[PATCH] wifi: mt76: mt7925: fix out-of-bounds read in mt7925_mac_add_txs

[YuanZhe Liu]

mt7925_queue_rx_skb() walks the TXS entries up to skb->len, but that
length only describes the whole packet. For RX skbs that are not fully
linear, such as the ones built from the fragmented USB RX path,
skb->data only covers skb_headlen(skb) bytes, so the loop advances past
the skb head buffer and mt7925_mac_add_txs() reads outside of the
allocated slab object:

  BUG: KASAN: slab-out-of-bounds in mt7925_mac_add_txs+0xe79/0x1290
  Read of size 4 at addr ffff88800ebea648 by task napi/mt76u-rx-0/209

Bound the iteration by skb_headlen(skb) instead. Fully linear skbs keep
the previous behaviour, since both lengths are equal there.

Fixes: c948b5da6bbe ("wifi: mt76: mt7925: add Mediatek Wi-Fi7 driver for mt7925 chips")
Cc: stable at vger.kernel.org
Co-developed-by: Bin Yu <byu at xidian.edu.cn>
Signed-off-by: Bin Yu <byu at xidian.edu.cn>
Co-developed-by: Cheng Wen <wencheng at xidian.edu.cn>
Signed-off-by: Cheng Wen <wencheng at xidian.edu.cn>
Signed-off-by: YuanZhe Liu <25031212351 at stu.xidian.edu.cn>
---
 drivers/net/wireless/mediatek/mt76/mt7925/mac.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/wireless/mediatek/mt76/mt7925/mac.c b/drivers/net/wireless/mediatek/mt76/mt7925/mac.c
index 3b82c9de26c5..adea216578f5 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7925/mac.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7925/mac.c
@@ -1422,7 +1422,7 @@ void mt7925_queue_rx_skb(struct mt76_dev *mdev, enum mt76_rxq_id q,
 {
 	struct mt792x_dev *dev = container_of(mdev, struct mt792x_dev, mt76);
 	__le32 *rxd = (__le32 *)skb->data;
-	__le32 *end = (__le32 *)&skb->data[skb->len];
+	__le32 *end = (__le32 *)&skb->data[skb_headlen(skb)];
 	enum rx_pkt_type type;
 	u16 flag;
 
-- 
2.34.1