[PATCH 0/2] wifi: mt76: add missing skb length validation

[Aviel Zohar]

This series addresses missing skb length validation in two mt76
drivers before memcpy operations on firmware MCU responses.

In both cases, the driver copies a fixed number of bytes from
skb->data without first checking that skb->len is large enough.
If the firmware returns a shorter-than-expected response (due to a
bug, partial DMA transfer, or in the case of mt7925, a malicious
USB device), the memcpy reads beyond the skb data buffer, causing
a heap buffer over-read. The over-read data is subsequently
returned to userspace.

Patch 1: mt7925 testmode - mt7925_tm_query() copies 512 bytes
(MT7925_EVT_RSP_LEN) from skb->data + 8 without verifying
skb->len >= 520. The leaked data is returned via nla_put()
through nl80211 testmode dump. Fix adds a length check before
the memcpy.

Patch 2: mt7915 txpower - mt7915_mcu_get_txpower_sku() copies
up to 322 bytes (MT7915_SKU_RATE_NUM * 2) from skb->data + 4
without verifying skb->len. The data surfaces through debugfs
(txpower_sku, txpower_path). Fix adds length checks for both
the TX_POWER_INFO_RATE and TX_POWER_INFO_PATH code paths.

Both fixes follow the same pattern: validate skb->len before
performing the memcpy, returning -EINVAL on insufficient data.

Tested by code inspection; I do not have the hardware to
run-test these changes.

Aviel Zohar (2):
  wifi: mt76: mt7925: validate skb length in testmode query
  wifi: mt76: mt7915: validate skb length in txpower SKU query

 drivers/net/wireless/mediatek/mt76/mt7925/testmode.c | 5 +++++
 drivers/net/wireless/mediatek/mt76/mt7915/mcu.c      | 8 ++++++++
 2 files changed, 13 insertions(+)

-- 
2.34.1