1. Patchew
  2. linux
  3. View series

[PATCH] wifi: mt76: connac: fix out of bounds read in mt76_connac2_load_patch()

Bert Karwatzki posted 1 patch 1 month, 3 weeks ago 
drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
[PATCH] wifi: mt76: connac: fix out of bounds read in mt76_connac2_load_patch()
Posted by Bert Karwatzki 1 month, 3 weeks ago 
As sizeof(hdr->build_date) is 16 we reading 17 bytes (sizeof(build_date))
result in the following error:

[    T378] ------------[ cut here ]------------
[    T378] strnlen: detected buffer overflow: 17 byte read of buffer size 16
[    T378] WARNING: lib/string_helpers.c:1036 at __fortify_report+0x3e/0x50, CPU#15: kworker/15:1/378
[...]
[    T378]  mt76_connac2_load_patch.cold+0x2a/0x313 [mt76_connac_lib]
[    T378]  mt792x_load_firmware+0x31/0x140 [mt792x_lib]

Fixes: f804a5895eba ("wifi: mt76: Strip whitespace from build ddate")

Signed-off-by: Bert Karwatzki <spasswolf@web.de>
---
 drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c b/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c
index ea99167765b0..aca3d7870dce 100644
--- a/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c
+++ b/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c
@@ -3125,7 +3125,7 @@ int mt76_connac2_load_patch(struct mt76_dev *dev, const char *fw_name)
 	}
 
 	hdr = (const void *)fw->data;
-	strscpy(build_date, hdr->build_date, sizeof(build_date));
+	strscpy(build_date, hdr->build_date, sizeof(hdr->build_date));
 	build_date[16] = '\0';
 	strim(build_date);
 	dev_info(dev->dev, "HW/SW Version: 0x%x, Build Time: %.16s\n",
-- 
2.47.3

In linux-next-20251217 I noticed the following error during boot:

[    T378] ------------[ cut here ]------------
[    T378] strnlen: detected buffer overflow: 17 byte read of buffer size 16
[    T378] WARNING: lib/string_helpers.c:1036 at __fortify_report+0x3e/0x50, CPU#15: kworker/15:1/378
[    T378] Modules linked in: mt7921e mt7921_common mt792x_lib mt76_connac_lib mt76 mac80211 libarc4 cfg80211 rfkill msr fuse nvme_fabrics configfs efi_pstore efivarfs autofs4 ext4 mbcache jbd2 amdgpu usbhid drm_client_lib i2c_algo_bit drm_ttm_helper ttm drm_exec drm_suballoc_helper drm_buddy xhci_pci drm_panel_backlight_quirks gpu_sched amdxcp xhci_hcd hid_sensor_hub drm_display_helper mfd_core hid_multitouch hid_generic psmouse usbcore nvme drm_kms_helper i2c_hid_acpi amd_sfh i2c_hid hid serio_raw nvme_core cec i2c_piix4 r8169 i2c_smbus usb_common crc16 i2c_designware_platform i2c_designware_core
[    T378] CPU: 15 UID: 0 PID: 378 Comm: kworker/15:1 Not tainted 6.19.0-rc1-next-20251217-master #262 PREEMPT_{RT,(full)} 
[    T378] Hardware name: Micro-Star International Co., Ltd. Alpha 15 B5EEK/MS-158L, BIOS E158LAMS.10F 11/11/2024
[    T378] Workqueue: events mt7921_init_work [mt7921_common]
[    T378] RIP: 0010:__fortify_report+0x3e/0x50
[    T378] Code: 39 c8 48 0f 47 c1 83 e7 01 48 c7 c1 29 ac 54 95 48 8b 34 c5 e0 d5 26 95 48 c7 c0 8c 8f 54 95 48 0f 44 c8 48 8d 3d 42 ba c7 00 <67> 48 0f b9 3a e9 d3 aa a5 ff 0f 1f 84 00 00 00 00 00 f3 0f 1e fa
[    T378] RSP: 0018:ffffb015823a7d18 EFLAGS: 00010246
[    T378] RAX: ffffffff95548f8c RBX: 0000000000000000 RCX: ffffffff95548f8c
[    T378] RDX: 0000000000000011 RSI: ffffffff955319d6 RDI: ffffffff95925070
[    T378] RBP: ffff8ebf90f22560 R08: 0000000000000010 R09: ffffb01581f8d000
[    T378] R10: ffff8ebf80042700 R11: ffff8ec23a7e5930 R12: 0000000000000000
[    T378] R13: ffffb01581f8d000 R14: 0000000000001000 R15: 0000000000000000
[    T378] FS:  0000000000000000(0000) GS:ffff8ec2a49de000(0000) knlGS:0000000000000000
[    T378] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[    T378] CR2: 00007f861de85114 CR3: 0000000025222000 CR4: 0000000000750ef0
[    T378] PKRU: 55555554
[    T378] Call Trace:
[    T378]  <TASK>
[    T378]  __fortify_panic+0xd/0xf
[    T378]  mt76_connac2_load_patch.cold+0x2a/0x313 [mt76_connac_lib]
[    T378]  mt792x_load_firmware+0x31/0x140 [mt792x_lib]
[    T378]  mt7921_run_firmware+0x27/0x490 [mt7921_common]
[    T378]  ? srso_alias_return_thunk+0x5/0xfbef5
[    T378]  ? srso_alias_return_thunk+0x5/0xfbef5
[    T378]  ? ____mt76_poll_msec+0x70/0xb0 [mt76]
[    T378]  mt7921e_mcu_init+0x47/0x75 [mt7921e]
[    T378]  mt7921_init_work+0x4c/0x190 [mt7921_common]
[    T378]  process_one_work+0x17b/0x290
[    T378]  worker_thread+0x17d/0x2e0
[    T378]  ? bh_worker+0x1c0/0x1c0
[    T378]  kthread+0xe9/0x1e0
[    T378]  ? kthreads_online_cpu+0x100/0x100
[    T378]  ? kthreads_online_cpu+0x100/0x100
[    T378]  ret_from_fork+0x23e/0x270
[    T378]  ? kthreads_online_cpu+0x100/0x100
[    T378]  ret_from_fork_asm+0x11/0x20
[    T378]  </TASK>
[    T378] ---[ end trace 0000000000000000 ]---
[    T378] ------------[ cut here ]------------
[    T378] kernel BUG at lib/string_helpers.c:1044!
[    T378] Oops: invalid opcode: 0000 [#1] SMP NOPTI
[    T378] CPU: 15 UID: 0 PID: 378 Comm: kworker/15:1 Tainted: G        W           6.19.0-rc1-next-20251217-master #262 PREEMPT_{RT,(full)} 
[    T378] Tainted: [W]=WARN
[    T378] Hardware name: Micro-Star International Co., Ltd. Alpha 15 B5EEK/MS-158L, BIOS E158LAMS.10F 11/11/2024
[    T378] Workqueue: events mt7921_init_work [mt7921_common]
[    T378] RIP: 0010:__fortify_panic+0xd/0xf
[    T378] Code: d6 e8 57 e6 fe ff 48 89 df e8 7f 5c 23 00 e9 21 80 48 00 66 2e 0f 1f 84 00 00 00 00 00 f3 0f 1e fa 40 0f b6 ff e8 53 c1 48 00 <0f> 0b 48 8b 54 24 08 48 8b 34 24 4c 8d 44 24 1d 4c 89 e9 48 c7 c7
[    T378] RSP: 0018:ffffb015823a7d20 EFLAGS: 00010246
[    T378] RAX: ffffffff95548f8c RBX: 0000000000000000 RCX: ffffffff95548f8c
[    T378] RDX: 0000000000000011 RSI: ffffffff955319d6 RDI: ffffffff95925070
[    T378] RBP: ffff8ebf90f22560 R08: 0000000000000010 R09: ffffb01581f8d000
[    T378] R10: ffff8ebf80042700 R11: ffff8ec23a7e5930 R12: 0000000000000000
[    T378] R13: ffffb01581f8d000 R14: 0000000000001000 R15: 0000000000000000
[    T378] FS:  0000000000000000(0000) GS:ffff8ec2a49de000(0000) knlGS:0000000000000000
[    T378] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[    T378] CR2: 00007f861de85114 CR3: 0000000025222000 CR4: 0000000000750ef0
[    T378] PKRU: 55555554
[    T378] Call Trace:
[    T378]  <TASK>
[    T378]  mt76_connac2_load_patch.cold+0x2a/0x313 [mt76_connac_lib]
[    T378]  mt792x_load_firmware+0x31/0x140 [mt792x_lib]
[    T378]  mt7921_run_firmware+0x27/0x490 [mt7921_common]
[    T378]  ? srso_alias_return_thunk+0x5/0xfbef5
[    T378]  ? srso_alias_return_thunk+0x5/0xfbef5
[    T378]  ? ____mt76_poll_msec+0x70/0xb0 [mt76]
[    T378]  mt7921e_mcu_init+0x47/0x75 [mt7921e]
[    T378]  mt7921_init_work+0x4c/0x190 [mt7921_common]
[    T378]  process_one_work+0x17b/0x290
[    T378]  worker_thread+0x17d/0x2e0
[    T378]  ? bh_worker+0x1c0/0x1c0
[    T378]  kthread+0xe9/0x1e0
[    T378]  ? kthreads_online_cpu+0x100/0x100
[    T378]  ? kthreads_online_cpu+0x100/0x100
[    T378]  ret_from_fork+0x23e/0x270
[    T378]  ? kthreads_online_cpu+0x100/0x100
[    T378]  ret_from_fork_asm+0x11/0x20
[    T378]  </TASK>
[    T378] Modules linked in: mt7921e mt7921_common mt792x_lib mt76_connac_lib mt76 mac80211 libarc4 cfg80211 rfkill msr fuse nvme_fabrics configfs efi_pstore efivarfs autofs4 ext4 mbcache jbd2 amdgpu usbhid drm_client_lib i2c_algo_bit drm_ttm_helper ttm drm_exec drm_suballoc_helper drm_buddy xhci_pci drm_panel_backlight_quirks gpu_sched amdxcp xhci_hcd hid_sensor_hub drm_display_helper mfd_core hid_multitouch hid_generic psmouse usbcore nvme drm_kms_helper i2c_hid_acpi amd_sfh i2c_hid hid serio_raw nvme_core cec i2c_piix4 r8169 i2c_smbus usb_common crc16 i2c_designware_platform i2c_designware_core
[    T378] ---[ end trace 0000000000000000 ]---

The result of this is that my wireless card doesn't work. The patch
above fixes the issue.

Bert Karwatzki
Re: [PATCH] wifi: mt76: connac: fix out of bounds read in mt76_connac2_load_patch()
Posted by Mario Limonciello 1 month, 3 weeks ago 
On 12/17/25 4:26 PM, Bert Karwatzki wrote:
> As sizeof(hdr->build_date) is 16 we reading 17 bytes (sizeof(build_date))
> result in the following error:
> 
> [    T378] ------------[ cut here ]------------
> [    T378] strnlen: detected buffer overflow: 17 byte read of buffer size 16
> [    T378] WARNING: lib/string_helpers.c:1036 at __fortify_report+0x3e/0x50, CPU#15: kworker/15:1/378
> [...]
> [    T378]  mt76_connac2_load_patch.cold+0x2a/0x313 [mt76_connac_lib]
> [    T378]  mt792x_load_firmware+0x31/0x140 [mt792x_lib]
> 
> Fixes: f804a5895eba ("wifi: mt76: Strip whitespace from build ddate")
> 
> Signed-off-by: Bert Karwatzki <spasswolf@web.de>
> ---
>   drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c | 2 +-
>   1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c b/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c
> index ea99167765b0..aca3d7870dce 100644
> --- a/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c
> +++ b/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c
> @@ -3125,7 +3125,7 @@ int mt76_connac2_load_patch(struct mt76_dev *dev, const char *fw_name)
>   	}
>   
>   	hdr = (const void *)fw->data;
> -	strscpy(build_date, hdr->build_date, sizeof(build_date));
> +	strscpy(build_date, hdr->build_date, sizeof(hdr->build_date));
>   	build_date[16] = '\0';
>   	strim(build_date);
>   	dev_info(dev->dev, "HW/SW Version: 0x%x, Build Time: %.16s\n",

FYI - there's already a fix here waiting for a maintainer to pick it.

https://lore.kernel.org/all/CABXGCsMeAZyNJ-Axt_CUCXgyieWPV3rrcLpWsveMPT8R0YPGnQ@mail.gmail.com/

Patchew 2.1-devel-b67e4c2

© 2016 - 2026 Red Hat, Inc.