[PATCH 00/11] wifi: mt76: validate mt792x firmware data

[Jiale Yao]

The mt7921 and mt7925 MCU paths trust firmware response sizes before
reading fixed fields or copying payloads. The shared mt792x firmware
capability parser also derives pointers from unchecked region and
release-info lengths. Malformed firmware data can therefore cause
out-of-bounds reads.

Validate each response before accessing it and keep every firmware
region and release-info record within the loaded image.

Jiale Yao (11):
  wifi: mt76: mt7921: validate MCU response lengths
  wifi: mt76: mt7921: validate EEPROM response length
  wifi: mt76: mt7921: reject malformed TX power responses
  wifi: mt76: mt7921: validate testmode query response
  wifi: mt76: mt7925: validate MCU response lengths
  wifi: mt76: mt7925: validate register query response
  wifi: mt76: mt7925: validate EEPROM response length
  wifi: mt76: mt7925: validate temperature response length
  wifi: mt76: mt7925: validate TX power response length
  wifi: mt76: mt7925: validate radio status response
  wifi: mt76: mt792x: bound firmware release-info parsing

 .../net/wireless/mediatek/mt76/mt7921/mcu.c   | 34 +++++++++++++-
 .../wireless/mediatek/mt76/mt7921/testmode.c  |  4 ++
 .../net/wireless/mediatek/mt76/mt7925/mcu.c   | 43 +++++++++++++++++-
 .../net/wireless/mediatek/mt76/mt792x_core.c  | 44 ++++++++++++++++---
 4 files changed, 117 insertions(+), 8 deletions(-)

-- 
2.34.1