[PATCH 00/10] wifi: mt76: validate legacy MCU responses

[Jiale Yao]

Several mt7603, mt7615, and mt7915 MCU response paths trust firmware
response sizes before reading receive descriptors, fixed fields, or
arrays. A truncated response can therefore cause an out-of-bounds read.

Validate the common response descriptors and each command-specific
payload before accessing or removing data from the skb.

Jiale Yao (10):
  wifi: mt76: mt7603: validate MCU response length
  wifi: mt76: mt7615: validate MCU response lengths
  wifi: mt76: mt7915: validate MCU response lengths
  wifi: mt76: mt7915: validate MURU statistics response
  wifi: mt76: mt7915: validate EEPROM response length
  wifi: mt76: mt7915: validate free-block response length
  wifi: mt76: mt7915: validate channel MIB response length
  wifi: mt76: mt7915: validate RX rate response length
  wifi: mt76: mt7915: validate WED TX statistics response
  wifi: mt76: mt7915: validate RF register response length

 .../net/wireless/mediatek/mt76/mt7603/mcu.c   |  2 +
 .../net/wireless/mediatek/mt76/mt7615/mcu.c   | 17 ++++++++
 .../net/wireless/mediatek/mt76/mt7915/mcu.c   | 43 +++++++++++++++++--
 3 files changed, 59 insertions(+), 3 deletions(-)

-- 
2.34.1