = (struct tlv *)data;
+		data += tlv_len;
 	}
 }
 
-- 
2.34.1

[PATCH 3/7] wifi: mt76: mt7996: validate EEPROM response lengths

[Jiale Yao]

The EEPROM query reads fixed event fields and copies EFUSE or external
EEPROM data without checking the firmware response length. A truncated
response or an oversized external data length can cause out-of-bounds
reads.

Validate the fixed event, the requested EFUSE bytes, and both the
external data-length field and its payload before copying data.

Fixes: 98686cd21624 ("wifi: mt76: mt7996: add driver for MediaTek Wi-Fi 7 (802.11be) devices")
Fixes: f456e1f56c4c ("wifi: mt76: add external EEPROM support for mt799x chipsets")
Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
 .../net/wireless/mediatek/mt76/mt7996/mcu.c   | 30 +++++++++++++++++--
 1 file changed, 28 insertions(+), 2 deletions(-)

diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
index 1f7af6359dd7..eb868c2d5108 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
@@ -4399,6 +4399,7 @@ int mt7996_mcu_get_eeprom(struct mt7996_dev *dev, u32 offset, u8 *buf, u32 buf_l
 	};
 	struct mt7996_mcu_eeprom_access_event *event;
 	struct sk_buff *skb;
+	size_t data_offset;
 	int ret, cmd;
 	u32 addr;
 
@@ -4424,9 +4425,14 @@ int mt7996_mcu_get_eeprom(struct mt7996_dev *dev, u32 offset, u8 *buf, u32 buf_l
 	if (ret)
 		return ret;
 
+	data_offset = offsetof(struct mt7996_mcu_eeprom_access_event, eeprom);
+	if (skb->len < data_offset) {
+		ret = -EINVAL;
+		goto out;
+	}
+
 	event = (struct mt7996_mcu_eeprom_access_event *)skb->data;
 	if (event->valid) {
-		u32 ret_len = le32_to_cpu(event->eeprom.ext_eeprom.data_len);
 		u32 block = mode == EEPROM_MODE_EXT ? MT7996_EXT_EEPROM_BLOCK_SIZE :
 						      MT7996_EEPROM_BLOCK_SIZE;
 
@@ -4444,16 +4450,35 @@ int mt7996_mcu_get_eeprom(struct mt7996_dev *dev, u32 offset, u8 *buf, u32 buf_l
 		case EEPROM_MODE_EFUSE:
 			if (!buf_len || buf_len > MT7996_EEPROM_BLOCK_SIZE)
 				buf_len = MT7996_EEPROM_BLOCK_SIZE;
+			if (skb->len - data_offset < buf_len) {
+				ret = -EINVAL;
+				break;
+			}
 
 			memcpy(buf, event->eeprom.efuse, buf_len);
 			break;
-		case EEPROM_MODE_EXT:
+		case EEPROM_MODE_EXT: {
+			u32 ret_len;
+
+			if (skb->len - data_offset < sizeof(__le32)) {
+				ret = -EINVAL;
+				break;
+			}
+
+			ret_len = le32_to_cpu(event->eeprom.ext_eeprom.data_len);
+			data_offset += sizeof(__le32);
+			if (ret_len > skb->len - data_offset) {
+				ret = -EINVAL;
+				break;
+			}
+
 			if (!buf_len || buf_len > MT7996_EXT_EEPROM_BLOCK_SIZE)
 				buf_len = MT7996_EXT_EEPROM_BLOCK_SIZE;
 
 			memcpy(buf, event->eeprom.ext_eeprom.data,
 			       ret_len < buf_len ? ret_len : buf_len);
 			break;
+		}
 		default:
 			ret = -EINVAL;
 			break;
@@ -4462,6 +4487,7 @@ int mt7996_mcu_get_eeprom(struct mt7996_dev *dev, u32 offset, u8 *buf, u32 buf_l
 		ret = -EINVAL;
 	}
 
+out:
 	dev_kfree_skb(skb);
 
 	return ret;
-- 
2.34.1

[PATCH 4/7] wifi: mt76: mt7996: validate free-block response length

[Jiale Yao]

The EFUSE free-block query reads a byte after an eight-byte prefix
without checking the firmware response length. A truncated response can
cause an out-of-bounds read.

Require the prefix and block-count byte before accessing the response.

Fixes: f456e1f56c4c ("wifi: mt76: add external EEPROM support for mt799x chipsets")
Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
 drivers/net/wireless/mediatek/mt76/mt7996/mcu.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
index eb868c2d5108..c70d7ad3148c 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
@@ -4516,6 +4516,10 @@ int mt7996_mcu_get_efuse_free_block(struct mt7996_dev *dev, u8 *block_num)
 					sizeof(req), true, &skb);
 	if (ret)
 		return ret;
+	if (skb->len < 8 + sizeof(*block_num)) {
+		dev_kfree_skb(skb);
+		return -EINVAL;
+	}
 
 	*block_num = *(u8 *)(skb->data + 8);
 	dev_kfree_skb(skb);
-- 
2.34.1

[PATCH 5/7] wifi: mt76: mt7996: validate channel MIB response length

[Jiale Yao]

The channel survey query removes a fixed response header and reads four
MIB entries without checking that they are present. A truncated
firmware response can cause out-of-bounds reads.

Require the header and complete MIB array before pulling the skb.

Fixes: 98686cd21624 ("wifi: mt76: mt7996: add driver for MediaTek Wi-Fi 7 (802.11be) devices")
Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
 drivers/net/wireless/mediatek/mt76/mt7996/mcu.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
index c70d7ad3148c..5391666553d9 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
@@ -4627,6 +4627,10 @@ int mt7996_mcu_get_chan_mib_info(struct mt7996_phy *phy, bool chan_switch)
 					&req, sizeof(req), true, &skb);
 	if (ret)
 		return ret;
+	if (skb->len < sizeof(req.hdr) + IDX_NUM * sizeof(*res)) {
+		dev_kfree_skb(skb);
+		return -EINVAL;
+	}
 
 	skb_pull(skb, sizeof(req.hdr));
 
-- 
2.34.1

[PATCH 6/7] wifi: mt76: mt7996: validate temperature response length

[Jiale Yao]

The temperature query reads a fixed firmware event without checking the
response length. A truncated response can cause an out-of-bounds read.

Require the complete thermal event before accessing its temperature.

Fixes: 6879b2e94172 ("wifi: mt76: mt7996: add thermal sensor device support")
Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
 drivers/net/wireless/mediatek/mt76/mt7996/mcu.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
index 5391666553d9..d87851c5fc1d 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
@@ -4702,6 +4702,10 @@ int mt7996_mcu_get_temperature(struct mt7996_phy *phy)
 					&req, sizeof(req), true, &skb);
 	if (ret)
 		return ret;
+	if (skb->len < sizeof(*res)) {
+		dev_kfree_skb(skb);
+		return -EINVAL;
+	}
 
 	res = (void *)skb->data;
 	temp = le32_to_cpu(res->temperature);
-- 
2.34.1

[PATCH 7/7] wifi: mt76: mt7996: validate RF register response length

[Jiale Yao]

The RF register query reads a fixed firmware response without checking
its length. A truncated response can cause an out-of-bounds read.

Require the complete register response before accessing its value.

Fixes: 98686cd21624 ("wifi: mt76: mt7996: add driver for MediaTek Wi-Fi 7 (802.11be) devices")
Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
 drivers/net/wireless/mediatek/mt76/mt7996/mcu.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
index d87851c5fc1d..c248055a2c94 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
@@ -5379,6 +5379,10 @@ int mt7996_mcu_rf_regval(struct mt7996_dev *dev, u32 regidx, u32 *val, bool set)
 					&req, sizeof(req), true, &skb);
 	if (ret)
 		return ret;
+	if (skb->len < sizeof(*res)) {
+		dev_kfree_skb(skb);
+		return -EINVAL;
+	}
 
 	res = (void *)skb->data;
 	*val = le32_to_cpu(res->data);
-- 
2.34.1